November Season: They Always Come Back
18d 13h leftAn intruder didn't just get in — they made sure they could get back. Three boxes, three footholds hidden where Linux re-runs things on its own: a cron job that phones home, a login hook that re-arms on every shell, and a library force-loaded into every process. Hunt each one down, rip it out without breaking the box, and recover what they left. Defensive eradication only.
The Job That Phones Home
persistence · cron · dfir
Every Login Reopens the Door
persistence · profile.d · shell
Loaded Before Anything Else
persistence · ld-preload · guided
Every Login Reopens the Door
275 pts · decays to 110 · +50 first bloodThe attacker hooked the login path instead of running a daemon: a script in /etc/profile.d, sourced for every interactive login, reaches an external host and re-arms their access on each shell. The rest of /etc/profile.d is legitimate shell setup. Find the rogue login hook, remove it without breaking the real environment, and recover the note left beside it. Full root on an isolated box.
The live sandbox for this challenge isn't available yet — the brief is open.
Hints
Hints for this challenge unlock with Pro.Sign in or create an account.
Submit flag
Complete every objective in the lab and use Verify & grade, then submit the flag from that same box here.
Sign in to submit flags and get on the board.
Season standings
loading standings…