Home / Labs / Isolate the Host

Isolate the Host

Reverse shell detected. The attacker is active inside. Map their connections and cut the cord.

Open this lab

Commands practised here

• cat /evidence/netstat-snapshot.txtShows all network connections - attacker and legitimate.
• cat /evidence/ps-snapshot.txtShows what every process on the system is doing.
• cat /evidence/ifconfig-snapshot.txtShows network interfaces and their IP addresses.
• grep '192.168.1.50' /evidence/netstat-snapshot.txt | grep ESTABLISHEDIsolates just the attacker connections.

Nearby labs

• All labsBrowse the full list.
• Exam prepWhich exams these objectives map to.
• Hunt the Malware
• Map the Network Footprint