Thursday, September 19, 2019

Who the hack, smj@sdf-eu.org…

$ ssh inne@sdf-eu.org
$ id
uid=63320(inne) gid=500(arpa) groups=500(arpa),700(dba),900(motd)
$ cd html
$ pwd
/arpa/i/inne/html
$ ls -la blog/fp-content/config-
total 24
drwxr-xr-x   2 smj   www  512 Dec 21  2018 .
drwxrwxrwx  20 inne  www  512 Sep 19 09:18 ..
-rwxr-xr-x   1 smj   www  105 Dec 21  2018 hashsalt.conf.php
$ find . ! -user inne -ls
6127797      8 -rw-r--r--    1 smj               www                    1321 Dec 21  2018 ./blog/fp-content/cache/3bf98dedb3c35f3273999e760a1202ba^%%45^451^4517C1A5%%previewstatic.tpl.php
6127794      8 -rw-r--r--    1 smj               www                    1966 Dec 21  2018 ./blog/fp-content/cache/3bf98dedb3c35f3273999e760a1202ba^%%19^196^19602E26%%login.tpl.php
6127796     16 -rw-r--r--    1 smj               www                    4666 Dec 21  2018 ./blog/fp-content/cache/3bf98dedb3c35f3273999e760a1202ba^%%3D^3D1^3D1C1A4B%%rss.tpl.php
6127798     16 -rw-r--r--    1 smj               www                    5226 Dec 22  2018 ./blog/fp-content/cache/3bf98dedb3c35f3273999e760a1202ba^%%54^547^54750FC1%%comment-rss.tpl.php
6127799     16 -rw-r--r--    1 smj               www                    5771 Dec 22  2018 ./blog/fp-content/cache/3bf98dedb3c35f3273999e760a1202ba^%%63^632^632BB7AF%%comment-atom.tpl.php
6127800     16 -rw-r--r--    1 smj               www                    4588 Dec 21  2018 ./blog/fp-content/cache/3bf98dedb3c35f3273999e760a1202ba^%%6E^6E2^6E2FB484%%atom.tpl.php
6127801      8 -rw-r--r--    1 smj               www                    3164 Dec 21  2018 ./blog/fp-content/cache/3bf98dedb3c35f3273999e760a1202ba^%%74^74C^74CD5DC3%%main.tpl.php
6127802      8 -rw-r--r--    1 smj               www                    2286 Dec 21  2018 ./blog/fp-content/cache/3bf98dedb3c35f3273999e760a1202ba^%%8B^8BC^8BC3BA8C%%delete.php
6127803      8 -rw-r--r--    1 smj               www                    1295 Dec 21  2018 ./blog/fp-content/cache/3bf98dedb3c35f3273999e760a1202ba^%%C3^C3F^C3F9BD33%%login_success.tpl.php
6127804      8 -rw-r--r--    1 smj               www                    1966 Dec 21  2018 ./blog/fp-content/cache/e93fccb09cf8b04111b9595da102f3f4^%%19^196^19602E26%%login.tpl.php
6127805      8 -rw-r--r--    1 smj               www                    3164 Dec 21  2018 ./blog/fp-content/cache/e93fccb09cf8b04111b9595da102f3f4^%%74^74C^74CD5DC3%%main.tpl.php
6127806     24 -rw-r--r--    1 smj               www                   10511 Dec 21  2018 ./blog/fp-content/cache/e93fccb09cf8b04111b9595da102f3f4^%%98^98A^98A39EF3%%default.php
6127807      8 -rw-r--r--    1 smj               www                    1239 Dec 21  2018 ./blog/fp-content/cache/e93fccb09cf8b04111b9595da102f3f4^%%BF^BFC^BFC59AF9%%updates.php
6127808      8 -rw-r--r--    1 smj               www                    1295 Dec 21  2018 ./blog/fp-content/cache/e93fccb09cf8b04111b9595da102f3f4^%%C3^C3F^C3F9BD33%%login_success.tpl.php
6127811      8 -rwxr-xr-x    1 smj               www                     183 Dec 21  2018 ./blog/fp-content/users/Inne.php
6127809      8 -rwxr-xr-x    1 smj               www                     472 Dec 21  2018 ./blog/fp-content/content/16/06/entry160614-151538.txt
6127810      8 -rwxr-xr-x    1 smj               www                     171 Dec 21  2018 ./blog/fp-content/content/static/404.txt
7489536      8 drwxr-xr-x    2 smj               www                     512 Dec 21  2018 ./blog/fp-content/config-
7489540      8 -rwxr-xr-x    1 smj               www                     105 Dec 21  2018 ./blog/fp-content/config-/hashsalt.conf.php
7489537      8 drwxr-xr-x    2 smj               www                     512 Dec 21  2018 ./blog/fp-content/index1545381278
7489542      8 -rw-r--r--    1 smj               www                    1034 Dec 21  2018 ./blog/fp-content/index1545381278/index.strings.dat
7489541      8 -rw-r--r--    1 smj               www                     508 Dec 21  2018 ./blog/fp-content/index1545381278/index-0.dat
7489538      8 drwxr-xr-x    2 smj               www                     512 Dec 21  2018 ./blog/fp-content/index1545382052
