All rooms Sign in
ForensicsLesson + challengeFree

The Last Login

Reconstruct the intrusion from what the attacker left behind.

A public web host fired an alert for a rogue root cron job. Work a real triage archive — auth logs, shell history, cron drop-ins, SSH keys — rebuild the intrusion timeline, and recover the token the attacker's persistence left behind.

Difficulty
Medium
Estimated time
40 min
Points
150 pts
Completions
Completed by 1 player
Authors
By Cyber Academy 4 U
Create a free account to startSign in

What you will learn

  • Reconstruct an intrusion timeline from Linux auth and system logs
  • Separate a brute-force attempt from the successful login and follow privilege escalation
  • Find and read attacker persistence (cron drop-ins, added SSH keys)
  • Decode a layered persistence payload and resist a planted decoy flag

What is inside

  1. Task 1 · The Last Login1 question

Sign in to read the tasks, start the machine and answer the questions.

The Last Login — CyberA4U Arena room | CyberA4U