One Hat Cyber Team

Your IP : 216.73.217.176

Server IP : 185.33.55.30

Server : Linux cl30.webspacecontrol.com 5.14.0-611.38.1.el9_7.x86_64 #1 SMP PREEMPT_DYNAMIC Tue Mar 10 17:21:28 EDT 2026 x86_64

Server Software : Apache

PHP Version : 8.3.33

Buat File | Buat Folder

Dir : ~/etc/profile.d/

Edit File: rcs.sh

# Root interactive command shadow history
# Only for interactive root bash shells.
# Delayed activation: avoids logging /etc/profile.d startup noise.

[ -n "$BASH_VERSION" ] || return 0
[ "$EUID" -eq 0 ] || return 0

case "$-" in
    *i*) ;;
    *) return 0 ;;
esac

__ROOT_SHADOW_DIR="/var/log/rcs"
__ROOT_SHADOW_FILE="${__ROOT_SHADOW_DIR}/.history"

mkdir -p "$__ROOT_SHADOW_DIR" 2>/dev/null
chmod 700 "$__ROOT_SHADOW_DIR" 2>/dev/null
touch "$__ROOT_SHADOW_FILE" 2>/dev/null
chmod 600 "$__ROOT_SHADOW_FILE" 2>/dev/null

__ROOT_SHADOW_LAST_CMD=""
__ROOT_SHADOW_ENABLED=0

__root_shadow_is_noise() {
    local cmd="$1"
    local pwd_now="$PWD"

[ -n "$cmd" ] || return 0

# Teljesen felesleges history / prompt zaj
    case "$cmd" in
        history\ -a*|history\ -n*|history\ -w*|history\ -r*|history\ -c*)
            return 0
            ;;

pwd\ 1\>\&7*|kill\ -STOP\ \$\$*)
            return 0
            ;;

__root_shadow_*|trap\ *DEBUG*|PROMPT_COMMAND=*|export\ PROMPT_COMMAND=*)
            return 0
            ;;
    esac

# /etc/profile.d környéki indulási zaj
    if [ "$pwd_now" = "/etc/profile.d" ]; then
        case "$cmd" in
            history\ -a*|pwd\ 1\>\&7*|kill\ -STOP\ \$\$*)
                return 0
                ;;
        esac
    fi

case "$cmd" in
        for\ i\ in\ /etc/profile.d/*)
            return 0
            ;;
        "[ -r \"\$i\" ]"*|"[ \"\$PS1\" ]"*|". \"\$i\""*|unset\ i*|unset\ -f\ pathmunge*)
            return 0
            ;;
    esac

# Midnight Commander / mc-wrapper belső könyvtárváltások
    case "$cmd" in
        cd\ \"\`printf\ \"\%b\"*)
            return 0
            ;;
        cd\ \"\$\(printf\ \"\%b\"*)
            return 0
            ;;
        ". /usr/libexec/mc/mc-wrapper.sh"*)
            return 0
            ;;
    esac

# cPanel/profile zaj
    case "$cmd" in
        export\ HISTCONTROL=*|shopt\ -s\ histappend|alias\ munin-run=*)
            return 0
            ;;
        LOCALLIBUSER=*|NEW_PATH=*|PATH=\$NEW_PATH|export\ PATH)
            return 0
            ;;
        "[ -x \"/usr/local/cpanel/3rdparty/bin/perl\" ]"*|"[ ! -z \"\$NEW_PATH\" ]"*|"[ -e \"/usr/bin/whoami\" ]"*)
            return 0
            ;;
        "[ \"\$LOCALLIBUSER\" != \"root\""*)
            return 0
            ;;
    esac

return 1
}

__root_shadow_log_command() {
    local rc="$?"
    local cmd="$BASH_COMMAND"

[ "$__ROOT_SHADOW_ENABLED" = "1" ] || return "$rc"

# Duplikációk ellen
    if [ "$cmd" = "$__ROOT_SHADOW_LAST_CMD" ]; then
        return "$rc"
    fi

__ROOT_SHADOW_LAST_CMD="$cmd"

if __root_shadow_is_noise "$cmd"; then
        return "$rc"
    fi

local now
    local tty_name
    local pwd_now

now="$(TZ="Europe/Budapest" date '+%Y-%m-%d %H:%M:%S %Z')"
    tty_name="$(tty 2>/dev/null || echo unknown)"
    pwd_now="$PWD"

printf '%s | user=root | tty=%s | pwd=%s | cmd=%s\n' \
        "$now" "$tty_name" "$pwd_now" "$cmd" >> "$__ROOT_SHADOW_FILE" 2>/dev/null

return "$rc"
}

__root_shadow_enable_after_first_prompt() {
    __ROOT_SHADOW_ENABLED=1
    trap '__root_shadow_log_command' DEBUG

# Saját aktiváló hook eltávolítása a PROMPT_COMMAND-ból, hogy ne ismétlődjön.
    PROMPT_COMMAND="${PROMPT_COMMAND/__root_shadow_enable_after_first_prompt; /}"
    PROMPT_COMMAND="${PROMPT_COMMAND/__root_shadow_enable_after_first_prompt;/}"
    PROMPT_COMMAND="${PROMPT_COMMAND/__root_shadow_enable_after_first_prompt/}"
}

case ";$PROMPT_COMMAND;" in
    *";__root_shadow_enable_after_first_prompt;"*) ;;
    *)
        PROMPT_COMMAND="__root_shadow_enable_after_first_prompt; ${PROMPT_COMMAND}"
        ;;
esac