Firewall: The Rule They Slipped In
MediumNetworking20-30 minSomeone with access gave themselves a way back in before things got locked down: one extra accept rule, buried in an otherwise normal-looking nftables config, dressed up with a comment that could pass for legitimate at a glance. The legitimate rules (SSH, HTTP) need to stay exactly as they are — this is about finding the one that doesn't belong and taking it out cleanly.
Record your findings under /root/case:
1. Read through /etc/nftables.conf and find the accept rule that has no business being there.
2. Record the port it opens to /root/case/finding.txt (just the number; the rule's own line is accepted too, the whole config is not).
3. Remove that rule from /etc/nftables.conf (the config file is what's graded; deleting the line or commenting it out with # both count) without touching the legitimate ones, then recover the flag they left as a receipt to /root/case/flag.txt.
See /root/case/brief.txt.
- Identify the illegitimate accept rule among the legitimate ones
- Remove it while leaving the legitimate rules intact
- Recover the flag the intruder left as a receipt
Hands-on lab: you work on a real Linux box in your browser, graded on the machine's actual state.