The trick: a second root

Only root should be root

Here is the trick to watch for. An attacker adds a brand-new account but gives it UID 0. Now that account has full power, just like root, but it has an innocent name like backup or sysmon, so it blends in.

You do not have to read the whole file by eye. This one line prints the name of every account whose UID is 0 — on a clean machine, that is only root:

awk -F: '$3 == 0 {print $1}' /etc/passwd

In the terminal

student@vulntech:~$ awk -F: '$3 == 0 {print $1}' /etc/passwd
root

awk -F: splits each line on the colons, and $3 == 0 keeps only the lines where the third field (the UID) is 0. If anything other than root comes back, you have found a hidden superuser.

Tip: Learn this one by heart. “Which accounts are UID 0?” is one of the fastest checks a defender can run after an alert.