Unit 2: Reading and checking files · Lesson 1 of 6 · 15 min
What is this file?
Use file and wc to size up anything before you print it.
mission
- You are
- You are triaging unfamiliar files on web01.
- Situation
- The handover mentions an old backup helper, and the web root holds a large backup file. Names and extensions prove nothing.
- Goal
- Find out what each file really is without running it.
- Hand in
- The real type of three files and the size of the access log.
Start with something known
file README.txt README.txt: ASCII text file /usr/bin/ls | cut -d, -f1 /usr/bin/ls: ELF 64-bit LSB pie executable
you should see Text and ELF, the format of Linux programs. cut trims the long description to its first part.
Check the suspicious ones
file /usr/local/bin/backup-helper /usr/local/lib/.cache/kthreadd /var/www/html/assets/site-backup.tar.gz | cut -d, -f1
/usr/local/bin/backup-helper: setuid ELF 64-bit LSB pie executable
/usr/local/lib/.cache/kthreadd: ELF 64-bit LSB pie executable
/var/www/html/assets/site-backup.tar.gz: data
you should see A setuid program, a program hidden in a dot folder, and a backup that is not a real archive.
defender tip setuid means the program runs as its owner. Any setuid file outside a package is worth a ticket. You will audit it later.
Measure before you read
wc -l counts lines. A few lines is a cat. Thousands is a job for grep and pipes.
wc -l /var/log/nginx/access.log /var/log/auth.log /var/log/auth.log.1 1378 /var/log/nginx/access.log 548 /var/log/auth.log 77 /var/log/auth.log.1 2003 total wc -c README.txt 247 README.txt
| Command | What it does |
|---|---|
file name | Real type from the content |
wc -l file | Count lines |
wc -c file | Count bytes |
cat file | Print it all. Short text only |
What a defender takes away
- 1Extensions lie. file reads the content.
- 2Never cat a binary or a huge log.
- 3A program where data should be is a finding.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.