Mission
Erase every trace of the full operation from auth.log, wtmp, btmp, bash_history, audit.log, lastlog, and /tmp. The box has real activity from 5 prior operators — scrub yours, leave theirs. /opt/verify-clean-exit.sh checks all categories. Fresh ephemeral per session — port 2227.
Why this matters in 2026
The final discipline of a complete operator — if the forensics sweep finds anything, the operation is burned. Per-session ephemeral container: one connection, one fresh box, one clean-up attempt.
Mitigation era: 2026-04-24 · rotation policy: levels may be refreshed as CVEs are patched out of distro defaults.
Connection Terminal
Use the password forphantom30 that you captured on the previous level, then:ssh [email protected] -p 2227SSH command copied to clipboard!
This level runs on its own ephemeral container — each SSH connect spawns a fresh box that disappears on disconnect.
Flag Submission
Log in to submit flags and track progress.
🩸
ACTIVE RECORDFirst Blood captured by