Home / Labs / Contain the Breach

Contain the Breach

192.168.1.50 has root and is still inside. Lock them out now.

Open this lab

Commands practised here

• grep 'Accepted' /var/log/auth.logShows all successful logins with timestamps.
• cat /evidence/ps-snapshot.txtShows the captured process list.
• cat /evidence/netstat-snapshot.txtShows the captured network connections.
• cat /root/.ssh/authorized_keysLists all authorized SSH keys - including planted ones.

Nearby labs

• All labsBrowse the full list.
• Exam prepWhich exams these objectives map to.
• Crack the Brute Force
• Cross-Reference Sources