A Simple Reverse Shell
Difficulty: easy
Topics: T1204.002 - User Execution: Malicious File
Problem statement
During an internal investigation, a security team observes an application establishing an outbound connection and shortly afterward launching a command shell
The shell appears to be started with additional execution details that are not visible from the process name alone
No binary sample is available
Analysts must approach the investigation from a behavioral perspective and research how Windows applications request the operating system to create new processes
The investigation notes that the application uses Unicode strings when interacting with the Windows API, which may help narrow down the relevant function variant
The objective is to identify where the requested execution details become visible during runtime and capture the information before the new process begins execution
OBJECTIVES: - Research User Execution: Malicious File (MITRE ATT&CK T1204.002) and understand how Windows applications initiate execution after user interaction. - Investigate how Windows transfers execution from one process to another and identify where the operating system receives the information required to launch a new program. - Develop runtime instrumentation to observe the execution flow and capture the relevant parameters involved during process creation. - Analyze the collected telemetry to reconstruct the sequence of events leading to the launched application. - Recover all hidden flags by identifying the correct runtime interaction point through your research and API instrumentation.
How to solve this challenge
Open the in-browser IDE on this page, write your solution in C or C++, and click Run. A sandboxed agent compiles your code and executes it against the target while streaming live stdout, stderr, hook traces, and verification results over a WebSocket. When your implementation succeeds, the flag is surfaced automatically.
Who is this challenge for?
Detection engineers, blue team analysts, malware researchers, security engineers, and operators who want hands-on practice with T1204.002 - User Execution: Malicious File.