Horreur, malheur 4/5 - Pas si simple persistance

Description

You’ve just been hired as Chief Information Security Officer (CISO) for a strategic company.

Arriving at your office on your first day, you realize that your predecessor has left you a USB stick with a note on it: VPN compromised (integrity). Version 22.3R1 b1647.

You notice that a built-in feature of your device is no longer working, and you wonder whether the attacker has used the first persistence to install a second, less “visible” one…

You look for the characteristics of this second persistence: protocol used, port used, path to the configuration file that was modified, path to the file that was modified in order to establish the persistence.

The flag is in the format: FCSC{<protocol>:<port>:<absolute_path>:<absolute_path>}.

This challenge has been split into five parts:

• Horreur, malheur 1/5 - Archive chiffrée.
• Horreur, malheur 2/5 - Accès initial.
• Horreur, malheur 3/5 - Simple persistance.
• Horreur, malheur 4/5 - Pas si simple persistance.
• Horreur, malheur 5/5 - Un peu de CTI.