Under Fire

Premium Machine (Locked)

🧩 PurpleTeam

Internal host — not internet-facing. Reach it from your cirt-gateway shell or the in-browser Pwnbox at active-defense-lab.default.svc.cluster.local with the analyst account. This host is under constant attack from 10.99.1.1. An attacker daemon continuously plants a webshell and a malicious cron job. You must configure fail2ban, enable ufw, block the attacker, and clean up the artifacts — in the right order. The machine auto-resets every 30 minutes.