Printable View
Where do i go to see how i got hacked?
A new user was made (standard account) which i then think made another FTP account. When i started my kali up, i saw the 3 login account options (my standard account, a second standard account, and an FTP standard account). How can I find out when this was done, how it was done? And most importantly, how to return the favor?
nevermind (i think)...
the new standard user account is named munin and the other new standard account is named ftpuser.
i did a find / -name *munin* search and came up with
/var/lib/AccountService/users/munindoc
/usr/share/bash-completetion/completions/munindoc
/usr/share/bash-completetion/completions/munin-update
/usr/share/bash-completetion/completions/munin-node-configure
/usr/share/bash-completetion/completions/munin-run
/usr/share/selinux/default/munin.pp
selinux looked familiar to me (as i went on an apt-get install binge the other day) i was going through forums and installing everything that looked interesting that was recommended. I am assuming(?) that these other files were created from the install of selinux? but would selinux create 2 user accounts? or... ?