tmpfs.tech · all tracks · Defense & IR

Eradicate attacker persistence

Defense & IR · medium · live throwaway Linux box · 3 tiered hints

Malware established two persistence mechanisms: a rogue systemd unit (updater.service) and a rogue cron job (/etc/cron.d/beacon). Remove BOTH — but keep the legitimate crond service enabled.

▶ Start this challenge

Fastest verified solves

• linksrum437s · ✦ no hints

How it works

Press start and you get your own real, disposable Linux VM — in the browser terminal or over SSH. Work the task on a live system; tmpfs.tech grades your solution automatically against the actual machine state, then throws the box away. No install, free to try as a guest.

More Defense & IR challenges

Incident response: evict rogue accounts, eradicate persistence, attribute a breach.

• Audit the User Databaseeasy · in-browser
• Biggest log fileeasy
• Block the Attacker at TCP Wrapperseasy · in-browser
• Count failed SSH loginseasy
• Disable Unused Kernel Moduleseasy · in-browser
• Evict a hidden root accounteasy
• Find the hidden stasheasy
• Harden the SSH Daemoneasy · in-browser

See all Defense & IR challenges →

FAQ

Is it free? Yes — play as a guest, no signup required to start.

Do I need to install anything? No. Everything runs in your browser, or connect over SSH if you prefer your own terminal.

How is it graded? Automatically and deterministically — your work is checked against the real state of the machine you worked on.