Cover Their Tracks on an Exploited Linux Server with Shell Scripting

Timestamps.sh

#!/bin/bash

if [ $# -eq 0 ]; then
	echo "*** Cover Their Tracks on an Exploited Linux Server ***"
	echo "Use a save (-s) or restore (-r) parameter"
	exit 1 
fi

#Writing Timestamps to a File

if [ $1 = "-s" ] ; then
	rm -f bkp-timestamps;
	ls -l | sed -n ‘s/^.*Jan/01/p;s/^.*Feb/02/p;s/^.*Mar/03/p;s/^.*Apr/04/p;s/^.*May/05/p;s/^.*Jun/06/p;s/^.*Jul/07/p;s/^.*Aug/08/p;s/^.*Sep/09/p;s/^.*Oct/10/p;s/^.*Nov/11/p;s/^.*Dec/12/p;’ >>bkp-timestamps
fi

#Restoring Timestamps to Files

if $1 = "-r" ; then
	cat bkp-timestamps | while read line
		do
			MONTH=$(echo $line | cut -f1 -d\ );
			DAY=$(echo $line | cut -f2 -d\ );
			FILENAME=$(echo $line | cut -f4 -d\ );
			YEAR=$(echo $line | cut -f3 -d\ )
			CURRENTYEAR=$(cal | head -1 | cut -f6- -d\ | sed 's/ //g')
			if [ $YEAR == *:* ]; then
				touch -d $CURRENTYEAR-$MONTH-$DAY\ $YEAR:00 $FILENAME;
			else
				touch -d ""$YEAR-$MONTH-$DAY"" $FILENAME;
			fi
		done
fi