Exfiltrated blue team ctf

How many users have a login shell?

How many users are allowed to run the sudo command on the system?

What is the 'rossatron' user password?

What is the Victim's IP address?

What service did the attacker use to gain access to the system?

What is the attacker's IP address?

What authentication attack did the attacker use to gain access o the system?

How many users the attacker was able to bruteforce their password?

When did the attack start? (DD/MM/YYYY)

What was the first user account used by the attacker during the attack?

What is the MITRE ID of the technique used by the attacker to achieve persistence?

What is the CVE number used by the attacker to escalate his Privilege?

After gaining more privilege the attacker dropped a backdoor to gain more persistence which receives commands from Gmail account. What is the email used to send commands?

The attacker downloaded a keylogger to capture users' keystrokes. What is the secret word the attacker was able to exfiltrate?