Operation Babel

WAR GAMES · LINUX · difficulty 5 · ~40 min · 20 steps

You inherited the site, the servers and the logs. The logs are not in your language, and neither is the intruder.

Briefing

A multinational exercise hands your section a working site: eleven servers, a directory, a monitoring stack, all built and run for three years by the contingent that rotated out on Friday. It works. Nobody handed over a password list and nobody handed over a dictionary. Every log on this box is in a Cyrillic code page, the clock is three hours ahead of the exercise timeline you were given, and your terminal renders half of it as punctuation soup. There has been an intrusion and it is in these logs. The language barrier is not an obstacle to the investigation. It is where the intruder is hiding.

Objectives

• Establish the locale, the code page and the timezone before reading anything
• Convert the evidence correctly instead of guessing at it
• Normalise every timestamp to one reference before you correlate
• Find the account that is not the account it appears to be
• Close it, and leave the next section the handover you wish you had

Return to the range lobby