Linux Fundamentals -HackTheBox

Linux Fundamentals -HackTheBox

1.0 INTRODUCTION

I began the Linux Fundamentals module by reviewing the importance of understanding the Linux operating system, especially in the context of cybersecurity. The module started by explaining what Linux is, its background, and why it is widely used across different environments — from personal computers and servers to embedded systems and mobile devices.

It also introduced the core structure of Linux, including its history, architecture, file system hierarchy, and underlying philosophy. These foundational topics are essential for anyone working in cybersecurity, as they provide the knowledge required to navigate and manage Linux systems effectively. This section set the stage for the rest of the module by explaining key concepts and components that are critical to understanding how Linux operates.

2.0 SYSTEM INFORMATION

2.1 Find out the machine hardware name and submit it as the answer.

Answer: x86_64

Explanation: I used the “uname -m” command to find the machine hardware name

Press enter or click to view image in full size

2.2 What is the path to htb-student’s home directory?

Answer:/home/htb-student

Explanation: I used the ‘pwd’ to find the directory I was working on.

Press enter or click to view image in full size

2.3 What is the path to the htb-student’s mail?

Answer:/var/mail/htb-student

Explanation: I used the ‘cd ’command to change directories to the mail and the ‘ls’ command to list the mails.

2.4 Which shell is specified for the htb-student user?

Answer: bin/bash

2.5 Which kernel release is installed on the system? (Format: 1.22.3)

Answer:4.15.0

Explanation: I used the ‘uname -a’ command to find all the information

Press enter or click to view image in full size

2.6 What is the name of the network interface that MTU is set to 1500?

Answer: ens192

Explanation: To find the name of the network I used the ‘ifconfig’ command

Press enter or click to view image in full size

3.0 NAVIGATION

3.1 What is the name of the hidden “history” file in the htb-user’s home directory?

Answer: .bash_history

Explanation: To find the hidden file, I printed the working directory using the command ‘pwd’ to confirm that I was in the home directory. I then went ahead and used the ‘ls -la’ command to list all the hidden files.

Press enter or click to view image in full size

3.2 What is the index number of the “sudoers” file in the “/etc” directory?

Answer:147627

Explanation: I used the ‘ls -i /etc/sudoers’ command to find the index of the sudoers file

Press enter or click to view image in full size

4.0 WORKING WITH FILES AND DIRECTORIES

4.1 What is the name of the last modified file in the “/var/backups” directory?

Answer: apt.extended_states.0

Explanation: To find the last modified file in the /var/backups directory,i changed directories using ‘cd /var/backups’ command and then I used the ‘ls -lt /var/backups’ command to get the list of modified files and the I picked the top one as it is the latest modified file.

Press enter or click to view image in full size

4.2 What is the inode number of the “shadow.bak” file in the “/var/backups” directory?

Answer:265293

Explanation: To find the inode number, I used the ‘ls -i /var/backups/shadow.bak’’ command

Press enter or click to view image in full size

5.0 FIND FILES AND DIRECTORIES

5.1 What is the name of the config file that has been created after 2020–03–03 and is smaller than 28k but larger than 25k?

Answer: 00-mesa-defaults.conf

Explanation: To find the config file that fulfils all the criteria above, I used the ‘find ’command like this ‘find / -type f -name *.conf -size +25k -size -28k -newermt 2020–03–03 -exec ls -al {} \; 2>/dev/null’

Press enter or click to view image in full size

5.2 How many files exist on the system that have the “.bak” extension?

Answer:4

Explanation: In this task, I modified the command from the previous question and replaced the .config extension with .bak like this ‘find / -type f -name *.bak -exec ls -al {} \; 2>/dev/null |wc -l’

Press enter or click to view image in full size

5.3 Submit the full path of the “xxd” binary.

Get Onix.09’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Answer: /usr/bin/xxd

Explanation: Here I used the ‘which xxd’ command to find the full path of the xxd binary

Press enter or click to view image in full size

6.0 FILE DESCRIPTORS AND REDIRECTIONS

6.1 How many files exist on the system that have the “.log” file extension?

Answer: 32

Explanation: This question was like the above two questions and I simply modified the command and replaced .bak with .log

Press enter or click to view image in full size

6.2 How many total packages are installed on the target system?

Answer:737

Explanation: To find the total number of packages, I used the command ‘apt list — installed |wc -l’ that gave me the total number to be 738.But the accepted answer in the module was 737 as shown in the screenshot below.

