Lab Description:

This lab simulates a scenario where a Linux server has been compromised by an attacker. The attacker gains an initial foothold by exploiting a known CVE (Common Vulnerability and Exposure) in the system. Using this vulnerability, the attacker is able to gain access to a Docker container running on the server. From within the container, the attacker performs a Docker escape to break out of the container’s isolated environment and gain access to the underlying host system. Once the attacker has shell access to the host system, they escalate privileges to root and establish persistence through multiple techniques to maintain access.

Lab Objectives:

• Initial Access: Investigate how the attacker exploited a CVE to gain initial access to the system.

• Privilege Escalation (Docker Compromise): Identify how the attacker gained access to a Docker container.

• Docker Escape: Analyze how the attacker escape the Docker container to access the host system.

• Post-Escape Privilege Escalation: Investigate how the attacker escalated privileges to root on the host system.

• Persistence Mechanisms: Examine how the attacker maintained access through persistence techniques like cron jobs and SSH keys.

Tools and Techniques:

• Disk Forensic: FTK Imager, Sleuth Kit
• Log Analysis : Any Preferred Tool or SIEM
• Container Forensic: docker, dive

Lab Evidence:

You will get access to all the evidence collected from the breached server.

Password: threatbreach.io

Writeup

Writeup will be published soon, If you want to send your writeup to be evaluated share it on labs[@]threatbreach.io