Linux Escape Room

Someone has been poking around in my (pretend) homelab and left five flags behind. Each one looks like FLAG{something}. You’re logged in as guest: find them all using real Linux commands. Everything runs in your browser and the whole box is make believe, so type whatever you like.

How to play

• Type help to see the commands, and hint whenever you’re stuck. The hints get you to each flag without giving it away.
• A flag counts as soon as it shows up in your output, and the counter in the corner keeps track.
• Pipes work, so cat /var/log/auth.log | grep Failed | wc -l does what you’d hope. Tab completes commands and file names, and the up arrow brings back what you typed.
• Your progress and best time are saved in your browser, so you can come back later.

What it teaches

Each flag is one habit I use on real servers all the time:

1. Hidden files. Anything starting with a dot doesn’t show up in a plain ls. Plenty of secrets live in dotfiles.
2. Searching logs. Nobody reads a 300 line log from the top. grep -i finds the line you care about in a second.
3. Busy processes. When a server is slow, ps aux shows what’s eating the CPU, and /proc/<pid>/cmdline shows what that process really is. A process pretending to be a kernel thread is a classic crypto miner trick.
4. Cron and base64. Scheduled jobs live in /etc/crontab. Text ending in = is usually base64, which is just encoding: anyone can decode it with base64 -d.
5. Forgotten backups. find / -name "*.bak" turns up the copies of config files people forget to delete.

If you want the commands in one place, my list of 50 commands every IT admin should know covers all of these and more. There are more games on the games page.