Operation Choke Point

LOCKOUT · LINUX · difficulty 5 · ~40 min · 21 steps

Your edge firewall answers to somebody else. Everything the site does passes through it.

Briefing

The edge firewall stopped accepting your SSH key on Thursday. The web interface takes your password and returns you to the login page. Traffic is flowing normally, which is why nobody escalated it for four days. This device terminates the site VPN, does the NAT, and sees every packet anybody here sends anywhere. You cannot simply unplug it, and you cannot trust a single thing it tells you over the network. There is a serial cable in the drawer. Start there.

Objectives

• Regain administrative access out of band
• Find how they kept access, including what you cannot delete
• Establish whether the system binaries are still the vendor's
• Determine whether the evidence itself has been altered
• Decide, with evidence, between cleaning and rebuilding

Return to the range lobby