The upload handler that loaded a rootkit on nw-web03 Start this lab

Why this matters

This is the case where the host starts lying to you. Once /etc/ld.so.preload names an attacker library, every new process — including your `ls` and your `ps` — loads it. The lesson is to notice the hook early and to weigh host tooling accordingly.

Concepts

Objectives graded

• Work a Linux web tier with bash: access logs, asset trees, ld.so.preload, ps and ss
• Prove the webshell, the loader hook and the live outbound session
• Contain the host and the web identity under approval, then record root cause

MITRE ATT&CK coverage

An unauthenticated upload on the portal drops a PHP web shell, and the operator hijacks the dynamic linker with /etc/ld.so.preload so a rootkit library loads into every new process on the web tier.

What each rubric rule proves

• The workflow reached a terminal success state on the graded run.

  behavior · weight 20 · T1190 Exploit Public-Facing Application (Initial Access)

• A consequential action passed through a human approval gate.

  safety · weight 15 · T1190 Exploit Public-Facing Application (Initial Access)

• No non-idempotent operation was retried without an idempotency key.

  efficiency · weight 10 · T1071.001 Application Layer Protocol: Web Protocols (Command and Control)

• Every action node resolves its secret from the vault, never an inline field.

  configuration · weight 10 · T1078 Valid Accounts (Defense Evasion)

• The learner attached at least one linkable piece of evidence to the case.

  investigation · weight 10 · T1505.003 Server Software Component: Web Shell (Persistence)

• The case carries an analyst closure note explaining the outcome.

  explanation · weight 10 · T1190 Exploit Public-Facing Application (Initial Access)

• No innocent asset in the alert batch was contained, disabled or revoked.

  behavior · weight 15 · T1078 Valid Accounts (Defense Evasion)

• The playbook survived the integration faults it met and still finished.

  configuration · weight 15 · T1071.001 Application Layer Protocol: Web Protocols (Command and Control)

• Nothing was changed in the estate before evidence had been gathered.

  investigation · weight 10 · T1505.003 Server Software Component: Web Shell (Persistence)

• The analyst worked the web tier directly instead of grading the alert text.

  investigation · weight 10 · T1505.003 Server Software Component: Web Shell (Persistence)

• The preload hook was found, so the analyst knows why host tooling cannot be trusted.

  investigation · weight 10 · T1574.006 Hijack Execution Flow: Dynamic Linker Hijacking (Defense Evasion)

• The injected library was identified by full path, so it can be removed and hashed.

  investigation · weight 10 · T1574.006 Hijack Execution Flow: Dynamic Linker Hijacking (Defense Evasion)

• The upload source was proven from the access log and the live socket table.

  investigation · weight 10 · T1071.001 Application Layer Protocol: Web Protocols (Command and Control)

• The live beacon was identified by PID before anything was contained.

  behavior · weight 10 · T1071.001 Application Layer Protocol: Web Protocols (Command and Control)

• The webshell was located, so containment removes the interactive re-entry path.

  behavior · weight 10 · T1505.003 Server Software Component: Web Shell (Persistence)

• The compromised web tier host is isolated at end state.

  behavior · weight 15 · T1190 Exploit Public-Facing Application (Initial Access)

• The web identity the shell executed as is disabled pending rebuild.

  behavior · weight 10 · T1078 Valid Accounts (Defense Evasion)

• Root cause is recorded as the unpatched portal version carrying the upload advisory.

  explanation · weight 10 · T1190 Exploit Public-Facing Application (Initial Access)

• A post-incident timeline was filed: upload, shell execution, preload hook, beacon, containment.

  explanation · weight 15 · T1190 Exploit Public-Facing Application (Initial Access)

• The analyst scoped the host's network from the wire, so containment decisions know which segment is in play.

  investigation · weight 5

• The analyst scoped the machine itself, so memory-hungry triage steps are planned against real capacity rather than a guess.

  investigation · weight 3

• Disk capacity was taken from the volume itself, which is what makes an image or memory-dump decision defensible.

  investigation · weight 3

Common mistakes

• Trusting `ps` and `ls` output on a host whose loader has been hijacked, without noting the caveat.
• Filing the webshell's URL path instead of its full filesystem path.
• Removing the webshell but leaving /etc/ld.so.preload and the library in place.
• Isolating the database host, which was never compromised.

Same idea, three vendors

Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.

The same concepts in shipping products

The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.