Page History

...

For reference, the kerberods binary I found had signatures:

Application-level vulnerabilities

...

• Check the audit log for suspicious admin activity, but be aware that the audit log is not trustable at this point.

• Identify accounts whose password has recently changed, by comparing password hashes with that from a recent backup.
  This command compares the cwd_user  table from a monthly backup to that from the current confluence database:

  Code Block
  # vim -d <(pg_restore -t cwd_user --data-only /var/atlassian/application-data/confluence/backups/monthly.0/database/confluence) \ <(sudo -u postgres PGDATABASE=confluence pg_dump -t cwd_user --data-only)

  (diffing database dumps like this is a generally useful technique, described here)
  
  

• Check for users logging in from strange IPs, e.g. foreign countries or VPSes.
  This lnav command prints a summary of Confluence access counts grouped by username and originating IP hostname

  Code Block
  jturner@jturner-desktop:~/redradishtech.com.au/clients/$client/hack$ lnav var/log/apache2/confluence.$client.com.au/access.log* -c ";select count, cs_username, gethostbyaddr(c_ip) from (select distinct cs_username, c_ip, count(*) AS count from access_log group by 1,2 order by 3 desc limit 15) x;"

  The originating IPs do not look suspicious for a small Australian business:
  
  

...