What happened after the break-in

Privilege escalation and persistence

A login is only the beginning. Read what the account did next — sudo to root, and the tell-tale creation of a new account so they can get back in later:

grep -E 'sudo|new user' /srv/soc-data/linux/auth.log

In the terminal

student@vulntech:~$ grep -E 'sudo|new user' /srv/soc-data/linux/auth.log
Mar 10 08:05:19 web01 sudo:  svc-backup : TTY=pts/1 ; PWD=/home/svc-backup ; USER=root ; COMMAND=/bin/bash
Mar 10 08:05:19 web01 sudo: pam_unix(sudo:session): session opened for user root(uid=0) by svc-backup(uid=1500)
Mar 10 08:07:40 web01 useradd[9210]: new user: name=support, UID=0, GID=0, home=/home/support, shell=/bin/bash

A brand-new account with UID=0 is not an ordinary user — UID 0 is root. That is a classic persistence move: a second root-level account hiding in plain sight.