Lab Description:

In this hands-on lab, you will dive into a real-world scenario where a Linux server has been breached. The attacker exploited various misconfigurations to gain unauthorized access and deployed malware on the system. Your task is to investigate the breach, identify the misconfigurations, and analyze the deployed malware to understand the attacker’s actions and objectives.

Lab Objectives:

• Initial Compromise: Discover how the attacker initially compromised the server through misconfigurations.

• Privilege Escalation: Identify the techniques used by the attacker to escalate privileges on the Linux system.

• Malware Analysis: Examine how the malware was deployed by the attacker on the system.

• Log Analysis: Analyze system logs to trace the attacker’s actions and timeline.

• Remediation: Learn best practices to secure the system and prevent similar breaches in the future.

Tools and Techniques:

• Disk Forensic: FTK Imager, Sleuth Kit
• Log Analysis : Any Preferred Tool or SIEM
• Network Forensic: Zeek, Suricata, Wireshark, Network Miner

Lab Evidence:

You will get access to all the evidence collected from the breached server.

Password: threatbreach.io

Writeup

Writeup will be published soon, If you want to send your writeup to be evaluated share it on labs[@]threatbreach.io