CYBRARY Mission stories
The written missions
These labs are written rather than generated: a real situation, the role you are standing in, what finishing well looks like, and what it costs if you miss it. Each one also carries tips written for its own steps — coaching, never answers.
lr-20-seeded-payload-drop
Someone opened the attachment. You have twenty minutes before it spreads.
It is 07:40. A finance workstation phoned home to an address nobody recognizes minutes after a mailbox rule was created. The user is already back at their desk and insists the invoice looked normal.
You are
You are the duty analyst on the morning shift, first pair of eyes on the case.Your goal
Find the payload, prove how it got on the machine, and show where it reached out to — with the artifacts to back each claim.If you miss it
Every minute it stays resident is another chance for it to take credentials off that host and move sideways into the finance share.Written for this lab
This tasking was written by the lab's author, not generated from its tags.lr-00-first-win
One alert, one host, ten minutes — your first case, start to finish.
A login alert just fired on a host you have never seen before. Nobody is expecting a masterclass — they are expecting you to look at what is on screen, work out what happened, and write it down.
You are
You are brand new to the desk, working your very first case.Your goal
Read the alert, look at the host, and record what you found — every answer is already visible on screen.If you miss it
Nothing here can go wrong: skip a question and the coach hands you the answer. The only real risk is not trying.Written for this lab
This tasking was written by the lab's author, not generated from its tags.ran-01-first-encryption
Files are turning unreadable on a share, one folder at a time.
It is 02:10 and the on-call phone went off: a file server is renaming documents faster than anyone can open them. Nobody has pulled the plug yet — that call is yours.
You are
You are the incident lead for the night, with the backup team on standby.Your goal
Stop the spread, work out what is encrypted and what is clean, and choose the recovery point you can defend in the morning review.If you miss it
Choose the wrong restore point and you either lose a day of work or bring the thing straight back with it.Written for this lab
This tasking was written by the lab's author, not generated from its tags.lr-25-baron-samedit
The sudo on this box is three years old. Anyone with a shell on it is already root.
It is Tuesday, mid-morning, and a routine inventory came back with one Debian jump box that has not taken a package update since it was built. Nobody owns it on paper. Everybody logs into it.
You are
You are the engineer who picked up the vulnerability queue this sprint.Your goal
Pin down the installed version, tie it to the advisory, get the upgrade past whatever is blocking it, and prove the local-root path is closed.If you miss it
A jump box where any user can become root is not a patch ticket — it is every account on the estate, one shell away.Written for this lab
This tasking was written by the lab's author, not generated from its tags.lr-26-pwnkit
A twelve-year-old setuid binary on a production RHEL server hands out root for free.
The scanner flagged polkit on an application server last week and the ticket was closed as 'patching scheduled'. It was never patched — the repository it needed had been switched off during a mirror outage and nobody turned it back on.
You are
You are the on-call systems engineer, and the change window is this afternoon.Your goal
Confirm the vulnerable version, find out why the update never landed, fix the real blocker, and show the fixed version on the host.If you miss it
Close it as 'patched' without checking and the same finding comes back next quarter, with a year of exposure behind it.Written for this lab
This tasking was written by the lab's author, not generated from its tags.lr-28-log4shell
A single line in a web log is enough to run code on this server.
It is the week everything stopped. A logging library buried inside an internal application turns any string it writes into a remote code execution primitive, and nobody can tell you with confidence where that library is deployed.
You are
You are the responder holding the bridge while the estate is inventoried around you.Your goal
Find where the vulnerable library actually lives, patch it properly rather than papering over it with a flag, and evidence that the lookup no longer fires.If you miss it
Miss one copy of the library and the mitigation report is a fiction — the next scan, or the next attacker, finds it for you.Written for this lab
This tasking was written by the lab's author, not generated from its tags.lr-10-query-the-estate
Nine hundred machines, one question, and nobody can answer it from memory.
A supplier has just disclosed a breach and your director wants to know, before lunch, which of your machines ever spoke to them. The estate is too big to walk and the answer is sitting in the logs nobody has learned to ask properly.
You are
You are the analyst who has been handed the search console and told to make it talk.Your goal
Turn a vague question into searches that return an answer you can stand behind, and keep the ones worth running again.If you miss it
An estate you cannot query is an estate you cannot defend. The next disclosure will not come with a longer deadline.Written for this lab
This tasking was written by the lab's author, not generated from its tags.lr-11-unwrap-the-payload
The attachment is four layers of encoding deep, and each one hides the next.
