APT Capstone I: Reconstruct the Multi-Stage, Multi-Host Kill Chain

The capstone investigation. A jump host (web01) was compromised and the attacker pivoted deeper. You have the telemetry a responder would pull: SSH auth, web access, outbound connections, scheduled jobs, and pulled copies of the auth logs of the internal hosts web01 can reach. Reconstruct the whole intrusion — initial access, foothold, persistence, command-and-control, lateral movement, and exfiltration — and record six indicators.

This is a correlation problem, not a volume problem: the loudest brute-forcer never got in, and a web scanner never touched a shell. The real intruder is the entity that ties stages together — the IP present in BOTH a successful SSH login and webshell activity. From there the chain unwinds: the webshell, the persistence that re-establishes C2, the C2 host itself, the internal host the attacker actually got INTO by lateral movement (a rejected attempt elsewhere is not movement), and the destination of the one large outbound transfer (distinct from the small repeating beacon).

Record one value per plain-text file under /root/case/answers/ (create the directory): attacker_ip.txt, webshell.txt (the request path under /uploads/), persistence.txt (the malicious cron file's full path), c2_ip.txt, pivot_host.txt (its hostname) and exfil_ip.txt. See /root/case/brief.txt for what each one means. Grading re-derives every answer from the evidence, so nothing but the real value passes. All addresses are inert TEST-NET. MITRE ATT&CK: T1110, T1078, T1505.003, T1053, T1071, T1021.004, T1560, T1041.