Audit the server
You have just taken over administration of this server. Before you fix anything, audit it: run the checks that reveal the common local weaknesses, then write down what you found.
List the SUID programs, check the permissions on /etc/passwd, and review your sudo rights. Record at least the out-of-place SUID binary in an audit note.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Hints
Run the attacker's checklist with a defender's eye: `find / -perm -4000`, `ls -l /etc/passwd`, `sudo -l`.
The SUID binary that stands out is `/usr/bin/find` — note it in your audit file.
Solution explanation
A good hardening pass always starts with an audit. In a few commands you surfaced the whole local attack surface: a SUID bit on /usr/bin/find that does not belong, a world-writable /etc/passwd, and an over-broad sudo rule. Writing findings down is part of the job — you fix from a list, and the list becomes your record that the box was reviewed. The next modules close each of these in turn.
Show solution
cd /home/student
find / -perm -4000 -type f 2>/dev/null
ls -l /etc/passwd
sudo -l
echo '/usr/bin/find is SUID-root and should not be' > /home/student/audit.txt