Horreur, malheur 3/5 - Simple persistance

Description

You’ve just been hired as Chief Information Security Officer (CISO) for a strategic company.

Arriving at your office on your first day, you realize that your predecessor has left you a USB stick with a note on it: VPN compromised (integrity). Version 22.3R1 b1647.

You have successfully decrypted the archive. It seems that this archive contains another archive, which contains the result of the device integrity check script.

Using this last archive and the logs, you are now looking for traces of persistence dropped and used by the attacker.

This challenge has been split into five parts:

• Horreur, malheur 1/5 - Archive chiffrée.
• Horreur, malheur 2/5 - Accès initial.
• Horreur, malheur 3/5 - Simple persistance.
• Horreur, malheur 4/5 - Pas si simple persistance.
• Horreur, malheur 5/5 - Un peu de CTI.