Environment and history
You took over from a colleague and he left you his shell. Query the environment and the command history to recover the production database credentials... and find out why they must never be typed on the command line.
Lab 9 of 9 in the Linux Fundamentals path. If you get stuck you have 3 hints, from the vaguest to the most precise: they cost 0, 50 and 150 XP.
What you learn
Objectives complete themselves while you work in the terminal; each one is worth experience points:
- List the environment variables with env (100 XP)
- Read a variable with echo $NAME (120 XP)
- Browse the command history (130 XP)
Topics: linux, ambiente, history.
Commands you will use
The terminal is simulated and understands about forty Linux commands. In this lab you will mostly need these:
cat: prints the contents of a file: the most direct way to read configurations, notes and logs.env: lists the shell environment variables, where configuration and credentials sometimes end up.echo: prints some text or the value of a variable, such as $HOME.history: shows the history of typed commands: it tells who did what, sometimes with passwords written on the command line.grep: finds the lines that contain a word, even across whole folders with -r. It is the main tool for analysing text and logs.|: the vertical bar | chains commands: the output of the first becomes the input of the next, so small tools form a complete analysis.
The simulated environment
You work in a simulated Linux shell, in the home folder of the user runner: invented files and folders, no network target.
The defensive lesson
Once the lab is solved, the write-up explains what went wrong and how to protect yourself:
Environment and history tell a lot: who used the shell, with which users and sometimes with which passwords. Typing a password on the command line (-p'...') leaves it in ~/.bash_history and in the process list (ps), visible to other users. Defense: leave the option empty (-p: the password is typed at the prompt), use files with 600 permissions or a secrets manager; with HISTCONTROL=ignorespace a command that starts with a space is not saved; and change at once any password that ended up in a history.
Before and after this lab
To unlock it you must have solved:
- Permissions and owners (Linux Fundamentals, medium)
After this lab you can move on to:
- Forgotten secrets (Privilege Escalation, medium)
The Linux Fundamentals path
Linux Fundamentals is the starting point. Almost every server, network device and security tool runs on Linux, and anyone who defends a system (or tests it with permission) spends much of their time in a terminal. Here you learn to move around the filesystem, find hidden files, read huge logs piece by piece, search for words with grep, chain commands with pipes and understand permissions, environment variables and history: the basics you will use in every other path.