RatCTF
🐀🐀 0 pts earned

SOC Runbook

Premium Machine (Locked)

🧩 PurpleTeam

🖧 AD Network — PurpleTeam

🔒 CIRT Gateway 🔒 SIEM Station SOC Runbook 🔒 Vuln Code Depot 🔒 Under Fire

Internal host — not internet-facing. Reach it from your cirt-gateway shell or the in-browser Pwnbox at soar-lab.default.svc.cluster.local with the analyst account. A queue of 15 alerts from the SolarGate incident awaits triage. Some are true positives — attacker activity. Others are false positives — routine noise. Triage correctly, then write a Python detection script that auto-classifies them.

🩸 First user blood: davidkarpinski1 🩸 First root blood: davidkarpinski1
Machine may be having trouble (checked 81498m ago)
Target IP Premium required
User Flag Pending
Root Flag Pending

Community

Community Hints

Grade A · 1000 pts Grade B · 700 pts Grade C · 400 pts Grade D · 200 pts + 150 credits on accept

Short, stage-specific nudges — directional, spoiler-light, no exact commands.

Privilege Escalation

Root comes from completing the workflow suraj_pun_magar · A · 1 Jul 2026

Community

Community Walkthroughs

Grade A · 2500 pts Grade B · 1750 pts Grade C · 1000 pts Grade D · 500 pts + 300 credits on accept

🔒 Community walkthroughs are spoilers — capture the root flag on this machine to unlock them.