{"id":1014,"date":"2021-03-10T20:16:37","date_gmt":"2021-03-10T12:16:37","guid":{"rendered":"https:\/\/byy3.com\/?p=1014"},"modified":"2021-03-10T20:17:22","modified_gmt":"2021-03-10T12:17:22","slug":"the-find-command","status":"publish","type":"post","link":"https:\/\/byy3.com\/?p=1014","title":{"rendered":"The find command"},"content":{"rendered":"
\n
\n
\n
\n
\n
\n
\n
\"The<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n
\n

The find command ~ THM Writeup<\/h1>\n
\n
\n
\n
\"The<\/a><\/div>\n
\n
\n
\n
\n
\n

Irshad Ahamed<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

May 13, 2020\u00b7<\/span>4 min read<\/p>\n<\/div>\n<\/div>\n

\n
\n
\n
\n
\n
<\/div>\n<\/div>\n<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
\n

I sincerely thanks the Tryhackme.com for creating such a platform for the cyber community!<\/p>\n<\/blockquote>\n

\n
\n
\n
\n
\n
\"The<\/div>\n

\"The<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/figure>\n

This is a writeup for the room: The find command [https:\/\/tryhackme.com\/room\/thefindcommand<\/a>]<\/p>\n

https:\/\/tryhackme.com\/p\/Zink<\/a><\/p>\n

To be precise, the \u2018find\u2019 command is used to search for files in a directory hierarchy, and as the necessary explanation is available there, we will look at the tasks.<\/strong><\/p>\n

\n

Note: The tasks are easy to solve on sight, but only few questions needs explanation for beginners and you can find them so!<\/em><\/p>\n<\/blockquote>\n

TASK -1 : ?<\/strong><\/h1>\n

TASK -2 :<\/h1>\n

#1 Find all files whose name ends with \u201c.xml\u201d<\/strong><\/p>\n

Ans:<\/strong>\u00a0find \/ -type f -name \u201c*.xml\u201d<\/p>\n

#2 Find all files in the \/home directory (recursive) whose name is \u201cuser.txt\u201d<\/strong><\/p>\n

Ans:<\/strong>\u00a0find \/home -type f -iname user.txt<\/p>\n

#3 Find all directories whose name contains the word \u201cexploits\u201d<\/strong><\/p>\n

Ans:<\/strong>\u00a0find \/ -type d -name \u201c*exploits*\u201d<\/p>\n<\/div>\n<\/div>\n<\/section>\n

<\/div>\n
\n
\n
\n

TASK -3:<\/h1>\n

#1 Fin<\/span>d all files owned by the user \u201ckittycat\u201d<\/strong><\/p>\n

Ans:<\/strong>\u00a0find \/ -type f -user kittycat<\/p>\n

#2 Find all files that are exactly 150 bytes in size<\/strong><\/p>\n

Ans:<\/strong>\u00a0find \/ -type f -size 150c<\/p>\n

E<\/span>xplanation:\u00a0<\/em><\/strong>To sort the files by size, one can use \u2018-size\u2019. The size number \u2018150\u2019 is suffixed by \u2018c\u2019 denotes \u201cbytes\u201d.<\/em><\/p>\n

#3 Find all files in the \/home directory (recursive) with size less than 2 KiB\u2019s and extension \u201c.txt\u201d<\/strong><\/p>\n

Ans:<\/strong>\u00a0find \/home -type f -size -2k -name \u201c*.txt\u201d<\/p>\n

E<\/span>xplanation:\u00a0<\/em><\/strong>To sort by kilobytes, the size number is suffixed with \u2018k\u2019 and due to the condition \u201cless than\u201d, final size denoted as \u2018-2k\u2019. In the extension, \u2018*\u2019 denotes to find all the files that contains that name \u2018.txt\u2019.<\/em><\/p>\n

#4 Find all files that are exactly readable and writeable by the owner, and readable by everyone else (use octal format)<\/strong><\/p>\n

