Incident response: evict rogue accounts, eradicate persistence, attribute a breach.
- Audit the User Databaseeasy · in-browser
Write /etc/audit/rules.d/identity.rules so auditd watches the account databases for changes. Add a write+attribute watch (-p wa) on /etc/passwd, on /etc/shadow, and on /etc/group, each tagged with the key (-k) named identity.
(Authored config, graded structurally — the engine isn't run here.)
- Biggest log fileeasy
Write the absolute path of the largest file under /var/log to /home/player/big.txt.
- Block the Attacker at TCP Wrapperseasy · in-browser
Write /etc/hosts.deny to contain a brute-forcer. Deny sshd access from the single host 203.0.113.7, deny all services from the subnet 198.51.100.0/24, and add a final catch-all line that denies ALL services from ALL hosts (the default-deny posture, relying on /etc/hosts.allow for exceptions).
(Authored config, graded structurally — the engine isn't run here.)
- Count failed SSH loginseasy
How many failed SSH password attempts are in /var/log/auth.log? Write the number to /home/player/n.txt.
- Disable Unused Kernel Moduleseasy · in-browser
Write /etc/modprobe.d/blacklist-hardening.conf to neutralize attack-surface modules. For both usb-storage and dccp, add an install <module> /bin/true line so loading is silently redirected, and add a blacklist <module> line so they are not auto-loaded.
(Authored config, graded structurally — the engine isn't run here.)
- Evict a hidden root accounteasy
Incident response: an intruder left a hidden privileged account on this host. Find and remove every UID-0 account except root (the planted one is 'svcbackup').
- Find the hidden stasheasy
An attacker hid a file in /opt/.stash. Write its filename (just the name, not the path) to /home/player/name.txt.
- Harden the SSH Daemoneasy · in-browser
Write /etc/ssh/sshd_config.d/10-hardening.conf to lock down SSH. Disable root login (PermitRootLogin no), disable password authentication (PasswordAuthentication no), reject empty passwords (PermitEmptyPasswords no), and cap login attempts with MaxAuthTries set to a single small integer of 3 or fewer.
(Authored config, graded structurally — the engine isn't run here.)
- Identify the brute-forcereasy
Which source IP has the most failed SSH attempts in /var/log/auth.log? Write it to /home/player/ip.txt.
- List UID-0 accountseasy
Write every username with UID 0 (sorted) to /home/player/r.txt.
- Recover a leaked secreteasy
An attacker's command leaked a token into /root/.bash_history. Write just the token (the value after TOKEN=) to /home/player/tok.txt.
- Schedule an Integrity Checkeasy · in-browser
Write /etc/cron.d/aide-check to run a daily filesystem integrity scan. Set a safe PATH= line for cron, then add a single job that runs as the root user (the 6-field cron.d form: minute hour dom mon dow USER command) invoking aide with its --check (or -C) option.
(Authored config, graded structurally — the engine isn't run here.)
- Whose cron is that?easy
A rogue job sits in /etc/cron.d/beacon. Write the username it runs as to /home/player/who.txt.
- Configure a fail2ban SSH Jailmedium · in-browser
Write /etc/fail2ban/jail.local with an [sshd] section that is enabled (enabled = true), uses the sshd filter (filter = sshd), bans after at most 4 failures (set maxretry to 4 or fewer), sets a findtime detection window, and bans for one hour (bantime = 3600).
(Authored config, graded structurally — the engine isn't run here.)
- Count authorized SSH keysmedium
Write how many keys are in /root/.ssh/authorized_keys to /home/player/n.txt.
- Count system SUID binariesmedium
Write how many SUID files exist under /usr/bin to /home/player/n.txt.
- Decode a ROT13 notemedium
An attacker left a ROT13 note at /opt/.note. Decode it and write the plaintext to /home/player/plain.txt.
- Decode a base32 blobmedium
Decode /opt/.b32 (base32) and write the recovered string to /home/player/s.txt.
- Decode an exfil blobmedium
Malware staged /opt/.x/payload.b64 (base64). Decode it and write the recovered secret to /home/player/secret.txt.
- Enumerate cron commandsmedium
List every command scheduled in /etc/cron.d (the part after the user field), one per line sorted, to /home/player/c.txt.
- Eradicate attacker persistencemedium
Malware established two persistence mechanisms: a rogue systemd unit (updater.service) and a rogue cron job (/etc/cron.d/beacon). Remove BOTH — but keep the legitimate crond service enabled.
- Find the most recent dropmedium
Which file under /opt/drop was created most recently? Write its absolute path to /home/player/new.txt.
- Find the world-writable filemedium
Exactly one file under /opt/app is world-writable (an attacker left it). Write its absolute path to /home/player/ww.txt.
- Inventory planted SUID binariesmedium
List every SUID file under /opt (sorted, one absolute path per line) to /home/player/suid.txt.
- Lock Down the Network Stackmedium · in-browser
Write /etc/sysctl.d/99-net-hardening.conf to harden IPv4. Enable TCP SYN cookies (net.ipv4.tcp_syncookies = 1), disable acceptance of ICMP redirects (net.ipv4.conf.all.accept_redirects = 0), disable sending redirects (net.ipv4.conf.all.send_redirects = 0), enable reverse-path filtering (net.ipv4.conf.all.rp_filter = 1), and disable IP forwarding (net.ipv4.ip_forward = 0).
