Unit 1: The shell and the filesystem · Lesson 3 of 5 · 16 min
What ls does not show
Find dotfiles, read the handover note and uncover a server that was never wiped.
mission
- You are
- You are checking what the previous admin left behind.
- Situation
- A plain
lsof your home shows one file. Admins often keep notes in dotfiles, and leftovers hide the same way. - Goal
- List everything, hidden entries included, and read what matters.
- Hand in
- The name of the hidden note, the web root and the forgotten server.
List everything
ls README.txt ls -la total 24 drwxr-xr-x 1 learner learner 4096 Oct 14 09:00 . drwxr-xr-x 1 root root 4096 Oct 14 09:00 .. -rw-r--r-- 1 learner learner 3771 Oct 14 09:00 .bashrc -rw------- 1 learner learner 298 Oct 14 09:00 .handover -rw-r--r-- 1 learner learner 807 Oct 14 09:00 .profile -rw-r--r-- 1 learner learner 247 Oct 14 09:00 README.txt
you should see Three dotfiles. .bashrc and .profile are shell settings. The odd one is mode -rw-------: private to you.
Read the handover
cat .handover
Handover notes from the previous admin
Web root: /var/www/html
Server inventory: /srv/inventory
App config: /srv/app/config
Things I never got round to:
- review who can log in over SSH
- check the web logs for scanners
- tidy up the sudo rules
- clean up the old backup helper in /usr/local/bin
you should see Three paths and a to-do list. That list is the plan for the rest of this course.
Look for leftovers
Defenders run tree -a on data folders because old copies and forgotten records hide in dot directories.
tree -a /srv/inventory /srv/inventory ├── .old │ └── servers-2019.txt ├── network │ ├── firewall.nft │ └── vlans.txt └── servers ├── backup01.txt ├── db01.txt └── web01.txt 4 directories, 6 files cat /srv/inventory/.old/servers-2019.txt hostname: web00 role: retired website server ip: 10.20.0.5 os: Ubuntu 18.04 status: decommissioned, never wiped
you should see A retired server that still exists on the network with an unsupported OS. That is a real finding.
defender tip Write it down now. Old machines that were never wiped are a favourite way into networks.
What a defender takes away
- 1Hidden is not secret. Permissions protect files, dots do not.
- 2Always look with ls -la and tree -a.
- 3Leftovers are findings: record them as you go.
Questions
0 of 4 solved
Answer each one from what you find on your lab machine.