← Back Command Hijacking Mini-CTF

Compromised Server — Full Investigation

Incident Response Exercise — Educational Lab Only
This capstone lab simulates a real-world server compromise. You are practicing legitimate incident response skills: log analysis, IOC discovery, and forensic investigation. All systems are simulated. Never apply these techniques to systems you do not own or have explicit written authorization to test.

Incident Briefing

At 06:30 UTC, automated monitoring flagged abnormal CPU spikes on prod-web-01. You have been assigned as the incident responder. Initial triage suggests the server was accessed during the overnight maintenance window. Multiple command hijacking techniques have been deployed by the attacker. Your mission: find every indicator of compromise (IOC), trace the attack timeline, and submit a complete incident report.

Entry vector: SSH credentials for the webadmin account were exposed in a Confluence page titled "Q1 Maintenance Runbook" and harvested prior to the attack window.

T1574 — Hijack Execution Flow T1547 — Boot/Logon Autostart T1053 — Scheduled Task/Job T1056 — Input Capture

Known Attack Window

02:15:44 UTC
SSH login from external IP
02:18:02 UTC
Attacker gained sudo access (credential theft)
02:21:17 UTC
Malicious binaries and scripts deployed
02:35:09 UTC
Persistence mechanisms installed
03:47:58 UTC
Last attacker activity logged
MITRE ATT&CK — Multi-Technique
T1574 Hijack Execution Flow  |  T1547 Boot/Logon Autostart Execution  |  T1053 Scheduled Task/Job: Cron  |  T1056 Input Capture: Credential API Hooking

Investigation Tasks

1. Find entry point
2. Discover alias hijack
3. Find credential harvester
4. Uncover ps hiding
5. Find persistence
6. Find staging area
7. Map attack timeline
8. Submit incident report
0/7
IOCs Found
Submit report when ready
Live Terminal webadmin@prod-web-01 COMPROMISED
Task 0 / 8