HTB CJCA: Operating System and Endpoint Security

Operating System and Endpoint Security tests hardening and permission logic on Windows and Linux endpoints. CJCA expects you to read access rules, identify risky configurations, and choose endpoint controls that actually reduce attack surface.

Core rules

• Windows uses NTFS ACLs with allow/deny entries; explicit deny usually wins. UAC prompts for elevation but is not a security boundary against an already-compromised admin account.
• Linux permissions: owner/group/other with read (4), write (2), execute (1). chmod 640 gives owner rw, group r, others none. sudo grants temporary elevated execution; SUID binaries run as their owner and deserve review.
• Hardening: patch promptly, remove or disable unused services, restrict local admin rights, enable host firewall and disk encryption, use application allowlisting, and centralize logs.
• Endpoint protection: signature-based antivirus catches known malware; EDR adds behavior monitoring, telemetry, and response. Neither replaces patching.

Worked example

A file is owned by root:finance with mode 640. User alice is in the finance group but is not root. Alice can read the file but cannot write to it, because group permissions are r--. If the requirement is that finance members can edit the file, the mode should be 660, not 777; 777 would let every local user modify it. If Alice needs to edit but the file must remain root-owned, a better fix is a controlled group-write permission or a sudo rule, not broad world-write.

Traps

777 is almost never the right answer. UAC consent is not the same as least privilege. A disabled antivirus service is not hardening. Linux execute permission on a directory means traverse, not run. Do not assume an EDR agent blocks every technique; it detects and may respond.