back to labs
Find the Backdoor User
EasyDigital Forensics & Incident Response10-15 minThe brief
A production server was compromised. The attacker left a persistence backdoor: a second account with UID 0 (root privileges) hiding among the normal users. Identify the rogue account and record its username to /root/case/backdoor_user.txt: a plain-text file holding just that one name (its /etc/passwd line is accepted too). root itself is legitimate, so a list that still includes root is not an answer.
What you'll do
- Inspect /etc/passwd for accounts with UID 0
- Identify the non-root account that also has UID 0
- Record its username to /root/case/backdoor_user.txt
Hands-on lab: you work on a real Linux box in your browser, graded on the machine's actual state.