A quarantined file came in from the mail gateway: base64 inside a script inside an archive, with a bit of obfuscation on top for good measure. Nobody wants to run it to find out what it does, and nobody has to.
You are
You are on the triage bench, working the file cold.Your goal
Peel it back one transformation at a time until the real payload is readable, and note what it intended to do.If you miss it
Sign the file off as unknown and the same campaign lands in six other mailboxes with a different filename.Written for this lab
This tasking was written by the lab's author, not generated from its tags.lr-12-triage-the-dropper
One file, one hour, and a decision: is this the thing that got in?
A dropper was pulled off an infected workstation and dumped on your bench with no context beyond the machine name. The rebuild is queued behind your answer.
You are
You are the malware triage analyst for the shift.Your goal
Establish what the file is, what it touches, and which indicators are worth pushing out to the rest of the estate.If you miss it
Miss an indicator here and every other machine carrying the same file stays infected after the rebuild.Written for this lab
This tasking was written by the lab's author, not generated from its tags.lr-13-sudo-actually
A single line in the sudoers file is the difference between a user and root.
A developer asked for 'just enough sudo to restart the service' and got rather more than that. The audit is next week and somebody needs to find out how far that grant actually reaches.
You are
You are the systems engineer reviewing local privilege on a Linux host.Your goal
Work out exactly what the account can do, demonstrate the escalation path it opens, and close it without breaking the job it was granted for.If you miss it
Every over-broad sudo rule on the estate is a local account away from being an administrator account.Written for this lab
This tasking was written by the lab's author, not generated from its tags.lr-14-dead-box-and-live-ram
The disk says nothing happened. Memory disagrees.
A machine was pulled off the network with the power still on. You have a disk image and a memory capture, and a story from the user that does not match either of them.
You are
You are the forensic examiner, working both artifacts side by side.Your goal
Reconcile what disk and memory each say, and show where the truth of the intrusion only exists in RAM.If you miss it
Pull the plug before the capture and the only copy of the evidence disappears with the power.Written for this lab
This tasking was written by the lab's author, not generated from its tags.lr-15-ask-the-internet
The indicator is real. The question is whether the internet already knows it.
You have a hash, a domain and an address, and a manager asking whether this is a targeted attack or yesterday's commodity malware. The difference changes who gets woken up.
You are
You are the analyst doing open-source enrichment before the call.Your goal
Enrich each indicator, judge how much the sources actually prove, and write a verdict that separates fact from reputation.If you miss it
Call commodity malware targeted and you burn the incident team's night. Call it the other way round and you miss the real one.Written for this lab
This tasking was written by the lab's author, not generated from its tags.lr-16-range-targets-pinata
Five hosts, no map, and whatever you can get a shell on is yours.
A practice segment has been stood up with deliberately weak services on it. Nobody will tell you which ones — that is the exercise.
You are
You are on the offensive side today, working a scoped target range.Your goal
Enumerate what is listening, find the weak service, get a foothold and evidence every step you took to get there.If you miss it
An unrecorded route in is a route the defenders cannot close. Your notes are the whole deliverable.Written for this lab
This tasking was written by the lab's author, not generated from its tags.lr-17-range-targets-pinata-win
Same exercise, Windows estate — and the shares are doing the talking.
The practice segment is Windows this time: file shares, service accounts and a domain that has grown organically for a decade. Somewhere in there is a path from nothing to something.
You are
You are working the Windows side of the target range.Your goal
Enumerate shares, accounts and services, find the misconfiguration that lets you in, and document the chain.If you miss it
The same misconfigurations are sitting in the real estate. Finding them here is cheaper than finding them later.Written for this lab
This tasking was written by the lab's author, not generated from its tags.lr-18-decrypt-the-chain
The exfiltrated file is encrypted, and the key is somewhere in the traffic you already have.
A capture shows a file leaving the network wrapped in something homemade. The attacker was sloppy: the material needed to open it went out over the same channel.
You are
You are the analyst asked to prove what was actually taken.Your goal
Work the chain of transformations backwards until you can show the contents of what left the building.If you miss it
Regulators do not accept 'something encrypted left the network'. They want to know exactly what was in it.Written for this lab
This tasking was written by the lab's author, not generated from its tags.lr-19-follow-the-packets
Forty thousand packets, one conversation that matters.
A capture was taken during the window the alert fired. It is mostly noise: backups, updates, someone streaming. Buried in it is the session that explains the incident.
You are
You are the network analyst reading the wire.Your goal
Filter down to the conversation that matters, follow it end to end, and pull out what was carried inside it.If you miss it
The packet capture is the only unarguable record you have. Whatever you cannot find in it, you cannot prove.Written for this lab
This tasking was written by the lab's author, not generated from its tags.lr-21-windows-hardening
The build is ten years of exceptions stacked on top of a default install.
