Responding to an incident

What you learn

Objectives complete themselves while you work in the terminal; each one is worth experience points:

• DETECT: spot the failed attempts in the log (grep Failed) (150 XP)
• CONTAIN: find the successful login from outside (200 XP)
• CLEAN UP: list the SUID programs (find -perm -4000) (200 XP)
• DOCUMENT: decode the report with the three right facts (150 XP)

Topics: defense, incident-response, log, suid.

Commands you will use

The terminal is simulated and understands about forty Linux commands. In this lab you will mostly need these:

• cat: prints the contents of a file: the most direct way to read configurations, notes and logs.
• grep: finds the lines that contain a word, even across whole folders with -r. It is the main tool for analysing text and logs.
• cut: extracts one column from each line using a chosen separator, to isolate a specific field of a log.
• sort: sorts lines, numerically (-n) or in reverse (-r) too.
• uniq: removes repeated adjacent lines and counts them with -c: together with sort it builds rankings, such as the most insistent addresses.
• head: shows only the first lines of a file, handy for understanding a log format without reading all of it.
• tail: shows the last lines of a file, that is the most recent events in a log.
• find: searches for files by name, type or permissions across a whole folder tree; in an audit it turns up keys, forgotten copies and programs with dangerous permissions.
• ls: lists the files in a folder; with -l it shows permissions and owners, with -a hidden files too. It is the first command on any machine.
• base64: encodes and decodes Base64, the format that turns bytes into text. It protects nothing: it can be undone without a key.
• |: the vertical bar | chains commands: the output of the first becomes the input of the next, so small tools form a complete analysis.

The simulated environment

You work in a simulated Linux shell, in the home folder of the user runner: invented files and folders, no network target.

Besides the home folder there is a complete simulated system, with configuration files, logs, users and permissions to examine.

The defensive lesson

Once the lab is solved, the write-up explains what went wrong and how to protect yourself:

An incident is handled in four stages: detect (the logs show the attack), contain (who really got in, with which account: not always the loudest address), clean up (extra SUID programs, scheduled jobs, new keys and accounts: whatever lets the intruder return) and document (what happened, what was touched, what was done). The root causes are two: a weak password on a service account and a sudo rule that is too broad. Defense: keys instead of passwords, least privilege for service accounts, network segmentation (backup must not reach everywhere), periodic checks of SUID and cron, logs shipped to a separate server.

Before and after this lab

To unlock it you must have solved:

• Timeline of an incident (Blue Team / Defense, medium)
• Closing the unneeded ports (Blue Team / Defense, medium)
• Executables with the SUID bit (Privilege Escalation, medium)

It is one of the final labs: no other lab requires it.

The Blue Team / Defense path

Blue Team / Defense is the path of those who protect. You read access logs, count failed attempts to find out who is forcing a login, rebuild the timeline of an incident, compare an SSH configuration with the recommended one, shut down unnecessary services and handle incident response in four steps: detect, contain, clean up, document. The commands are the same as in the other paths, but used through the eyes of someone who must understand what happened and stop it from happening again.

All labs in the Blue Team / Defense path

Learn more with the guides

• Red team, blue team and purple team: what is the difference?
• Brute force and strong passwords: how they work and how to defend

All guides