Forgotten secrets
The sysadmin of the Crumiro Biscuit Factory is on holiday and left the deploy panel behind a password nobody knows. But people in a hurry leave traces: look in the command history and in the service files, then get into the panel.
Lab 2 of 5 in the Privilege Escalation path. If you get stuck you have 3 hints, from the vaguest to the most precise: they cost 0, 50 and 150 XP.
What you learn
Objectives complete themselves while you work in the terminal; each one is worth experience points:
- Read the command history (100 XP)
- Search the service files for "password" (150 XP)
- Get into the deploy panel with the right credential (200 XP)
Topics: privesc, secrets, history, audit.
Commands you will use
The terminal is simulated and understands about forty Linux commands. In this lab you will mostly need these:
history: shows the history of typed commands: it tells who did what, sometimes with passwords written on the command line.grep: finds the lines that contain a word, even across whole folders with -r. It is the main tool for analysing text and logs.cat: prints the contents of a file: the most direct way to read configurations, notes and logs.curl: makes HTTP requests from the terminal and shows the server’s raw answer, headers included.
The simulated environment
You work in a simulated Linux shell, in the home folder of the user runner: invented files and folders, no network target.
Besides the home folder there is a complete simulated system, with configuration files, logs, users and permissions to examine.
Local services also run on the machine:
- Web (HTTP): a web server with pages, APIs or admin panels: the most exposed part of almost every organisation.
- Database: a database (MySQL, MariaDB or PostgreSQL), which should answer only the services that use it and never the whole network.
The defensive lesson
Once the lab is solved, the write-up explains what went wrong and how to protect yourself:
Credentials end up where they should not: world-readable configuration files, scripts, the shell history (a password typed on the command line stays in .bash_history). Defensive lesson: secrets belong in a secrets manager or in files with 600 permissions, never in code; rotate them as soon as they are exposed and hunt for them yourself (secret scanning, a periodic grep -r) before somebody else does.
Before and after this lab
To unlock it you must have solved:
- Who am I and what can I do? (Privilege Escalation, medium)
- Environment and history (Linux Fundamentals, medium)
After this lab you can move on to:
- Secrets in processes and local services (Privilege Escalation, medium)
The Privilege Escalation path
Privilege Escalation is an audit path here: you are on a server as a normal user and you check whether some misconfiguration lets you gain more privileges than you should have. You examine sudo rules, programs with the SUID bit, credentials forgotten in the history and in files, and secrets passed as process arguments. These are the same checks that people who harden systems run, and each lab ends with the principle that sums them all up: least privilege.