published priority 7 35 min. 70 XP.

Backdoor Hunt. The 10 Places to Look

The competition image arrives pre-compromised. Before the scoring engine even gets involved, you need to find and remove the planted backdoors. Ten locations cover 95% of persistence mechanisms used in past competitions.

Prerequisites

Samba Share Basics. Keep SMB Login Green SSH Hardening Without Locking Yourself Out

DCWF roles: CS-212 Cyber Defense Forensics Analyst CE-463 Host Analyst CS-531 Cyber Defense Incident Responder CS-541 Vulnerability Assessment Analyst

Objectives

Check for UID-0 accounts other than root
Audit sudoers and sudoers.d for NOPASSWD
Inspect every user's crontab + system cron directories
Find and read all authorized_keys files
List enabled systemd services and timers
Read /etc/rc.local, /etc/profile.d, all shell rcfiles
Enumerate SUID binaries and flag dangerous ones
Find processes running from /tmp, /dev/shm, /var/tmp
Watch current outbound TCP connections
Identify listening ports you don't recognize

Quick reference

Command	Purpose
awk -F: '$3==0' /etc/passwd	UID 0 accounts
for u in $(cut -d: -f1 /etc/passwd); do crontab -l -u $u; done	All user crontabs
find / -name authorized_keys 2>/dev/null	All SSH key files
systemctl list-unit-files --type=service --state=enabled	Enabled services
systemctl list-timers --all	Scheduled systemd units
find / -perm -4000 -type f -ls 2>/dev/null	All SUID binaries
ss -tnp \| grep -v 127.0.0.1	Non-loopback TCP connections
ps auxf \| awk '$11 ~ /^\\/(tmp\|dev\\/shm\|var\\/tmp)/'	Processes from temp dirs

Common pitfalls

Missing a script because you only checked user cron (not /etc/cron.d/)
Wiping authorized_keys and losing the scoring engine's key
Killing a suspicious process without identifying what started it. it respawns
Disabling a systemd service without also disabling its `.timer`
Removing a crontab entry but the same cron file exists under a different user

Skill drills

1. Command to find all SUID binaries on the system?

find / -perm -4000 -type f
2. Where do pre-scheduled systemd tasks live?

systemctl list-timers (or .timer unit files in /etc/systemd/system/)
3. What UID does root have?

0
4. What's the signature of a reverse-shell bash idiom?

/dev/tcp in the command, or bash -i with an fd redirect