005
EXH-0052000Fictional reconstruction
Kind Regards
May 2000. The subject line is ILOVEYOU. The attachment is a .vbs file. Within hours, outlook.exe is the fastest file-sharing network on Earth.
Type
Classic
Difficulty
Beginner
Era
2000s
Time
8 min
Briefing
The help desk opened fifty tickets in an hour. Users say `I only opened an email from Carol`. Attachment type and scripting engine matter more than who sent it, the From: header is lies. Walk the quarantine logs.
Your role
Mail administrator at a university in the Philippines, ground zero for the storm.
Objective
Fingerprint the attachment type, read the quarantine log, then confirm the worm summary.
Terminal environment
- user
- postmaster
- host
- gw-manila
- cwd
- /var/spool/mailgateway
- steps
- 5
Enter the terminalAbout 8 minutesSafe simulation
Safety note. This is a safe reconstruction. All systems, files, hosts, credentials, and outputs are simulated. Do not use these techniques on systems you do not own or have explicit permission to test.