(Authored config, graded structurally — the engine isn't run here.)
- Record Every Commandmedium · in-browser
Write /etc/audit/rules.d/exec.rules to log all program executions. Add a syscall rule -a always,exit for arch=b64 watching the execve syscall (-S execve), keyed (-k) as exec; add the equivalent rule for arch=b32; and make the rule list immutable by ending the file with -e 2.
(Authored config, graded structurally — the engine isn't run here.)
- Record Privileged Sessionsmedium · in-browser
Write /etc/sudoers.d/10-logging to capture a full audit trail of sudo use. Use Defaults lines to enable log_input and log_output (so keystrokes and output are recorded), point session transcripts at a directory with iolog_dir=, and force a real TTY with use_pty.
(Authored config, graded structurally — the engine isn't run here.)
- Restrict Kernel Information Leaksmedium · in-browser
Write /etc/sysctl.d/99-kernel-hardening.conf to reduce kernel exposure. Force full address-space randomization (kernel.randomize_va_space = 2), restrict kernel pointer exposure (kernel.kptr_restrict = 2), restrict the kernel ring buffer (kernel.dmesg_restrict = 1), and block setuid core dumps (fs.suid_dumpable = 0).
(Authored config, graded structurally — the engine isn't run here.)
- Secret in /etc/environmentmedium
A credential was written into /etc/environment. Write the value of the API_KEY variable to /home/player/k.txt.
- Ship Auth Logs Off-Boxmedium · in-browser
Write /etc/rsyslog.d/10-forward.conf to forward logs to a central collector so an attacker cannot erase them locally. Forward the authpriv facility (all priorities) to 192.168.1.10 over reliable TCP on port 514 (use the @@host:514 double-at syntax), and enable a LinkedList action queue with $ActionQueueType LinkedList so messages buffer if the collector is down.
(Authored config, graded structurally — the engine isn't run here.)
- Spot the sudoers backdoormedium
Someone dropped a passwordless-root sudoers rule in /etc/sudoers.d. Write the username it empowers to /home/player/who.txt.
- Suspicious executable in /tmpmedium
Find the executable file an attacker dropped in /tmp; write its absolute path to /home/player/p.txt.
- Which account was just added?medium
An attacker created a new user (UID >= 4000). Write that username to /home/player/who.txt.
- Accounts with no passwordpro
List every account in /etc/shadow whose password field is empty (login with no password), sorted, to /home/player/r.txt.
- Attribute the breachpro
Investigate the intrusion. /var/log/auth.log shows an SSH brute force followed by a successful login. Write the attacker's IP to /home/player/attacker.txt and the account they compromised to /home/player/user.txt.
- Author an AIDE Policypro · in-browser
Write /etc/aide.conf to baseline critical paths. Define a rule group named NORMAL whose attribute list includes the sha256 checksum (e.g. NORMAL = p+i+n+u+g+s+m+c+sha256), apply NORMAL to /bin (and ideally /sbin and /boot), and exclude the noisy /var/log tree with a leading ! negation line.
(Authored config, graded structurally — the engine isn't run here.)
- Catch Kernel Module Loadspro · in-browser
Write /etc/audit/rules.d/modules.rules to detect rootkit-style kernel module manipulation. Add an -a always,exit rule for arch=b64 covering the init_module, finit_module and delete_module syscalls; add -p x watches on /sbin/insmod and /sbin/modprobe; and tag every rule with the key (-k) modules.
(Authored config, graded structurally — the engine isn't run here.)
- Find the locked filepro
An attacker set a file immutable under /etc/app to stop you fixing it. Write that file's absolute path to /home/player/locked.txt.
- Find the planted SUIDpro
Exactly one SUID file was planted under /opt; write its path to /home/player/s.txt.
- Find the tampered binarypro
/opt/bin ships a SHA256SUMS manifest; one file was modified. Write the name of the failing file to /home/player/bad.txt.
- First brute-force timestamppro
From /var/log/auth.log write the timestamp (first 3 fields) of the FIRST 'Failed password' line to /home/player/t.txt.
- Inventory listening portspro
Write every distinct TCP port in LISTEN state, sorted numerically, one per line, to /home/player/ports.txt.
- Most recently modified /etc filepro
Which file directly under /etc/app was modified most recently? Write its path to /home/player/m.txt.
- Watch the System Clockpro · in-browser
Write /etc/audit/rules.d/time.rules to detect clock tampering that would forge log timestamps. Add an -a always,exit rule for arch=b64 covering the adjtimex, settimeofday and clock_settime syscalls; add a -p wa watch on /etc/localtime; and tag every rule with the key (-k) time-change.
(Authored config, graded structurally — the engine isn't run here.)
- Write a Brute-Force Detectorpro · in-browser
Write a bash script /home/player/detect.sh that reports the IPs hammering SSH. It must start with a bash shebang, use awk to scan /var/log/secure for 'Failed password' lines, and pipe the extracted source IPs through sort, uniq -c and sort -rn so the busiest attacker appears first.
(Authored config, graded structurally — the engine isn't run here.)