Avatar upload to SSH login in seventeen minutes
An access log and an auth log with different timestamp formats. Align them to rebuild the upload, the web shell, the sudo misconfiguration it abused, and the backdoor account.
Briefing
web-03 has a new local account called backup2 that nobody created. You have the nginx access log and /var/log/auth.log.
The two logs write time differently, [21/Mar/2026:11:02:41 +0000] and Mar 21 11:02:41, but both are UTC on this host. The URL-encoded query strings in the access log are the attacker’s commands.
web-03 · Incident timelines
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.