Sophie Chen
ResumeLinkedInGitHubBluesky
Work
Work
  • Work
  • Digital Forensics Lab
    • 1 Setting Up
    • 2 Basic Computer Skills for Digital Forensics
      • 2.1 Number Systems
      • 2.2 PC Introduction
      • 2.3 Windows Command Line Tutorial
      • 2.4 Linux Command Line Tutorial
      • 2.5 Advanced Linux Command Line Tutorial
    • 3 Basic Networking Skills for Digital Forensics
      • 3.1 HTTP Analysis using Wireshark 1
      • 3.2 HTTP Analysis using Wireshark 2
      • 3.3 SYN Flood Attack Investigation using tshark
      • 3.4 SMTP Forensics
      • 3.5 ARP Poisoning Forensics
      • 3.6 Firewall
      • 3.7 DNS Introduction
      • 3.8 DNS Spoofing Forensics
      • 3.9 WEP40 Wireless Aircrack
    • 4 Computer and Digital Forensics
      • 4.1 Introduction to Digital Forensics
      • 4.2 Sleuth Kit Tutorial
      • 4.3 USB Image Acquisition
      • 4.4 Evidence Search - A Pattern Match Game
      • 4.5 Evidence Search - File Metadata
      • 4.6 Data Carving
      • 4.7 Steganography
      • 4.8 Forensic Report Template
    • 5 Computer Forensics Case Studies
      • 5.1 Investigating NIST Data Leakage
        • 5.1.1 Environment Setting Up
        • 5.1.2 Windows Registry
        • 5.1.3 Windows Event and XML
        • 5.1.4 Web History and SQL
        • 5.1.5 Email Investigation
        • 5.1.6 File Change History and USN Journal
        • 5.1.7 Network Evidence and shellbag
        • 5.1.8 Network Drive and Cloud
        • 5.1.9 Master File Table ($MFT) and Log File ($logFile) Analysis
        • 5.1.10 Windows Search History
        • 5.1.11 Windows Volume Shadow Copy Analysis/SQL database carving
        • 5.1.12 Recycle Bin and Anti-Forensics
        • 5.1.13 Data Carving
        • 5.1.14 Crack Windows Passwords
      • 5.2 Investigating P2P Data Leakage
        • 5.2.1 Lab Environment Setting Up
        • 5.2.2 Disk Image and Partitions
        • 5.2.3 Windows Registry and File Directory
        • 5.2.4 MFT Timeline
        • 5.2.5 USN Journal Timeline
        • 5.2.6 uTorrent Log File
        • 5.2.7 File Signature
        • 5.2.8 Emails
        • 5.2.9 Web History
        • 5.2.10 Website Analysis
        • 5.2.11 Timeline (Summary)
      • 5.3 Investigating Illegal Possession of Images
        • 5.3.1 Review HTTP Analysis using Wireshark (text)
        • 5.3.2 Rhion Possession Investigation 1: File recovering
        • 5.3.3 Rhion Possession Investigation 2: Steganography
        • 5.3.4 Rhion Possession Investigation 3: Extract Evidence from FTP Traffic
        • 5.3.5 Rhion Possession Investigation 4: Extract Evidence from HTTP Traffic
      • 5.4 Investigating Email Harassment
        • 5.4.1 Investigating Harassment Email using Wireshark
        • 5.4.2 t-shark Forensic Introduction
        • 5.4.3 Investigating Harassment Email using t-shark
      • 5.5 Investigating Illegal File Transferring
      • 5.6 Investigating Hacking Case
      • 5.7 Investigating Morris Worm Attack
        • 5.7.1 Morris Worm Attack
        • 5.7.2 Investigating Morris Worm Attack
    • 6 Mobile/IoT Forensics Case Studies
      • 6.1 Investigating Echo Show 8
        • 6.1.1 Echo Show Introduction
        • 6.1.2 Echo Show Evidence Planting
        • 6.1.3 Device Teardown and eMMC Chip-off
        • 6.1.4 Image Acquisition and Mounting
        • 6.1.5 Specifications: Device and OS Info
        • 6.1.6 Specifications: User Info
        • 6.1.7 Specifications: Network Connectivity Info
        • 6.1.8 Web Activity
        • 6.1.9 Phone Communication
        • 6.1.10 Multimedia: Photos and related Data
        • 6.1.11 Multimedia: Videos and related Data
        • 6.1.12 Multimedia: Audio and related Data
      • 6.2 Investigating Android 10
        • 6.2.1 Intro Pixel 3
        • 6.2.2 Pixel 3 Image
        • 6.2.3 Pixel 3 Device
        • 6.2.4 Pixel 3 System Setting
        • 6.2.5 Overview: App Life Cycle
        • 6.2.6 AOSP App Investigations: Messaging
        • 6.2.7 AOSP App Investigations: Contacts
        • 6.2.8 AOSP App Investigations: Calendar
        • 6.2.9 GMS App Investigations: Messaging
        • 6.2.10 GMS App Investigations: Dialer
        • 6.2.11 GMS App Investigations: Maps
        • 6.2.12 GMS App Investigations: Photos
        • 6.2.13 Third-Party App Investigations: Kik
        • 6.2.14 Third-Party App Investigations: textnow
        • 6.2.15 Third-Party App Investigations: whatapp
        • 6.2.16 Pixel 3 Rooting
      • 6.3 Investigating iPhone iOS 13.4.1
        • 6.3.1 Intro Intro iPhone iOS 13
        • 6.3.2 iOS 13.4.1 Image
        • 6.3.3 iPhone Device Investigation
        • 6.3.4 iOS System Settings
        • 6.3.5 Overview of App Life Cycle
        • 6.3.6 Messages Investigations
        • 6.3.7 Contacts Investigations
        • 6.3.8 Calendar Investigations
        • 6.3.9 Safari Investigations
        • 6.3.10 Photo Investigations
        • 6.3.11 KnowledgeC Investigations
        • 6.3.12 Health Investigations
        • 6.3.13 Location Investigations
        • 6.3.14 Cellebrite Investigations
        • 6.3.15 Magnet Axiom Investigations
        • 6.3.16 Jailbreak Investigations
      • 6.4 Investigating Drone DJI
        • 6.4.1 DJI Mavic Air Mobile
        • 6.4.2 DJI Mavic Air MicroSD Raw
        • 6.4.3 DJI Mavic Air MicroSD Encase Format
  • CTF Walkthroughs
    • Hack The Box
      • Linux Fundamentals
      • Windows Fundamentals
    • TryHackMe
      • Linux Fundamentals Part 1
      • Linux Fundamentals Part 2
      • Linux Fundamentals Part 3
      • Introductory Networking
      • HTTP in Detail
      • DNS in Detail
      • Intro to Cyber Threat Intel
      • Threat Intelligence Tools
      • MAL: Malware Introductory
      • Intro to Digital Forensics
      • Digital Forensics Case B4DM755
  • Multithreaded Network File Server
  • Thread Library
  • Virtual Memory Pager
Powered by GitBook
On this page
  • Task 1: Introduction
  • Task 2: Accessing Your Linux Machine Using SSH (Deploy)
  • Task 3: Introduction to Flags and Switches
  • Task 4: Filesystem Interaction Continued
  • Task 5: Permissions 101
  • Task 6: Common Directories
  • Task 7: Conclusions and Summaries
  • Task 8: Linux Fundamentals Part 3
  1. CTF Walkthroughs
  2. TryHackMe

