📋 Mission Brief
A Linux web server was breached. The attacker attempted to cover their tracks but made critical mistakes. The server logs were collected before the machine was wiped. Reconstruct the full attack timeline and recover the flag the attacker deliberately left on the server.
🎯 The Challenge
Download the ZIP and extract it. You’ll find 5 log files from a compromised Linux server:
auth.log— SSH login attempts and sessionsapache_access.log— Web server access logbash_history— Commands run during the intrusionsyslog— System events.flag.txt— A file the attacker created on the server
Investigation tasks:
- What IP address conducted the attack?
- How did the attacker gain initial access? (Which account, what method?)
- What scanning tool did they use against the web application?
- What did the attacker write to
/var/www/html/.flag.txt? - Decode the content of
.flag.txtto get the real flag
Tools needed: Any text editor. A Base64 decoder (online: base64decode.org or CyberChef).
📁 Challenge File
Download the file and analyze it to find the flag:
💡 Show Hint (click to reveal)
Read bash_history carefully — it shows every command the attacker ran. Find the command that writes to .flag.txt. The file .flag.txt contains a Base64-encoded string. Decode it to reveal the flag.
🚩 Submit Your Flag
Found the flag? Enter it below. Format: PlainlySec{...}