Home / Labs / Suspicious Accounts

Suspicious Accounts

Audit the account list for anything that should not be there. UID 0 is full root, so a second account holding it is almost always a backdoor someone added for themselves.

Open this lab

Commands practised here

• awk -F: '$3==0' /etc/passwdEvery account with UID 0. There should be one.
• awk -F: '$3>=1000' /etc/passwdRegular human accounts that can log in.
• last -20Recent login history, including source addresses.

Nearby labs

• All labsBrowse the full list.
• Exam prepWhich exams these objectives map to.
• Correlate the Login Log
• What's Here?