back to labs
Persistence: Purge the Malicious Cron
MediumPersistence Hunting15 minThe brief
Something in /etc/cron.d/ is beaconing to an external host every minute. Find the malicious drop-in and remove it entirely — and leave the legitimate jobs alone.
grep -rn . /etc/cron.d/
Grading checks the malicious drop-in is gone and the legitimate one survives.
What you'll do
- Remove the malicious cron.d drop-in
- Leave the legitimate cron drop-in intact
Hands-on lab: you work on a real Linux box in your browser, graded on the machine's actual state.