Audit the Accounts
The security team thinks an attacker was on this machine and changed some accounts to keep a way in. Audit the users and groups, and close every door you find. Your password is student.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Hints
Real audits start with exactly these three checks: UID 0 accounts, empty passwords and the members of the sudo group.
Solution explanation
A second UID 0 account is a backdoor: it is root under another name. Because root's programs use the same UID, userdel needs -f. An empty password field lets anyone log in as visitor without a password, so lock it with passwd -l. Finally, the sudo group is a list of everyone who can become root: intern doesn't belong there.
Show solution
awk -F: '$3 == 0' /etc/passwd
sudo userdel -f toor
sudo awk -F: '$2 == ""' /etc/shadow
sudo passwd -l visitor
getent group sudo
sudo gpasswd -d intern sudo