Two gigabytes out at 02:41, traced to a key

Start from a netflow alert for a 2 GB upload and work back through shell history, the auth log, and authorized_keys to the SSH key that let the uploader in.

Terminal mission
Advanced
5 objectives
0 of 5 solved

Briefing

Netflow flagged db-backup-01 sending 2 GB to an external address at 02:41. The backup job only ever talks to internal hosts.

You are on the host as root for the response. history -c clears the in-memory list, but anything already written to ~/.bash_history from an earlier session stays.

root@db-backup-01

db-backup-01 · Capstone investigations

Type help for the command list and objectives for your tasks. Everything runs in this browser.

root@db-backup-01:~$

Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.