SERVICES AND CRON LAB
VIRTUAL MACHINES AND TOOLS NEEDED FOR
LAB:
DCI-StudentLinux VM
Username: chiron
Password: chiron
DCI-Workstation-Bob VM
IP Address: 192.168.12.102
Username: chiron
Password: chiron
LAB
Lab Goal: Demonstrate the ability to identify
malicious services and cron jobs used for
persistent access on a Linux system.
Objective: Identify malicious services on a Linux system.
1. Login to DCI-StudentLinux VM.
2. SSH into the DCI-Workstation-Bob VM using the credentials above.
3. Elevate privileges to root using sudo.
4. Review the files in /etc/init, attempting to identify a potentially malicious service.
5. Review the services for systemd, attempting to identify if the attacker installed a
malicious service.
6. If found, identify the following information about the service:
7. Name:
8. Payload location:
7021 Columbia Gateway Dr. Suite 250, Columbia, MD 21046
www.chirontech.com | 410.672.1522 | @ChironTech
© Chiron Technology Services
Any unauthorized use or disclosure of this material is strictly prohibited
VIRTUAL MACHINES AND TOOLS NEEDED FOR
LAB:
DCI-StudentLinux VM
Username: chiron
Password: chiron
DCI-Workstation-Bob VM
IP Address: 192.168.12.102
Username: chiron
Password: chiron
LAB
Lab Goal: Demonstrate the ability to identify
malicious services and cron jobs used for
persistent access on a Linux system.
Objective: Identify malicious services on a Linux system.
1. Login to DCI-StudentLinux VM.
2. SSH into the DCI-Workstation-Bob VM using the credentials above.
3. Elevate privileges to root using sudo.
4. Review the files in /etc/init, attempting to identify a potentially malicious service.
5. Review the services for systemd, attempting to identify if the attacker installed a
malicious service.
6. If found, identify the following information about the service:
7. Name:
8. Payload location:
7021 Columbia Gateway Dr. Suite 250, Columbia, MD 21046
www.chirontech.com | 410.672.1522 | @ChironTech
© Chiron Technology Services
Any unauthorized use or disclosure of this material is strictly prohibited
