November Season: They Always Come Back
18d 13h leftAn intruder didn't just get in — they made sure they could get back. Three boxes, three footholds hidden where Linux re-runs things on its own: a cron job that phones home, a login hook that re-arms on every shell, and a library force-loaded into every process. Hunt each one down, rip it out without breaking the box, and recover what they left. Defensive eradication only.
The Job That Phones Home
persistence · cron · dfir
Every Login Reopens the Door
persistence · profile.d · shell
Loaded Before Anything Else
persistence · ld-preload · guided
Loaded Before Anything Else
150 pts · decays to 60 · +25 first bloodPractise removing a preload registration in this guided exercise. The library named in /etc/ld.so.preload is an inert copy of a system library: it does not hide files or processes, intercept commands, or collect data. Read the registration, record the library path, remove both the registration and the demonstration library, and recover the flag from the exercise note. Full root on an isolated box; grading reads the filesystem directly.
The live sandbox for this challenge isn't available yet — the brief is open.
Hints
Hints for this challenge unlock with Pro.Sign in or create an account.
Submit flag
Complete every objective in the lab and use Verify & grade, then submit the flag from that same box here.
Sign in to submit flags and get on the board.
Season standings
loading standings…