plasticglass

information security and technology

im plasticglass. i write about the sh*t i do.

"bandit" part 4: detecting and analyzing changes in files

4.1 - more ways to list files

as discussed earlier, the ls command will list the contents of a directory. adding the -a option will cause the command to also display hidden files. however, certain options for the ls command will allow the user to gather more information about the files in a directory.

some useful options are:

  • -l: "long format" - displays the filename, permissions, user (owner), group, size in bytes, last modification date/time, and number of links.
  • -s: "size" - print the allocated size in blocks of the file.
  • -S: "sort by size" - sort by size, largest first. can be combined with -r for reverse order.
  • -R: "recursive" - recursively list subdirectories.
there are more options, but these are useful for many cases.

4.2 - more about "find"

a previous section introduced the find command. this command has several options that are useful for finding and examining files:

  • -maxdepth num: sets the number of subdirectories to recursively search to num, starting from the specified starting directory. without setting this option, find will search as far down as it can go.
  • -name: search for files with a specified name.
  • -user: search for files owned by a specified user.
  • -group: search for files owned by a specified group.
  • -size: search for files of a specified size.
  • -mtime: search for files modified more or less (+n/-n) than n days ago.

modified vs. changed vs. accessed: these terms actually mean different things in a linux system:

  • modified refers to the last time the content of the file was updated. e.g., a user edited the file.
  • changed refers to the last time the metadata of the file was updated. e.g., the file was moved, renamed, or changed permissions.
  • accessed refers to the last time the file was read.
it is common for these values to be different, so it is important to understand what they represent.

4.3 - gathering info about a file or directory

the file command is a very useful tool for determining the file types in a directory. in addition, the stat command can return pertinent metadata about a file, such as size, permissions, ownership, and modify/change/access times. the usage of the stat command is:

  • stat filename: returns metadata for filename.
  • stat *: returns metadata for all files in the current working directory.

4.4 - comparing files

the two most common methods of comparing two files to each other are diff and cmp. diff file1 file2 will compare file1 and file2 line by line, and return any lines that differ between the two, noting the line number where the difference occurs. this command is useful for files that are very similar, but not exactly alike, as using diff on completely different files would return a giant mess.

cmp is similar, but instead of comparing text, the files are compared byte-by-byte. it will give the byte number of the beginning of the difference.

both of these commands will return nothing if the files are identical.

once differences have been identified, the patch command can be used to fix them, if necessary. by executing patch file1 file2, the user can "patch" the changes listed in file2 onto file1. this "patch file" can be created by redirecting the output of diff to a file, and then using that file in the patch command.


walkthroughs

"bandit" level 17

bandit 17:

use the ssh key from the previous level to log in. in the home directory, there are two files. identify the difference between them, and you will find the password.

relevant sections: 4.4


part 5 - shells and config files