The Log Never Lies
EasyDigital Forensics & Incident Response10-20 minA brute-force wave hit this host's SSH, and exactly one attempt succeeded. The attacker cleared their shell history, but the auth log remembers. Reconstruct the timeline from /var/log/auth.log and record under /root/case, then submit the flag in the CTF panel:
1. Count Failed password lines per source IP — one IP dwarfs the rest. Record that IP to the file /root/case/attacker.txt (the bare IP; the uniq -c count line for it is accepted too).
2. The first Accepted password from that IP names the account that fell. Record just the account name to /root/case/user.txt.
3. The flag is in that user's home directory. Record the flag string to /root/case/flag.txt.
See /root/case/brief.txt.
- Aggregate failed logins by source IP to find a brute-force
- Pivot on the first success from the attacking IP
- Attribute the compromised account
- Recover the flag from the victim's home
Hands-on lab: you work on a real Linux box in your browser, graded on the machine's actual state.