back to labs
Network Block: Cut Off the C2
MediumDigital Forensics & Incident Response20-30 minThe brief
Threat intel has identified a command-and-control server this host has been talking to. Read /root/case/brief.txt for the C2 address (also in /root/case/assignment.env as C2_IP), then block ALL communication with it — both outbound (host → C2) and inbound (C2 → host) — and make the block persistent by writing it into /etc/nftables.conf so it survives a reboot. Grading reads the nftables config: it must drop traffic to and from the C2 address. A literal address, a define, or a named set holding the address all count; a commented-out rule or one that doesn't drop does not.
What you'll do
- Add a persistent rule dropping outbound traffic to the C2 (daddr)
- Add a persistent rule dropping inbound traffic from the C2 (saddr)
- Put the rules in /etc/nftables.conf so they persist
Hands-on lab: you work on a real Linux box in your browser, graded on the machine's actual state.