title: analyzing hacked website log : is thee any link between ./etc and ./tmp when uploading files ?
body: <p>so one of my friends got hacked and asked me for help 
  this guy had a single shared host and uploaded like 20 website on that single host and one of them got hacked and now all of them are full of shells </p>
  
  <p>so this happen today , so i asked for list of files that has been created or changed on the server since so i got the list something like below </p>
  
  <p>the shell name is <code>accesson.php</code>  it first appears in </p>
  
  <pre><code>./etc/assets/images/accesson.php
  </code></pre>
  
  <p>and than in </p>
  
  <pre><code>./tmp/assets/images/accesson.php
  </code></pre>
  
  <p>log : </p>
  
  <pre><code>./etc
  ./etc/newsss.com
  ./etc/shsh.com
  ./etc/nck.com
  ./etc/pvf.com
  ./etc/pvf.com/@pwcache/info
  ./etc/lck.com
  ./etc/assets
  ./etc/assets/images
  ./etc/assets/images/accesson.php
  ./tmp
  ./tmp/assets
  ./tmp/assets/images
  ./tmp/assets/images/accesson.php
  ./mail
  ./mail/new
  ./mail/tmp
  ./mail/assets
  ./mail/assets/images
  ./mail/assets/images/accesson.php
  
  
  
  ./public_html
  ./public_html/images/2017/01/162210999.jpg.CROP_.cq5dam_web_1280_1280_jpeg-280x200.jpg
  ./public_html/wp-content/plugins
  ./public_html/.ftpquota
  ./public_html/backlinks/error_log
  ./public_html/app/images
  ./public_html/app/images/css_sprites.png
  ./public_html/app/index.php
  ./public_html/assets
  ./public_html/assets/images
  ./public_html/assets/images/accesson.php
  ./public_ftp
  ./public_ftp/assets
  ./public_ftp/assets/images
  ./public_ftp/assets/images/accesson.php
  
   ./irso.com
  ./irso.com/.ftpquota
  ./irso.com/wp-content/plugins
  ./irso.com/wp-content/themes
  ./irso.com/assets
  ./irso.com/assets/images
  ./irso.com/assets/images/accesson.php
  
  ./ncl2.com
  ./ncl2.com/assets
  ./ncl2.com/assets/images
  ./ncl2.com/assets/images/accesson.php
  ./cache
  ./cache/assets
  ./cache/assets/images
  ./cache/assets/images/accesson.php
  ./ssl
  ./ssl/assets
  ./ssl/assets/images
  ./ssl/assets/images/accesson.php
  
  
  ./efr.com
  ./efr.com/.ftpquota
  ./efr.com/assets
  ./efr.com/assets/images
  ./efr.com/assets/images/accesson.php
  </code></pre>
  
  <p>it seems <code>accesson.php</code> has been spread trough all directories interesting thing is its been created with its directory  <code>/assets/images/</code>  even in the tmp </p>
  
  <p>so i thought since it first appeasers in ./tmp it must be uploaded trough some bug since all uploaded files first go to ./tmp but what about that ./etc ? its even before ./tmp .... so i thought maybe there is a link between the 2 ? </p>
  
  <p>i appreciate any suggestion </p>