The Quiet Cron
MediumDigital Forensics & Incident Response20-30 minThis web server makes a brief outbound connection every few minutes, then goes quiet — and nobody admits to scheduling anything. Find the persistence the intruder planted, follow it to the note it drops, and recover the flag. You have full root on this isolated, offline box.
Record your findings under /root/case and submit the flag in the CTF panel:
1. Enumerate every scheduled task, not just your own crontab — system schedules hide under /etc/cron.d, /etc/cron.*, /etc/crontab.
2. Record the malicious drop-in's full path to /root/case/finding.txt (just the path, one line).
3. Follow it to the hidden payload, read the note it drops, and record the flag to /root/case/flag.txt.
4. Eradicate the implant: remove the cron drop-in and the hidden binary.
See /root/case/brief.txt.
- Enumerate system-wide cron persistence, not just user crontabs
- Spot a system-looking, leading-dot implant among legitimate jobs
- Follow the payload to the note and recover the flag
- Eradicate both the schedule and the binary it runs
Hands-on lab: you work on a real Linux box in your browser, graded on the machine's actual state.