Basic File Analysis

To follow along with the examples shown here using the virtual machines is it safer to use an account other than the administration account (root). By pressing the button below a new account is created called "demo", password is also "demo". Log in using this account and you cannot do any damage. If you mess the account up and want to start again, just press the button again.

Once created, you can log into this account using telnet or ssh, logging into the hostname linuxzoo.net. Remember the username is demo and the password is demo. And remember, you cannot break anything using this account! The account begins with an empty directory, so dont be shocked that "ls" shows nothing...

MAKE SURE YOU USE THE USER demo. If you do this with "root" or another account, you will be marked wrong. If you start with the wrong user, make sure you delete any files you created wrongly before changing to demo.

This question covers basic file manipulation. To begin this question use the first button to set up a small file and directory tree in /home/demo. The resulting tree looks like:

/
+--- home
     |
     +--- demo
          |
          +--- theanalysis
          |    +--- file1
          |    +--- file2
          |    +--- file3
          |    +--- file4
          |    +--- file5
          |
          +--- tree (plus directories and subdirectories)
          |
          +--- suspect
               +--- data1

You only have to press the button to create this tree. You do not create this structure yourself. It is completely automatic. If you lose this structure or accidentally delete it then you can press the button again to restore the struture.

Using the "file" command, evaluate the file signature of theanalysis/file1.
What is file1? data ASCII text ELF 32-bit executable ELF 64-bit executable JPEG GIF

User the "file" command, evaluate the file signature of theanalysis/file4.
What is file4? data ASCII text ELF 32-bit executable ELF 64-bit executable JPEG GIF

Use the md5sum command to calculate the md5 hash of file3.
What is the md5 hash of file3? 9369bbf580daf4c52288f951dd547b37 693f40a4d6a497d422372ce4bfd2bbc2 f319a7af4b8889b21159c68606f3b139 79054025255fb1a26e4bc422aef54eb4 dbe0018c2e65da9d3b48f0e5a76d06b9 12cbbf1f2f88dc3b0b289cd368761b7e f319a7af4b8889b21159c68606f3b139 bde0018c2e65da9d3b48f0e5a76d06b9 f19abf1f2f88dc3b0b289cd368761b7e

If another file has the same md5 hash, what does this mean?
Meaning of two files with same hash? File content must be identical File content are probably identical File permissions are probably identical File lengths are different File content are probably different

Use the md5sum command to calculate the md5 hash of file4.
What is the md5 hash of file4? 9369bbf580daf4c52288f951dd547b37 693f40a4d6a497d422372ce4bfd2bbc2 f319a7af4b8889b21159c68606f3b139 79054025255fb1a26e4bc422aef54eb4 dbe0018c2e65da9d3b48f0e5a76d06b9 12cbbf1f2f88dc3b0b289cd368761b7e f319a7af4b8889b21159c68606f3b139 bde0018c2e65da9d3b48f0e5a76d06b9 f19abf1f2f88dc3b0b289cd368761b7e

Use the cmp command to verify that file3 and file4 are identical.
Output of cmp command Command not found file3 file4 similar: ... file3 file4 identical: ... file3 file4 differ: ... file3 file4 inconclusive analysis: ... file3 file4 hash collision detected: ... file3 file4 permission denied: ...

Check file3 and file4 using a 512 bit sha hash.
512 bit hash of file3 a34473cf767c6108a5751a20971f1fdfba97690a 4283dd2d70af1ad3c2d5fdc917330bf502035658 9272889ad0f7372047229d19ca58b93c539002f21f6e3da1697514406fe9b3cb20fcf546b9005ebadc16691a71658af848e35abad58422d5ae4650c21d7ad749 77e921be6902b03a34e6e56aa80f611bb5aec86850f83a5260959ff33012dfc6bb554141fe8641c09ffdd44955ea0af232e9883b91eae6db26a87782640e0a95 06f1d4b4962a1dcca3bcfdfe2d369c800190ca107ad138ced00ae1a20b17032f833226652ef413884e8483eb14cc8b665a98438885fc93de341ae47c447972e7
512 bit hash of file4 a34473cf767c6108a5751a20971f1fdfba97690a 4283dd2d70af1ad3c2d5fdc917330bf502035658 9272889ad0f7372047229d19ca58b93c539002f21f6e3da1697514406fe9b3cb20fcf546b9005ebadc16691a71658af848e35abad58422d5ae4650c21d7ad749 77e921be6902b03a34e6e56aa80f611bb5aec86850f83a5260959ff33012dfc6bb554141fe8641c09ffdd44955ea0af232e9883b91eae6db26a87782640e0a95 06f1d4b4962a1dcca3bcfdfe2d369c800190ca107ad138ced00ae1a20b17032f833226652ef413884e8483eb14cc8b665a98438885fc93de341ae47c447972e7
So this means? File content must be identical File content are almost certainly identical File permissions are probably identical File lengths are different File content are probably different File content are definitely different

Use the find command to locate all files which start with an "a" and end in a ".conf" which exist somewhere in /usr/share. Save this list to a file '/home/demo/alist'. Make sure that the first parameter of find is "/usr/share". Run the command as user "demo" and do not worry about any permission error messages.

Use the find command to locate all FILES in /usr/share which have the permissions "rwxr-xr-x". Save this list to /home/demo/blist. Make sure that the first parameter of find is "/usr/share". Run the command as user "demo" and ignore any permission error messages.

Use the find command to locate all directories in /usr/share which have the permissions "rwxr-xr-x". Pipe this list to wc and count the number of directories.
Number of directories:

Again using the find command find out how many FILES in /etc are in group lp.
Number of files:

Using a combination of grep, regular expressions, and wc via a pipe count how many words in the /usr/share/dict/words dictionary starts with "anti" and ends with an "n".
Number of words:

Using grep and regular expressions, create a file /home/demo/aword which contains all the words which start with "tele" from /usr/share/dict/words, and which are exactly 7 characters long.

How many words have the string "ra" in them twice in /usr/share/dict/words?
Number of words:

How many words are in /usr/share/dict/words which contains "ice" then immediately following that either an "s" or a "d" (i.e. ices or iced). Use square brackets to form a set in your regular expression.
Number of words:

Use grep on words to find a word that contains each of the vowels in alphabetical (i.e first an A, then an E, etc) order in /usr/share/dict/words. How many such words are there? (you may include words with extra vowels such as adventitious. A vowel is one of A,E,I,O,U.
Number of words:

The word interlinking includes the same two characters (e.g. "in") which appear three times. The word "priestessess" also contains the same two characters repeated three time (e.g. "es").

How many words can you find which contain any two characters repeated three times, like the examples "interlinking" and "priestessess". Use /usr/share/dict/words as your list of possible words and grep to find the answer.
Number of words:

Note. Do a case sensitive match, so do not use "-i".

Challenge Question: This is a tricky question. Just give it 10 minutes before moving onto the next question!

How many words are 5 character palindromes? A palindrome is a word spelled the same way forward and backwards, such as "sagas". Use /usr/share/dict/words. Hint: Use multiple groups and backreferences.
Number of words: