Linux dir and dates

Red Squirrel · 01-26-2011, 05:01 PM

It only occured to me now, but why is it that date listings are not consistent? ex:

Code:

  4 drwxr-xr-x 2 iceteks iceteks   4096 Mar 26  2010 fonts
  4 drwxr-xr-x 8 iceteks iceteks   4096 Mar 26  2010 html
 16 -rw-r--r-- 1 iceteks iceteks  13123 Aug 19 17:43 index.php
  4 drwxr-xr-x 3 iceteks iceteks   4096 Mar 26  2010 lang
  8 -rw-r--r-- 1 iceteks iceteks   5434 Mar 26  2010 lasttopics.php

They are all Month Day Year but one (from that particular extract, there's more), why is the 3rd there one Month Day Time? I know the year is not 2011 because we have not hit august 2011 yet, but what if it's 2009 or 2008? I would not know.

One of my sites got hacked and I'm just trying to figure out what the hacker got into and trying to figure how he got in so I can fix the exploit.

eSelix · 01-26-2011, 05:17 PM

Try

Code:

ls --full-time

By the way - changing index.php is often method used by hackers/bots. They usualy get passwords to ftp stored in ftp client applications, like TotalCommander, by trojans installed on PC.

z1p · 01-26-2011, 05:29 PM

Looking up info on ls or using man will give you more info, but the basic answer is if the file was modified recently (I believe within the last 6 months) then the time is shown instead of the year. So if the time is shown, you know the date is within the last months, and from there can easily determine the year.

If you want to get a more consistent or specific date format, check the man for ls. Depending you version of you may be able to specify the date format.

Red Squirrel · 01-27-2011, 11:44 AM

Oh ok, so it's time based, so last 6 months it shows differently. That's good to know. I don't see any files that were modified so I'm thinking the attack was SQL injection and they modified the templates in the database. I never use FTP so my password is never sent in clear text.

I just need to find this injection exploit and fix it.