THM: Ninja Skills Writeup • 0xnhl

Link: https://tryhackme.com/room/ninjaskills ↗

Challenge:
Answer the questions about the following files:
8V2L
bny0
c4ZX
D8B3
FHl1
oiMO
PFbD
rmfX
SRSq
uqyw
v2Vb
X1Uy

First we’ll locate these files by their filename using find:

find / -type f \( -name 8V2L -o -name bny0 -o -name c4ZX -o -name D8B3 -o -name FHl1 -o -name oiMO -o -name PFbD -o -name rmfX -o -name SRSq -o -name uqyw -o -name v2Vb -o -name X1Uy \) 2>>/dev/null
/mnt/D8B3
/mnt/c4ZX
/var/FHl1
/var/log/uqyw
/opt/PFbD
/opt/oiMO
/media/rmfX
/etc/8V2L
/etc/ssh/SRSq
/home/v2Vb
/X1Uy

plaintext

We get path of all files except for the file bny0.

Q1. Which of the above files are owned by the best-group group(enter the answer separated by spaces in alphabetical order)

ls -la /mnt/D8B3 /mnt/c4ZX /var/FHl1 /var/log/uqyw /opt/PFbD /opt/oiMO /media/rmfX /etc/8V2L /etc/ssh/SRSq /home/v2Vb /X1Uy
-rwxrwxr-x 1 new-user   new-user   13545 Oct 23  2019 /etc/8V2L
-rw-rw-r-- 1 new-user   new-user   13545 Oct 23  2019 /etc/ssh/SRSq
-rw-rw-r-- 1 new-user   best-group 13545 Oct 23  2019 /home/v2Vb
-rw-rw-r-- 1 new-user   new-user   13545 Oct 23  2019 /media/rmfX
-rw-rw-r-- 1 new-user   new-user   13545 Oct 23  2019 /mnt/c4ZX
-rw-rw-r-- 1 new-user   best-group 13545 Oct 23  2019 /mnt/D8B3
-rw-rw-r-- 1 new-user   new-user   13545 Oct 23  2019 /opt/oiMO
-rw-rw-r-- 1 new-user   new-user   13545 Oct 23  2019 /opt/PFbD
-rw-rw-r-- 1 new-user   new-user   13545 Oct 23  2019 /var/FHl1
-rw-rw-r-- 1 new-user   new-user   13545 Oct 23  2019 /var/log/uqyw
-rw-rw-r-- 1 newer-user new-user   13545 Oct 23  2019 /X1Uy

plaintext

Looking at the group of each file we get the answer.
We can also use this command to find files based on file owner:

find / -type f -group best-group 2>>/dev/null
/mnt/D8B3
/home/v2Vb

plaintext

Q2. Which of these files contain an IP address?

grep -E -o "([0-9]{1,3}\.){3}[0-9]{1,3}"  /mnt/D8B3 /mnt/c4ZX /var/FHl1 /var/log/uqyw /opt/PFbD /opt/oiMO /media/rmfX /etc/8V2L /etc/ssh/SRSq /home/v2Vb /X1Uy
/opt/oiMO:1.1.1.1

plaintext

Q3. Which file has the SHA1 hash of 9d54da7584015647ba052173b84d45e8007eba94

sha1sum  /mnt/D8B3 /mnt/c4ZX /var/FHl1 /var/log/uqyw /opt/PFbD /opt/oiMO /media/rmfX /etc/8V2L /etc/ssh/SRSq /home/v2Vb /X1Uy
2c8de970ff0701c8fd6c55db8a5315e5615a9575  /mnt/D8B3
9d54da7584015647ba052173b84d45e8007eba94  /mnt/c4ZX
d5a35473a856ea30bfec5bf67b8b6e1fe96475b3  /var/FHl1
57226b5f4f1d5ca128f606581d7ca9bd6c45ca13  /var/log/uqyw
256933c34f1b42522298282ce5df3642be9a2dc9  /opt/PFbD
5b34294b3caa59c1006854fa0901352bf6476a8c  /opt/oiMO
4ef4c2df08bc60139c29e222f537b6bea7e4d6fa  /media/rmfX
0323e62f06b29ddbbe18f30a89cc123ae479a346  /etc/8V2L
acbbbce6c56feb7e351f866b806427403b7b103d  /etc/ssh/SRSq
7324353e3cd047b8150e0c95edf12e28be7c55d3  /home/v2Vb
59840c46fb64a4faeabb37da0744a46967d87e57  /X1Uy

plaintext

Matching the hash given in the question to the output we get the answer.

Q4. Which file contains 230 lines?

wc -l /mnt/D8B3 /mnt/c4ZX /var/FHl1 /var/log/uqyw /opt/PFbD /opt/oiMO /media/rmfX /etc/8V2L /etc/ssh/SRSq /home/v2Vb /X1Uy
   209 /mnt/D8B3
   209 /mnt/c4ZX
   209 /var/FHl1
   209 /var/log/uqyw
   209 /opt/PFbD
   209 /opt/oiMO
   209 /media/rmfX
   209 /etc/8V2L
   209 /etc/ssh/SRSq
   209 /home/v2Vb
   209 /X1Uy
  2299 total

plaintext

There is one file which we dont have path of. Trying that gives the correct answer.

Q5. Which file’s owner has an ID of 502?

cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
...
ec2-user:x:500:500:EC2 Default User:/home/ec2-user:/bin/bash
new-user:x:501:501::/home/new-user:/bin/bash
newer-user:x:502:503::/home/newer-user:/bin/bash

plaintext

The user newer-user has the user id 502. refering the above ls -la we get to know the file /X1Uy has the owner newer-user.

Q6. Which file is executable by everyone?

ls -la /etc/8V2L
-rwxrwxr-x 1 new-user   new-user   13545 Oct 23  2019 /etc/8V2L

plaintext

The file /etc/8V2L is executable by everyone.