Persistence: Revoke the Attacker's SSH Keys

MediumPersistence Hunting15 min

The brief

The 'backup' service account trusts more SSH keys than it should: someone added their own public key(s) to /home/backup/.ssh/authorized_keys so they can log back in even after a password reset. Find the rogue keys and remove them, keeping the one legitimate key the account actually uses.

cat /home/backup/.ssh/authorized_keys

Grading checks the attacker keys are gone and the legit key remains.

What you'll do

Remove both attacker-added keys from backup's authorized_keys
Keep the legitimate backup@corp key

Hands-on lab: you work on a real Linux box in your browser, graded on the machine's actual state.