Find the hidden superuser
An alert says this machine may have a sneaky extra admin account. Somewhere in the user list is an account that is not root but still has UID 0 — a second superuser the attacker left behind.
Find it, note its name, then remove it so the attacker loses that key. Finally, record what you found.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Hints
List UID-0 accounts: `awk -F: '$3 == 0 {print $1}' /etc/passwd`.
Remove the one that is not root with `sudo userdel -f
Solution explanation
The awk check listed two UID-0 accounts: root (expected) and sysbak (not expected). That extra superuser was the attacker's spare key. userdel -f sysbak removed it, and you wrote the name into your findings so the next person knows what was cleaned up. Checking for surprise UID-0 accounts is one of the quickest, highest-value things a defender does.
Show solution
awk -F: '$3 == 0 {print $1}' /etc/passwd
sudo userdel -f sysbak
echo 'backdoor account: sysbak' >> /home/student/findings.txt