Take away the shortcuts to root

Linux lab Intermediate 3 tasks 20 points

The attacker left two ways to become root again without a password:

a rule file in /etc/sudoers.d/ containing NOPASSWD: ALL, and
a SUID copy of bash, owned by root, hidden at /opt/.cache-helper.

Find the sudo rule file, then remove both shortcuts.

How it works: the terminal below is a real Linux machine running in your browser. Click it and type. Tasks tick themselves off as you complete them; questions are answered in the box under each task. Press Reset any time for a fresh machine. Your password on this machine (for sudo) is student.

Getting your Linux machine ready…

The first start downloads about 20 MB. After that your browser keeps it, and labs start in a moment.

Hints

Find the bad rule with `sudo grep -rl NOPASSWD /etc/sudoers.d/`.

Delete the rule file and the SUID file with `sudo rm`.

Solution explanation

Both shortcuts are gone. The file 90-devops had student ALL=(ALL) NOPASSWD: ALL, which let the student account become root with no password — deleting the file closes that. The file /opt/.cache-helper was a root-owned copy of bash with the SUID bit, so running it would have handed out a root shell; removing it closes that too. Checking /etc/sudoers.d/ for NOPASSWD and hunting for stray SUID shells are two staple defender habits.

Show solution

sudo grep -rl NOPASSWD /etc/sudoers.d/
sudo rm /etc/sudoers.d/90-devops
ls -l /opt/.cache-helper
sudo rm /opt/.cache-helper