● LIVE

November Season: They Always Come Back

18d 13h left

An intruder didn't just get in — they made sure they could get back. Three boxes, three footholds hidden where Linux re-runs things on its own: a cron job that phones home, a login hook that re-arms on every shell, and a library force-loaded into every process. Hunt each one down, rip it out without breaking the box, and recover what they left. Defensive eradication only.

Easy150 pts

The Job That Phones Home

persistence · cron · dfir

Medium275 pts

Every Login Reopens the Door

persistence · profile.d · shell

Easy150 pts

Loaded Before Anything Else

persistence · ld-preload · guided

The Job That Phones Home

150 pts · decays to 60 · +25 first blood

A departing intruder left a cron drop-in that beacons to an external host on every tick, disguised as routine package maintenance among the box's legitimate scheduled jobs. Audit the drop-ins in /etc/cron.d, tell the beacon from the real jobs, remove it without breaking the legitimate ones, and recover the note they left in root's home. You have full root on this isolated box.

The live sandbox for this challenge isn't available yet — brief and hints are open.

Hints

Cron policy is layered across /etc/crontab and every file in /etc/cron.d. List them: ls -la /etc/cron.d && grep -rn . /etc/cron.d.

Submit flag

Complete every objective in the lab and use Verify & grade, then submit the flag from that same box here.

Season standings

loading standings…