Challenge ·Medium

Audit the Shell Environment: Detect a Shadowed Command

Mister P
by  Mister P · on
Linux
A system administrator must verify the shell environment is clean before performing privileged tasks. Practice detecting and resolving command aliases and shell function overrides that can silently hijack administrative commands.
#shell#bash#environment#rhcsa#audit

The laborant user's shell environment on rocky-01 has been tampered with — a dangerous sudo alias and a useradd shell function have been injected into ~/.bashrc, and you must clean them up before any administrative work can proceed safely.

Complete the following tasks on rocky-01 as the laborant user.

Hint 1 — How to detect what's wrong

Use type sudo and declare -f useradd in an interactive session to confirm whether a command is aliased or shadowed by a shell function.

Hint 2 — Where to look

The injected definitions live in ~/.bashrc. Open it with a text editor and look for lines containing alias sudo= and a useradd() function block.

Hint 3 — What to remove

Delete the alias sudo='...' line and the entire useradd() { ... } function block including the export -f useradd line. Save the file, then open a new shell to verify the changes took effect.

Hint 4 — How to verify your fix

In a new shell session, run:

alias sudo 2>&1
declare -f useradd
echo $PATH | tr ':' '\n' | grep '^/usr/bin$'

The first two commands should produce no output. The third should print /usr/bin.

How to Author Challenges on iximiuz Labs

Instead of providing a subpar online editing experience, iximiuz Labs offers a helper CLI tool called labctl, allowing you to use your favorite text editor (or a full-featured IDE) to write content from the comfort of your local machine.

Install labctl CLI

curl -sf https://labs.iximiuz.com/cli/install.sh | sh

This will download and install the latest version of the labctl CLI. You only need to do this once per workstation.

Authorize labctl

labctl auth login

This will open a browser window asking you to authorize labctl to access your account. You need to do it after a fresh install of labctl and repeat it whenever the auth session expires.

Pull challenge content

labctl content pull challenge rhcsa-x200101-challenge-5-78ed0ed6

This will create a local copy of the challenge content in a directory named rhcsa-x200101-challenge-5-78ed0ed6. You only need to do this once per challenge.

Stream your changes

labctl content push -fw challenge rhcsa-x200101-challenge-5-78ed0ed6

Run this command in a separate terminal to continuously upload your changes to the server while editing the challenge in your favorite text editor or IDE.

You can also use labctl to create, list, and delete your content. Learn more about the available commands: labctl content --help

Start challenge