Press enter or click to view image in full size

7.0 FILTER CONTENTS

7.1 How many services are listening on the target system on all interfaces? (Not on localhost and IPv4 only)

Answer: 7

Explanation: I used the command ‘netstat -tunl4 | grep -v “127.0.0” | grep “LISTEN” | wc -l’ This lists all IPv4 TCP and UDP services that are listening on interfaces other than localhost. By excluding 127.0.0.1, it filters out services bound only to localhost, counting only those listening on all interfaces (0.0.0.0) or specific external IPs.

Press enter or click to view image in full size

7.2 Determine what user the ProFTPd server is running under. Submit the username as the answer.

Answer: proftpd

Explanation: To determine which user the ProFTPd server is running under, I searched for the proftpd user account in the system’s password file using: ‘cat /etc/passwd | grep “proftpd”’. This file (/etc/passwd) lists all system users and the services they run. If the proftpd server is running under its own user account (common for security reasons), it will appear here. The output confirmed that a user named proftpd exists, indicating the server runs under this account.

Press enter or click to view image in full size

7.3 Use cURL from your Pwnbox (not the target machine) to obtain the source code of the “https://www.inlanefreight.com" website and filter all unique paths (https://www.inlanefreight.com/directory" or “/another/directory”) of that domain. Submit the number of these paths as the answer.

Answer: 34

Explanation: To find the number of unique paths on the website https://www.inlanefreight.com, I used curl from my Pwnbox to download the source code of the homepage with the command: curl -s https://www.inlanefreight.com.

8.0 USER MANAGEMENT

8.1 Which option needs to be set to create a home directory for a new user using “useradd” command?

Answer: -m

8.2 Which option needs to be set to lock a user account using the “usermod” command? (long version of the option)

Answer: — lock

8.3 Which option needs to be set to execute a command as a different user using the “su” command? (long version of the option)

Answer: — command

9.0 SERVICE AND PROCESS MANAGEMENT

9.1 Use the “systemctl” command to list all units of services and submit the unit name with the description “Load AppArmor profiles managed internally by snapd” as the answer.

Answer: snapd.apparmor.service

Explanation: Here is the command that I used to find the unit name ‘ystemctl list-units — type=service | grep “Load AppArmor profiles managed internally by snapd”’

Press enter or click to view image in full size

10.0 TASK SCHEDULING

10.1 What is the type of the service of the “syslog. Service” ?

Answer: dbus Explanation: To determine the type of the dconf.service, I used the command: locate dconf.service | awk NR==1 | xargs cat. This command finds the location of the service file, displays its contents, and from there I identified the Type=dbus, which means the service is considered started when it acquires a D-

Bus name.

Press enter or click to view image in full size

11.0 WORKING WITH WEB SERVICES

11.1 Find a way to start a simple HTTP server inside Pwnbox or your local VM using “npm”. Submit the command that starts the web server on port 8080 (use the short argument to specify the port number).

Answer: http-server -p 8080

11.2 Find a way to start a simple HTTP server inside Pwnbox or your local VM using “php”. Submit the command that starts the web server on the localhost (127.0.0.1) on port 8080.

Answer: php -S 127.0.0.1:8080

Press enter or click to view image in full size

12.0 FILE SYSTEM MANAGEMENT

12.1 How many partitions exist in our Pwnbox? (Format: 0)

Answer: 3

Explanation: I used the lsblk command to list all the block devices and their partitions on the Pwnbox. The output showed one disk, sda, with three partitions labeled sda, sda1, and sda2. Therefore, the total number of partitions on the Pwnbox is 3.

Press enter or click to view image in full size

13.0 CONCLUSION AND SUMMARY

Looking back on this learning journey, I realize how much I have deepened my understanding of Linux fundamentals and practical cybersecurity tools. Exploring commands like curl, systemctl, and analysing system files gave me hands-on experience that bridged theory and practice. I’ve gained confidence in navigating the terminal and troubleshooting real-world scenarios, which I know will be invaluable as I continue to build my skills.

That said, I did face some challenges along the way, especially in parsing complex outputs and filtering data efficiently. At times, interpreting the commands’ results felt overwhelming, but pushing through those moments helped me develop patience and problem-solving skills.

Overall, this experience has reinforced my curiosity and motivated me to keep exploring with a more analytical mindset.