Operation Iron Ledger

PRACTICAL · LINUX · difficulty 1 · ~15 min · 20 steps

Post-breach persistence audit on a Debian build server.

Briefing

A vendor notified us that deb-build-03 appears in a leaked credential dump. No active attack detected — but anything that had access may have left persistence behind. Run a methodical audit: users, SSH keys, cron, services, and autostart.

Objectives

• Audit accounts and SSH authorized_keys
• Review cron and systemd for rogue persistence
• Practice reading /etc like an investigator
• Trace the origin as far as the evidence honestly reaches

Return to the range lobby