Live Linux Forensics training coming up @WWHackinFest Deadwood! Let's do some daily Linux Forensics trivia as a lead-up! wildwesthackinfest.com/deadw…
34
50
2
95
Replying to @hal_pomeranz @WWHackinFest
Daily Linux Forensics Trivia #25 —A user’s .bash_history file shows repeated use of “sudo vim” with no other arguments. What other artifact could you inspect to get a better picture of their activities?

Sep 30, 2022 · 12:12 PM UTC

3
2
7
Trivia Answer #25 - Look at the user’s $HOME/.viminfo file. The file contains information on recently edited files, search terms, commands typed at the “:” prompt, and (probably most useful in this case) commands executed via shell escape.
3
Replying to @hal_pomeranz @WWHackinFest
Vimcache files owned by root?
Replying to @hal_pomeranz @WWHackinFest
I would say it’s a false positive - everyone knows most people don’t know how to escape VIM so it’s probably just another instance of VIM jail. 🤣 ok seriously, I will just sit patiently and wait for the real answer.