Operation Dark Datastore

LOCKOUT · LINUX · difficulty 5 · ~40 min · 21 steps

Every guest is stopped and the datastore is encrypted. The multi-terabyte disks were never touched.

Briefing

The hypervisor's web interface answers with a ransom page. Your credentials do not work. Eighteen virtual machines — the file server, the mail gateway, the accounting system — are powered off and their configuration files have a new extension. You have console access, which is the only reason this is recoverable. Before you accept the number on that page, look at the file sizes. Encrypting a two-kilobyte descriptor takes a millisecond. Encrypting the eight-terabyte disk behind it takes days, and nobody has days.

Objectives

• Establish what is registered, what is running, and what is encrypted
• Find the accounts and services the intruder left behind
• Prove which files are actually damaged and which only look it
• Rebuild a disk descriptor over the surviving flat file
• Close the management plane before you power anything on

Return to the range lobby