7489545      8 -rw-r--r--    1 smj               www                     508 Dec 21  2018 ./blog/fp-content/index1545382052/index-10.dat
7489543      8 -rw-r--r--    1 smj               www                    1966 Dec 21  2018 ./blog/fp-content/index1545382052/index-0.dat
7489544      8 -rw-r--r--    1 smj               www                     508 Dec 21  2018 ./blog/fp-content/index1545382052/index-1.dat
7489557     32 -rw-r--r--    1 smj               www                   13834 Dec 21  2018 ./blog/fp-content/index1545382052/index.strings.dat
7489546      8 -rw-r--r--    1 smj               www                     508 Dec 21  2018 ./blog/fp-content/index1545382052/index-11.dat
7489547      8 -rw-r--r--    1 smj               www                     508 Dec 21  2018 ./blog/fp-content/index1545382052/index-12.dat
7489548      8 -rw-r--r--    1 smj               www                     508 Dec 21  2018 ./blog/fp-content/index1545382052/index-16.dat
7489549      8 -rw-r--r--    1 smj               www                     508 Dec 21  2018 ./blog/fp-content/index1545382052/index-17.dat
7489550      8 -rw-r--r--    1 smj               www                     508 Dec 21  2018 ./blog/fp-content/index1545382052/index-18.dat
7489551      8 -rw-r--r--    1 smj               www                     508 Dec 21  2018 ./blog/fp-content/index1545382052/index-19.dat
7489552      8 -rw-r--r--    1 smj               www                     508 Dec 21  2018 ./blog/fp-content/index1545382052/index-2.dat
7489553      8 -rw-r--r--    1 smj               www                     508 Dec 21  2018 ./blog/fp-content/index1545382052/index-21.dat
7489554      8 -rw-r--r--    1 smj               www                     508 Dec 21  2018 ./blog/fp-content/index1545382052/index-22.dat
7489555      8 -rw-r--r--    1 smj               www                     508 Dec 21  2018 ./blog/fp-content/index1545382052/index-3.dat
7489556      8 -rw-r--r--    1 smj               www                    1480 Dec 21  2018 ./blog/fp-content/index1545382052/index-6.dat
7489539      8 drwxr-xr-x    2 smj               www                     512 Dec 21  2018 ./blog/fp-content/index1545384385
7489560      8 -rw-r--r--    1 smj               www                     508 Dec 21  2018 ./blog/fp-content/index1545384385/index-10.dat
7489558      8 -rw-r--r--    1 smj               www                    1966 Dec 21  2018 ./blog/fp-content/index1545384385/index-0.dat
7489559      8 -rw-r--r--    1 smj               www                     508 Dec 21  2018 ./blog/fp-content/index1545384385/index-1.dat
7489572     32 -rw-r--r--    1 smj               www                   13834 Dec 21  2018 ./blog/fp-content/index1545384385/index.strings.dat
7489561      8 -rw-r--r--    1 smj               www                     508 Dec 21  2018 ./blog/fp-content/index1545384385/index-11.dat
7489562      8 -rw-r--r--    1 smj               www                     508 Dec 21  2018 ./blog/fp-content/index1545384385/index-12.dat
7489563      8 -rw-r--r--    1 smj               www                     508 Dec 21  2018 ./blog/fp-content/index1545384385/index-16.dat
7489564      8 -rw-r--r--    1 smj               www                     508 Dec 21  2018 ./blog/fp-content/index1545384385/index-17.dat
7489565      8 -rw-r--r--    1 smj               www                     508 Dec 21  2018 ./blog/fp-content/index1545384385/index-18.dat
7489566      8 -rw-r--r--    1 smj               www                     508 Dec 21  2018 ./blog/fp-content/index1545384385/index-19.dat
7489567      8 -rw-r--r--    1 smj               www                     508 Dec 21  2018 ./blog/fp-content/index1545384385/index-2.dat
7489568      8 -rw-r--r--    1 smj               www                     508 Dec 21  2018 ./blog/fp-content/index1545384385/index-21.dat
7489569      8 -rw-r--r--    1 smj               www                     508 Dec 21  2018 ./blog/fp-content/index1545384385/index-22.dat
7489570      8 -rw-r--r--    1 smj               www                     508 Dec 21  2018 ./blog/fp-content/index1545384385/index-3.dat
7489571      8 -rw-r--r--    1 smj               www                    1480 Dec 21  2018 ./blog/fp-content/index1545384385/index-6.dat