Verifying your work

Prove it is fixed

Fixing is not finished until you have confirmed the fix. The defender's habit is to re-run the same checks an attacker would and see nothing exploitable:

find / -perm -4000 -type f 2>/dev/null | grep -c find
ls -l /etc/passwd
ls -ld /opt/maint/bin

In the terminal (find no longer SUID, passwd 644, the PATH dir no longer world-writable)

student@vulntech:~$ find / -perm -4000 -type f 2>/dev/null | grep -c find
0
student@vulntech:~$ ls -l /etc/passwd
-rw-r--r-- 1 root root 1067 Oct 18 13:21 /etc/passwd
student@vulntech:~$ ls -ld /opt/maint/bin
drwxr-xr-x 2 root root 0 Oct 19 10:41 /opt/maint/bin

When the audit sweep that once lit up with findings comes back clean, the box is hardened. Make that re-check part of your routine — configuration drifts, and today's clean host is not guaranteed to be clean next month.