A Windows workstation came back from the scanner with a page of policy findings. Each one has a reason it was left alone, and none of those reasons has been checked since it was written.
You are
You are the engineer who owns the hardening baseline.Your goal
Scan the machine, understand what each weak setting actually allows, and correct the ones that matter without breaking the user.If you miss it
A workstation this soft is where an intrusion stops being one machine and starts being the domain.Written for this lab
This tasking was written by the lab's author, not generated from its tags.lr-22-linux-hardening
The server is fine. It is also listening on ports nobody can account for.
A Linux host is due to go into production on Friday. The build came from a template that predates the current standard, and nobody has read it line by line.
You are
You are the engineer signing the host off before it goes live.Your goal
Audit services, accounts, permissions and logging, then close what should not be open and prove it afterwards.If you miss it
Whatever you leave on today is what an attacker finds in eighteen months, long after everyone has forgotten the template.Written for this lab
This tasking was written by the lab's author, not generated from its tags.lr-23-sysadmin-shift
A full shift of the unglamorous work that keeps an estate alive.
It is a normal Tuesday. Disks are filling, a service has not come back after a reboot, someone locked themselves out, and a certificate expires at the weekend.
You are
You are the systems administrator on shift, working the queue.Your goal
Clear the queue properly: find the actual cause of each job, fix it, and leave the machine in a state the next person can read.If you miss it
Every shortcut taken on a quiet Tuesday is the thing that breaks during the incident three months from now.Written for this lab
This tasking was written by the lab's author, not generated from its tags.lr-24-bofh-excuses
Every ticket has a plausible excuse attached. Exactly one of them is true.
A stack of tickets has come in with helpful explanations already written into them by whoever raised them. Most of those explanations are wrong, and one of them is hiding something worth finding.
You are
You are the administrator who has to check rather than agree.Your goal
Test each claim against the machine itself, and separate the tickets that describe reality from the ones that describe a guess.If you miss it
Accepting a confident explanation without checking it is how real problems stay open for months.Written for this lab
This tasking was written by the lab's author, not generated from its tags.lr-27-regresshion
The thing listening on port 22 of every server you own has a race condition in it.
An advisory landed overnight for the one service that is running, by policy, on every machine in the estate. The maintenance window is not until the weekend and your Ubuntu fleet is exposed until then.
You are
You are the engineer running the emergency patch assessment.Your goal
Establish the installed version, tie it to the advisory, take the update through cleanly and prove the fixed version is what is actually running.If you miss it
This is the service that accepts connections before anyone has authenticated. There is no inside of the network for this one.Written for this lab
This tasking was written by the lab's author, not generated from its tags.lr-29-fleet-patch-drill
Five machines, five distributions, one deadline.
The estate is mixed: Debian, Ubuntu, RHEL, Arch and Alpine, each with its own tooling, its own version scheme and its own way of refusing to cooperate. The same advisory affects all of them.
You are
You are running the patch drill across the whole fleet.Your goal
Patch every host using its own native tooling, work through the blockers each distribution throws, and produce one report that covers all five.If you miss it
A fleet is only as patched as its most awkward machine, and that is always the one nobody knows the commands for.Written for this lab
This tasking was written by the lab's author, not generated from its tags.lr-30-choose-your-distro
Pick your distribution, and live with every consequence of the choice.
The same job — get a service running and keep it running — waits on the other side of a boot menu. The package manager, the init system, the shell and the file layout all change depending on what you pick.
You are
You are the engineer who has to be fluent on whatever is in front of them.Your goal
Complete the same objectives on the distribution you chose, using its own tooling rather than the one you are used to.If you miss it
In a real estate you do not get to choose. Being fluent on one distribution and lost on the next is how outages get long.Written for this lab
This tasking was written by the lab's author, not generated from its tags.lr-30-pick-your-distro
Same task, five distributions — find out which commands are habit and which are knowledge.
A boot menu, five images, and one set of objectives that does not care which you chose. What works on one will fail loudly on another, and the failure is the lesson.
You are
You are the engineer comparing the families side by side.Your goal
Work the objectives on your chosen image, then read the comparison of how the other families would have done the same thing.If you miss it
Muscle memory built on one distribution quietly becomes a gap everywhere else.Written for this lab
This tasking was written by the lab's author, not generated from its tags.
Every other lab still opens with a brief — generated from its own track, tags and objectives, so no lab starts with a bare list. 24 are written by hand.