For Teachers · Back to the Module · Print with your browser's Print command.

P20 Teacher Answer Key: Secrets, Cron and Account Hygiene

Teacher Answer Key (about 20 minutes, Practitioner level)

Name: ______________________ Class: __________ Date: __________

Read first: P7, P15

Learning Objectives

• [ ] Find secrets that any local user can read and explain why that is a lateral movement path.
• [ ] Trace what a root cron job really executes and who could change it.
• [ ] Spot account-file inconsistencies that tools such as pwck report.

Key Terms

Write each definition in your own words.

• Secret Sprawl: Secrets copied into configuration files, backups, scripts and environment files where more people and processes can read them than intended.
• Authorized Keys Options: Prefixes in an SSH authorized_keys line, such as from=, command= and restrict, that limit where a key may log in from and what it may do.
• PATH Interception: Planting a program in a folder that appears early in PATH, or in a writable PATH folder, so a privileged job runs it instead of the intended command.
• Shadow File: /etc/shadow, the root-only file that holds password hashes and ageing data for the accounts listed in /etc/passwd.
• Privilege Escalation: Gaining higher privileges than intended, for example turning a normal user account into root.

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Run: openvapt demo --only HOST-SEC-,HOST-CRON-,HOST-SSH-013,HOST-USR-008,HOST-USR-009,HOST-USR-010 --out p15 and, for each finding, write who gains what.
2. In internal/lab/fixtures_containers_apps.go, follow the vulnerable /etc/crontab from PATH to the backup script and list every file a non-root user could change to run code as root.
3. On a test machine you are allowed to assess: pwck -r ; grpck -r ; find /etc -type f -perm -0004 -name '*.conf' | head and compare with the report.

Self-Check Questions

1. A root cron job runs backup-db with no path. Where is the risk?

• [ ] a) Cron refuses to run it
• [x] b) Whichever folder on cron's PATH is writable by others can supply a fake backup-db
• [ ] c) Only in /etc/crontab's permissions
• [ ] d) Nowhere, because root jobs are always trusted
• Answer: b. PATH interception: the first matching file on PATH runs as root.

1. What does from="203.0.113.0/24" in authorized_keys do?

• [ ] a) Sets the key's expiry date
• [x] b) Limits the addresses the key may log in from
• [ ] c) Encrypts the key
• [ ] d) Forces the key to run one fixed command
• Answer: b. from= restricts source addresses; command= and restrict limit what the key can do.

1. An account appears in /etc/passwd with x but has no /etc/shadow line. Why does it matter?

• [ ] a) It cannot own files
• [x] b) Its password state is undefined and differs between tools; the files were edited inconsistently
• [ ] c) It is automatically root
• [ ] d) It is deleted at the next reboot
• Answer: b. pwck reports this; pwconv or vipw repairs it.

1. What does HOST-SEC-001 report when it finds a secret in a world-readable file?

• [x] a) Only the file and the kind of match
• [ ] b) The full secret value
• [ ] c) Nothing, because it deletes the file
• [ ] d) The file owner's password
• Answer: a. Reports never copy the secret itself. The file and the kind of match are enough to act on.

1. A root cron job runs /usr/local/bin/backup.sh, and any user can edit that file. What follows?

• [x] a) Their code runs as root at the next run
• [ ] b) Cron refuses to run the job
• [ ] c) Only the file's owner is affected
• [ ] d) Nothing, because cron checks a signature
• Answer: a. A root job is only as trustworthy as the file it runs and the folder it sits in.

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• OWASP Secrets Management Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
• sshd(8), AUTHORIZED_KEYS FILE FORMAT: https://man.openbsd.org/sshd.8#AUTHORIZED_KEYS_FILE_FORMAT
• MITRE ATT&CK T1574.007, Path Interception by PATH Environment Variable: https://attack.mitre.org/techniques/T1574/007/
• MITRE ATT&CK T1053.003, Cron: https://attack.mitre.org/techniques/T1053/003/
• pwck(8), Linux man-pages: https://man7.org/linux/man-pages/man8/pwck.8.html
• NIST SP 800-53 Rev. 5, IA-5 Authenticator Management: https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.