July Season: Ghost in the Machine
Three compromised boxes, three flags buried in the aftermath. Hunt the persistence, read the logs, and recover what the intruder left behind — all on sandboxes you fully control. Defensive practice only.
Archived season — playable for practice, no leaderboard points. Official write-ups are open.
The Quiet Cron
forensics · persistence · cron
Sudo Misery Loves Company
forensics · privesc · sudo
The Log Never Lies
forensics · log-analysis · ssh
The Quiet Cron
250 pts · decays to 100 · +50 first bloodThis web server makes a brief outbound connection every few minutes, then goes quiet — and nobody admits to scheduling anything. Find the persistence the intruder planted, follow it to the note it drops, and recover the flag. You have full root on this isolated, offline box.
The live sandbox for this challenge isn't available yet — brief and hints are open.
Hints
Persistence isn't always in a user's crontab. System-wide schedules live under /etc/cron.d, /etc/cron.*, and /etc/crontab.
Submit flag
Sign in to submit flags and get on the board.
Archived — solves are for practice, not the leaderboard.
Season standings
loading standings…