Users & Groups
Phantom Users
125 pts
0 solves
medium
hands-on
A server has been compromised. The attacker created a **phantom user account**
with UID 0, giving it root-level access. Several legitimate users also exist.
Your mission:
- Audit `/etc/passwd` to find the non-root user with **UID 0**
- Write the username to `~/audit_report.txt`
- **Lock** the account so it can no longer log in
*Hint: `awk -F: '$3==0' /etc/passwd` shows UID-0 users.*
Ready to solve this?
Create a free account to launch containers, submit answers, and track your progress.