Finding the Answers

Three questions, three methods

Forensics questions repeat from image to image. Learn the three shapes and you have seen most of what a Linux round will ask.

Shape one: which account has power it should not

Open the account file:

sudo nano /etc/passwd

Every line is one account, with the pieces separated by colons:

root:x:0:0:root:/root:/bin/bash
 │   │ │
 │   │ └── the third item is the one that matters
 │   └──── ignore this
 └──────── the name

The third item is the account's power level. Anything with 0 there has complete control of the machine, no matter what it is called. Exactly one line should have a 0, and that line should be root.

Scroll down the file and read the third item on each line. If a second line has a 0, you have found your answer. Press Ctrl+X to leave without changing anything.

💡 The name means nothing here. An account called backup with a 0 has more power than an account called admin without one. Read the number, not the word.

Shape two: find a file when you only know who owns it

sudo find / -xdev -user NAME 2>/dev/null

That lists every file on the machine owned by that account. Two pieces are doing real work:

• 2>/dev/null hides the "permission denied" noise from folders nobody is allowed to read, so the real answers are not buried in it.
• -xdev keeps the search on the actual disk. Without it you also walk /proc, which is not files at all, it is a live view of every running program. That alone can be seventy thousand extra lines.

Search an ordinary unauthorized account, not the one with the 0. This is the part that catches people out. An account with a power level of 0 owns everything root owns, which is most of the operating system, so searching for that one returns hundreds of thousands of results and the file you want is buried. The thing you are looking for belongs to one of the other accounts that should not be on the machine.

Most of what comes back will be inside /home, which is where people's files normally live and is not interesting. You want the one that is somewhere else, so cut /home out of the results:

sudo find / -xdev -user NAME 2>/dev/null | grep -v '^/home'

That usually leaves a handful of lines, and your answer is one of them.

Shape three: text that has been scrambled

If a question gives you a string of nonsense, do not try to work it out by hand. Paste it into an online cipher identifier, which will tell you what kind of scrambling it is, and most of them will unscramble it for you in the same step.

Two that work well:

Once you know what it is, reversing it is a button press. The skill being tested is recognizing that something is encoded and knowing where to take it, not doing the arithmetic in your head.

Try it yourself

Work the three shapes on your machine and write down what you find:

sudo nano /etc/passwd        # read the third item on each line

Then look in /home/yaga/Documents for anything that looks like nonsense, and paste it into CyberChef.