Operation Ghost Signal

PRACTICAL · LINUX · difficulty 1 · ~20 min · 24 steps

A web server is mining crypto for someone who isn't you.

Briefing

03:12 UTC. The NOC paged you: srv-web-04, an Ubuntu 22.04 production web node, is pegged at 400% CPU and egressing to a known Tor exit range. You have root over an out-of-band console. Triage, hunt, eradicate, contain. Every command you type is executed against the live (simulated) box. Make them count.

Objectives

• Establish situational awareness on the host
• Locate the malicious process and its payload
• Identify persistence and initial-access vector
• Eradicate the miner and block the C2
• Trace the origin as far as the evidence honestly reaches

Return to the range lobby