Controlled DFIR simulation: Web exploit → shell → root → persistence → exfil. Built to practice evidence handling, log correlation, artifact validation, and timeline reconstruction using SIFT.
A Linux web server hosting a deliberately vulnerable web application is compromised. The attacker exploits a web flaw to gain an initial foothold, escalates privileges to root via a misconfiguration, establishes persistence in two distinct ways, and exfiltrates staged “sensitive” data to an attacker host on an isolated network.
Objective: reconstruct the full attack chain with defensible evidence (logs + host artifacts), produce a coherent timeline, and document IOCs and remediation recommendations.
Status: Planned (Academic Simulation). This page will be updated as the lab is executed and findings are validated.
Correlate Apache access/error logs with auth/syslog (or journald) to prove initial access, lateral actions, and exfil.
Identify dropped files (webshell, tooling), validate persistence artifacts, and record hashes + metadata.
Demonstrate root access via a provable configuration weakness (sudoers/SUID/cron), not “magic kernel exploits.”
Build a single timeline (Plaso/log2timeline) mapping: exploit → shell → root → persistence → exfil.
Evidence types below reflect the intended dataset. Only validated artifacts will appear in the final redacted report.
Webroot uploads, suspicious binaries/scripts, permission changes, timestamps, hashes, and persistence files.
Apache access/error logs used to prove exploit traffic and subsequent attacker interactions.
SSH logins, sudo events, service changes, and transfer activity (auth.log + syslog/journald).
If collected, memory can validate processes and network connections at time of compromise (advanced).
Only tools actually used will be reflected in the final write-up.
H1: Exploit traffic + host artifacts indicate a confirmed compromise with established persistence.
Evidence needed: corroboration across web logs, auth/system logs, and persistence artifacts (authorized_keys + systemd).
H2: Some suspicious signals may be benign admin activity or expected service behavior.
Evidence needed: baseline comparison (snapshot), elimination of false positives, and consistent timeline attribution.
Confidence will be assessed after cross-validation of artifacts and timeline consistency.
Redacted report will be published after the lab is executed and findings are validated.
* This page documents simulated work in a controlled environment; no live systems are involved.