Linux Fundamentals Part 2


Task 1: Introduction

This room is the second in a three-part series on Linux fundamentals. This room will have us:

  • Unlocking the potential of our first few commands by introducing flags and arguments

  • Advancing our knowledge of the filesystem by copying and moving files

  • Discovering how access to files and folders is managed and how we can determine our access

  • Running our first few scripts and executables

Task 2: Accessing Your Linux Machine Using SSH (Deploy)

Secure Shell (SSH) is a protocol between devices in an encrypted form. We can SSH into the machine for this room using the command ssh tryhackme@<machine_ip>. The machine IP is listed at the top of the page after we start the machine for the room.

Task 3: Introduction to Flags and Switches

Commands in Linux have a default behavior. For example, ls lists the contents of the working directory. We can add flags to commands to extend the behavior of commands. man <command> can be used to view the associated flags for each command.

What directional arrow key would we use to navigate down the manual page?

down

Pressing the down key scrolls the manual page down, and pressing the up key scrolls up.

What flag would we use to display the output in a "human-readable" way?

-h

Use the command man ls to view the flags for ls. Then, press the down key to find the flag that results in "human-readable" output.

Task 4: Filesystem Interaction Continued

The command line can also be used to manipulate files. touch <file> creates a new file and mkdir <directory> creates a new folder. Files and folders can be copied with cp <file> <destination>, moved with mv <file> <destination>, and removed with rm <file>. file <file> can be used to output the file type.

How would you create the file named "newnote"?

touch newnote

The touch command is used to create a new file.

On the deployable machine, what is the file type of "unknown1" in "tryhackme's" home directory?

ASCII text

Use the file command to view the file's type.

How would we move the file "myfile" to the directory "myfolder"

mv myfile myfolder

The mv command is used to move or rename a file.

What are the contents of this file?

THM{FILESYSTEM}

Use cat myfile to output the contents of the file to the command line.

Task 5: Permissions 101

In Linux, a file's characteristics determines what actions can be performed on that file and by whom. The three basic actions we have in Linux are read, write and execute.

A file's permissions can be viewed by using the -l flag on the ls command.

We can switch users using su <user>.

On the deployable machine, who is the owner of "important"?

user2

Use ls -l to view the owner of "important".

What would the command be to switch to the user "user2"?

su user2

The su command is used to switch users.

Output the contents of "important", what is the flag?

THM{SU_USER2}

After switching to user2 using su, we can cat to view the output of "important".

Task 6: Common Directories

The Linux filesystem is organized into directories that hold important files for the operating system. The /etc directory holds system files that are used by the operating system. /var holds variable data such as logs. /root is the home directory for the root user, and /tmp holds temporary information and is wiped after the computer is restarted.

What is the directory path that would we expect logs to be stored in?

/var/log

Logs are stored in the log directory of /var.

What root directory is similar to how RAM on a computer works?

/tmp

RAM on a computer is wiped after the computer is restarted, similar to tmp.

Name the home directory of the root user

/root

The root user's home directory is simply root.

Task 7: Conclusions and Summaries

In conclusion, this room allowed us to:

  • Use terminal text editors

  • Deploy general utilities, such as downloading and serving contents using a Python web server

  • Take a look into processes

  • Maintain and automate our system using crontabs, package management, and reviewing logs

Task 8: Linux Fundamentals Part 3


Last updated 4 months ago

My walkthrough for the next room in this Linux introductory series can be found .

⋅ ⋅

here
Work
Thoughts
Home