LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Software (https://www.linuxquestions.org/questions/linux-software-2/)
-   -   Linux dir and dates (https://www.linuxquestions.org/questions/linux-software-2/linux-dir-and-dates-858885/)

Red Squirrel 01-26-2011 05:01 PM

Linux dir and dates
 
It only occured to me now, but why is it that date listings are not consistent? ex:

Code:

  4 drwxr-xr-x 2 iceteks iceteks  4096 Mar 26  2010 fonts
  4 drwxr-xr-x 8 iceteks iceteks  4096 Mar 26  2010 html
 16 -rw-r--r-- 1 iceteks iceteks  13123 Aug 19 17:43 index.php
  4 drwxr-xr-x 3 iceteks iceteks  4096 Mar 26  2010 lang
  8 -rw-r--r-- 1 iceteks iceteks  5434 Mar 26  2010 lasttopics.php

They are all Month Day Year but one (from that particular extract, there's more), why is the 3rd there one Month Day Time? I know the year is not 2011 because we have not hit august 2011 yet, but what if it's 2009 or 2008? I would not know.

One of my sites got hacked and I'm just trying to figure out what the hacker got into and trying to figure how he got in so I can fix the exploit.

eSelix 01-26-2011 05:17 PM

Try
Code:

ls --full-time
By the way - changing index.php is often method used by hackers/bots. They usualy get passwords to ftp stored in ftp client applications, like TotalCommander, by trojans installed on PC.

z1p 01-26-2011 05:29 PM

Looking up info on ls or using man will give you more info, but the basic answer is if the file was modified recently (I believe within the last 6 months) then the time is shown instead of the year. So if the time is shown, you know the date is within the last months, and from there can easily determine the year.

If you want to get a more consistent or specific date format, check the man for ls. Depending you version of you may be able to specify the date format.

Red Squirrel 01-27-2011 11:44 AM

Oh ok, so it's time based, so last 6 months it shows differently. That's good to know. I don't see any files that were modified so I'm thinking the attack was SQL injection and they modified the templates in the database. I never use FTP so my password is never sent in clear text.

I just need to find this injection exploit and fix it.


All times are GMT -5. The time now is 08:11 AM.