A second root account and a readable shadow file
Audit local accounts with awk. Find any account other than root with UID 0, any account with an empty password hash, and a permission on /etc/shadow that leaks every hash.
Briefing
A file integrity alert fired on /etc/passwd on app-11. You have a shell as analyst.
/etc/passwd fields are separated by colons: name, an x that points to the shadow file, UID, GID, comment, home, shell. /etc/shadow holds the hashes and should only be readable by root and the shadow group.
app-11 · Privilege audit
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.