Respond and report
The intrusion is confirmed. Your machine has been staged with the attacker's leftovers: the breached account svc-backup, a UID-0 backdoor account support, and the web shell at /srv/vt-target/uploads/avatar_8842.php. Contain the attacker, eradicate every foothold, and write the incident report.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Hints
Contain first: `echo 'sshd: 203.0.113.66' | sudo tee -a /etc/hosts.deny`.
Then `sudo passwd -l svc-backup`, `sudo userdel -f support`, `sudo rm -f` the web shell, and write the report.
Solution explanation
You closed the incident out: contained the attacker by blocking 203.0.113.66, eradicated all three footholds (locked svc-backup, deleted the support backdoor and the web shell), and wrote a hand-over report with the summary, impact, IOCs and recommendations. Investigation plus decisive response plus a clear report — that is the full SOC analyst job, and the end of this course.
Show solution
cd /home/student
echo 'sshd: 203.0.113.66' | sudo tee -a /etc/hosts.deny
sudo passwd -l svc-backup
sudo userdel -f support
sudo rm -f /srv/vt-target/uploads/avatar_8842.php
printf 'INCIDENT REPORT\nSummary: attacker 203.0.113.66 brute-forced SSH and logged in as svc-backup, scanned the web app, dropped a web shell and created a UID-0 backdoor (support).\nImpact: root-level access to web01.\nIOCs: 203.0.113.66, /uploads/avatar_8842.php, sync-updates-cdn.net\nActions: blocked IP, locked svc-backup, removed support and the web shell.\nRecommendation: reset svc-backup, enforce key-only SSH, rebuild if integrity in doubt.\n' > /home/student/incident-report.txt