Operation Last Good Copy

HOME LAB · LINUX · difficulty 5 · ~40 min · 18 steps

Everything on the NAS is encrypted, including the backup. Something older than the damage still exists.

Briefing

06:10. Every file on the family share has a new extension and there is a text file in each directory explaining how to pay. The nightly rsync mirror ran at 03:00. It ran perfectly. It mirrored the encryption onto the backup drive and deleted the originals, because that is what --delete does and you asked it to. The pool is ZFS. You have been taking hourly snapshots for two years and never once tested a restore. Find out whether that habit just saved you.

Objectives

Establish the health of the pool and the extent of the damage
Date the first encrypted write and find the account behind it
Locate the last snapshot taken before the damage
Prove what changed between that snapshot and now
Restore without destroying the evidence, then make it impossible to repeat

Return to the range lobby

shellDojo

THREAT FEED ▲ lateral movement via wmiexec up 18% ▲ new loader family 'GHOSTPULSE' staging via DLL search-order hijack ▲ prompt injection in support queues now routine ▲ cron persistence campaign targeting exposed SSH ▲ poisoned model weights on public hubs ▲ remember: trust nothing, hash everything ▲

operator@dojo:~$

No operation deployed. Open OPERATIONS and deploy one, or type start <id> at the prompt.

—

SITUATION

OBJECTIVES

CURRENT TASKING

booting range…

—SAFE

PERFORMANCE

ACCURACY—

ELAPSED0:00

VS PAR—

TYPING—

STREAK—

SCORE0

COMMAND BRIEF

Every command you are asked to type gets decoded here — what the binary is, what each flag does, and a hook to make it stick.

—

search ▸ —

Every command this range teaches, decoded. Pick one on the left, or search above.

OPERATOR

RECRUIT 0 XP

CAMPAIGN—

OPS CLEARED0

STEPS0

LIFETIME ACC—

DAY STREAK—

FLAGS—

FLAG WALLET

DEPLOY

ALL OPERATIONS

SHELL

TEXT SIZE 15

GUIDED MODE

Guided shows the next command as a ghost you can type over. Expert hides it — and expert clears earn their own flags.

FOCUS low & steady

SOUND

VOLUME

Steady, generated background beds — no streaming, no files, works offline. Keep it under the level where you notice it.

1–5 switch · esc close · / search manual

shellDojo range · operations · built by gary23w ▾

shellDojo

A blue team combat range. Every host, log, hash and IP address in here is fictional — nothing you type is executed anywhere.

shellDojo — defensive training only. Practising on systems you do not own is a crime. gary23w