Real case: web shell on a CMS, then an added SSH key

Objective

Investigate a site where a page changed on its own: find, in the web server logs, the drop of a web shell through a CMS flaw, its use to run commands, the escalation to root, and the SSH key the attacker added to come back — then eradicate everything.

A typical public incident (vulnerable CMS, web shell, SSH backdoor), rewritten for MasterLinux. The lab's "web shell" is an inert text file, never interpreted; all artifacts are simulated.