Auditing the box

Look before you touch

Before changing anything, take inventory of what is wrong. Here is the audit sweep — the same checklist the attacker runs, read with a defender's eye. First, programs that run as root because of a SUID bit:

find / -perm -4000 -type f 2>/dev/null

In the terminal (su/sudo/passwd are expected; find is NOT — that is a finding)

student@vulntech:~$ find / -perm -4000 -type f 2>/dev/null
/usr/bin/chfn
/usr/bin/chsh
/usr/bin/find
/usr/bin/gpasswd
/usr/bin/mount
/usr/bin/newgrp
/usr/bin/passwd
/usr/bin/su
/usr/bin/sudo
/usr/bin/umount
/usr/lib/dbus-1.0/dbus-daemon-launch-helper

Next, the permissions on the account database and on anything a root job runs:

ls -l /etc/passwd
ls -l /opt/backup/backup.sh

In the terminal (both are writable by everyone — two findings)

student@vulntech:~$ ls -l /etc/passwd
-rw-rw-rw- 1 root root 1067 Oct 18 13:21 /etc/passwd
student@vulntech:~$ ls -l /opt/backup/backup.sh
-rwxrwxrwx 1 root root 79 Oct 19 10:21 /opt/backup/backup.sh

Then your own sudo rights and any secrets left lying in app config:

sudo -l
grep -ri pass /var/www 2>/dev/null

In the terminal (an over-broad NOPASSWD rule and a plaintext password — two more findings)

student@vulntech:~$ sudo -l
Matching Defaults entries for student on vulntech:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin,
    use_pty, lecture=never

User student may run the following commands on vulntech:
    (ALL : ALL) ALL
    (ALL) NOPASSWD: /usr/bin/less
    (ALL : ALL) ALL
student@vulntech:~$ grep -ri pass /var/www 2>/dev/null
/var/www/app/config.php:$DB_PASS = 'S3rv3r-Adm1n-2024';

That is the whole surface: SUID, file permissions, sudo, cron and secrets. The modules ahead fix them one at a time, and the capstone fixes them all.