Lire en françaisع
Menu

Back to the Academy

CLR-1 · Hands-on lab · Easy ·about 20 min

Linux: the hidden files

Your first day on a server: find what the previous analyst left behind, a risky permission and a burst of SSH logins, using only the terminal.

Briefing

It is your first day in the SOC. Your team lead gives you a shell on srv01, an internal Ubuntu server, with the analyst account, and asks for a first look before you get your own tickets.

Three things to check:

  1. The previous analyst left handover notes somewhere in your home directory, but you will not see them at first glance.
  2. Someone set up a job in /opt in a hurry: check who can change those files.
  3. This morning the SSH log in /var/log was noisy. Measure how bad it was.

Everything happens in the terminal below. Start with help, then ls, cd and cat. Nothing here touches a real system: it is a simulated server running in your browser.

Good habit: read before you act. README.txt and the ticket in tickets/ tell you what the team expects.

Terminal

Type help to list the commands. Tab completes, ↑ ↓ browse the history.

Questions

  1. The previous analyst left notes in your home directory (/home/analyst), in a hidden file. What is its name, exactly as ls -a shows it?25 XP

    1. Read that file. It contains a flag in the form ZEN{...}. What is it?25 XP

      1. In /opt, one file can be modified by any user on the system. Which user owns it?25 XP

        1. How many failed SSH password attempts came from the IP 203.0.113.45 in /var/log/auth.log? Give a number.25 XP