Ans:<\/strong>\u00a0find \/ -type f -perm 644<\/p>\n

E<\/span>xplanation<\/em><\/strong>: To sort by file permissions, one can use \u2018-perm\u2019. The file permissions can be represented in either symbolic or octal format (i.e. u=r [or] 644 ). On further breaking down, the number \u20186\u2019 denotes the OWNER & the rest denotes the USER GROUP & OTHER USERS.<\/em><\/p>\n

#5 Find all files that are only readable by anyone (use octal format)<\/strong><\/p>\n

Ans:<\/strong>\u00a0find \/ -type f -perm \/444<\/p>\n

E<\/span>xplanation<\/em><\/strong>: The \u2018444' is prefixed by \u2018\/\u2019, so that it will match files that are readable and writable by\u00a0<\/em>at least one<\/em><\/strong>\u00a0of the groups (owner, group, or others).<\/em><\/p>\n

#6 Find all files with write permission for the group \u201cothers\u201d, regardless of any other permissions, with extension \u201c.sh\u201d (use symbolic format)<\/strong><\/p>\n

Ans:\u00a0<\/strong>find \/ -type f -perm -o=w -name \u201c*.sh\u201d<\/p>\n

#7 Find all files in the \/usr\/bin directory (recursive) that are owned by root and have at least the SUID permission (use symbolic format)<\/strong><\/p>\n

Ans:<\/strong>\u00a0find \/usr\/bin -type f -user root -perm -u=s<\/p>\n

#8 Find all files that were not accessed in the last 10 days with extension \u201c.png\u201d<\/strong><\/p>\n

Ans:<\/strong>\u00a0find \/ -type f -atime +10 -name \u201c*.png\u201d<\/p>\n

E<\/span>xplanation:<\/em><\/strong>\u00a0To filter the file by DAYs of ACCESSING, \u2018time\u2019 is used prefixed with \u2018-a\u2019. As the requirement is that the file should NOT be accessed in last \u201810\u2019 days, the number \u201810\u2019 is prefixed with \u2018+\u2019.<\/em><\/p>\n

#9 Find all files in the \/usr\/bin directory (recursive) that have been modified within the last 2 hours<\/strong><\/p>\n

Ans:<\/strong>\u00a0find \/usr\/bin -type f -mmin -120<\/p>\n

E<\/span>xplanation:<\/em><\/strong>\u00a0To filter the file by HOURs of MODIFICATION, \u2018min\u2019 is used prefixed with \u2018-m\u2019. As the requirement is that the file should have been MODIFIED within last two hours, the hours in minutes is taken prefixed with \u2018-120\u2019.<\/em><\/p>\n<\/div>\n<\/div>\n<\/section>\n

<\/div>\n
\n
\n
\n

TASK -4:<\/h1>\n

2> \/dev\/null<\/code><\/p>\n

The above flag is used with\u00a0find<\/code>command to neglect the unwanted error that are displayed in the terminal, making the output bit legible to view. This is helpful when the search surface is bit huge<\/p>\n

-exec<\/code><\/p>\n

The above flag is used to execute any defined action, after performing the \u2018find\u2019 operation. Remember the privilege escalation bug in sudo!!! ?<\/p>\n<\/div>\n<\/div>\n<\/section>\n

<\/div>\n
\n
\n
\n

IF YOU FIND THIS ARTICLE USEFUL, MAKE A CLAP. I\u2019 LL BE WRITING MORE USEFUL ARTICLES!<\/p>\n

Reference<\/em><\/strong>:<\/em><\/h1>\n<\/div>\n<\/div>\n<\/section>\n","protected":false},"excerpt":{"rendered":"

The find command ~ THM Writeup Irshad Ahamed May 13, 20 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[14],"tags":[543,544],"class_list":["post-1014","post","type-post","status-publish","format-standard","hentry","category-linux","tag-find","tag-find-command"],"_links":{"self":[{"href":"https:\/\/byy3.com\/index.php?rest_route=\/wp\/v2\/posts\/1014","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/byy3.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/byy3.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/byy3.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/byy3.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1014"}],"version-history":[{"count":0,"href":"https:\/\/byy3.com\/index.php?rest_route=\/wp\/v2\/posts\/1014\/revisions"}],"wp:attachment":[{"href":"https:\/\/byy3.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1014"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/byy3.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1014"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/byy3.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1014"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}