Home / Labs / Enumerate the Users

Enumerate the Users

The attacker had root. Read /etc/passwd and /etc/shadow to find planted accounts.

Open this lab

Commands practised here

• cat /evidence/passwd-snapshot.txtShows all user accounts on the system.
• awk -F: '$3 == 0' /evidence/passwd-snapshot.txtFinds all accounts with UID 0 (root-level).
• cat /evidence/shadow-snapshot.txtShows password hashes for all accounts.
• grep 'NOPASSWD' /evidence/sudoers-global.txtShows who has passwordless sudo access.

Nearby labs

• All labsBrowse the full list.
• Exam prepWhich exams these objectives map to.
• Map the User Sessions
• Trace the Web Attack