Capture the FlagMedium
Trace the Intruder
Lab for Reading Linux Logs: journalctl, auth.log & syslog
Scenario
Someone brute-forced their way onto this box and then used sudo. The whole story is in /var/log/auth.log: a wall of failed logins, one that finally succeeded, and the commands that followed. Search the log and find the secret the attacker echoed through sudo.
Objective
Read the auth log to find what an intruder ran with sudo after breaking in.
lab ~ trace the intrudernothing real runs
booting lab sandbox…
This sandbox is fully emulated in your browser, nothing real runs and nothing leaves your machine. Type help to see the tools available.