back to labs
Persistence: Clean the Shell RC Backdoor
MediumPersistence Hunting15 minThe brief
Root's shell startup runs an extra command on every interactive login: someone appended a backdoor to /root/.bashrc that phones out to a remote host when the shell starts. Surgically remove ONLY the malicious line — the legitimate content (aliases, PATH, prompt) must stay exactly as it was.
grep -n . /root/.bashrc
Grading checks the backdoor line is gone and the legit lines remain.
What you'll do
- Remove the backdoor line from /root/.bashrc
- Preserve all the legitimate .bashrc content
Hands-on lab: you work on a real Linux box in your browser, graded on the machine's actual state.
