SIMULATION -
You are about to enter the virtual environment.
Once you have completed the item in the virtual environment, you will NOT be allowed to return to this item.
Click Next to continue.
Question and Instructions -
DO NOT perform the following actions within the virtual environment. Making any of these changes will cause the virtual environment to fail and prevent proper scoring.
1. Disabling ssh
2. Disabling systemd
3. Altering the network adapter 172.162.0.0
4. Changing the password in the lab admin account
Once you have completed the item in the virtual environment. you will NOT be allowed to return to this item.
TEST QUESTION -
This system was recently patched following the exploitation of a vulnerability by an attacker to enable data exfiltration.
Despite the vulnerability being patched, it is likely that a malicious TCP service is still running and the adversary has achieved persistence by creating a systemd service.
Examples of commands to use:
kill, killall
lsof
man, --help (use for assistance)
netstat (useful flags: a, n, g, u)
ps (useful flag: a)
systemctl (to control systemd)
Please note: the list of commands shown above is not exhaustive. All native commands are available.
INSTRUSTIONS -
Using the following credentials:
Username: labXXXadmin -
Password: XXXyyYzz!
Investigate to identify indicators of compromise and then remediate them. You will need to make at least two changes:
1. End the compromised process that is using a malicious TCP service.
2. Remove the malicious persistence agent by disabling the service's ability to start on boot.
dangerelchulo
Highly Voted 2 years, 3 months ago23169fd
5 months agoyoungprinceton
2 years, 3 months agodangerelchulo
2 years, 1 month agoyoungprinceton
2 years, 1 month agoyoungprinceton
2 years, 1 month agoBroesweelies
Highly Voted 1 year, 9 months agoIT_Master_Tech
Most Recent 7 months, 4 weeks agoe4af987
8 months, 1 week agoSirL
7 months, 2 weeks agoWaltsthe
8 months, 3 weeks agoD1960
10 months, 2 weeks agoIT_Master_Tech
1 week agoDelab202
11 months agoTrap_D0_r
10 months, 3 weeks agoD1960
10 months, 2 weeks agoAnarckii
11 months, 2 weeks agojoinedatthehop
1 year agoPluDou
4 months, 2 weeks agoD1960
10 months, 2 weeks agoUncle_Lucifer
1 year, 3 months agoUncle_Lucifer
1 year, 3 months agoUncle_Lucifer
1 year, 3 months agopawnpusher
1 year, 3 months agoUncle_Lucifer
1 year, 3 months ago[Removed]
1 year, 6 months agoBLADESWIFTKNIFE
1 year, 9 months agoMikeyMaster
1 year, 7 months agoMostofMichelle
1 year, 3 months agobobby44
1 year, 9 months agobobby44
1 year, 9 months agoToneBar
1 year, 9 months agojekster
1 year, 10 months agoFOURDUE
1 year, 10 months ago