Installed Packages

Software that shouldn't be on the machine is attack surface, and on a competition image it's often the whole point: a password cracker, a network scanner, a game, a remote-access tool. The README says what the machine is for; everything else installed has to justify itself.

List what's installed

apt list --installed 2>/dev/null | wc -l
apt-mark showmanual | sort

showmanual lists packages someone chose to install, as opposed to dependencies pulled in automatically. It's a much shorter list and it's where the planted software is.

snap list
flatpak list --app 2>/dev/null

What to look for

Category	Examples	Why it goes
Attack tools	nmap, zenmap, hydra, john, hashcat, aircrack-ng, wireshark, metasploit-framework, sqlmap, nikto, netcat, ncat, socat, ophcrack, medusa	An administrator doesn't need them on a production machine, and the README won't ask for them
Games	aisleriot, gnome-mahjongg, gnome-mines, sudoku, 0ad, minetest, steam, wesnoth	Not the machine's job
Remote access	x11vnc, tightvncserver, tigervnc-*, xrdp, teamviewer, anydesk, telnetd, rsh-server	Doors that aren't in the README
Obsolete clients (CIS 2.2.1 to 2.2.6)	nis, rsh-client, talk, telnet, ldap-utils, ftp, tnftp	Clear-text or ancient protocols an attacker on the box would use
prelink (CIS 1.5.5)		Rewrites binaries and defeats address randomization
Servers the README doesn't name	apache2, nginx, vsftpd, samba, bind9, mysql-server, postgresql, postfix, dovecot, squid, nfs-kernel-server, tftpd-hpa, snmpd	Every one is a listening port
Media and torrents	transmission, deluge, qbittorrent, frostwire, vuze	File sharing the README doesn't sanction
Miners and odd tools	anything with miner, xmrig, cpuminer in the name	Malware

dpkg -l | grep -iE 'nmap|hydra|john|hashcat|aircrack|wireshark|metasploit|sqlmap|nikto|netcat|ncat|socat|ophcrack|medusa|vnc|xrdp|telnetd|rsh-server|transmission|deluge|torrent|miner|xmrig'

Remove

sudo apt purge -y john hydra nmap
sudo apt autoremove -y
sudo snap remove name
sudo flatpak uninstall -y org.example.Name

purge removes configuration files too; remove leaves them. autoremove cleans up dependencies nothing needs anymore.

If the README requires something on this list (a web server, a database), it stays and is hardened on the Server Roles pages instead.

Software outside the package manager

Not everything is installed with apt. Check the places a hand-installed binary lands:

ls -la /opt /usr/local/bin /usr/local/sbin
find /home /root /tmp /var/tmp /dev/shm -type f -perm -u+x 2>/dev/null

An executable in a home directory or /tmp that isn't a script the user wrote is on the Malware and Persistence page.

Verify

dpkg -l john hydra nmap 2>&1 | grep -E '^(ii|un|dpkg-query)'
apt-mark showmanual | wc -l

dpkg -l name prints un (unknown/not installed) or "no packages found" for a removed package; ii means still installed.

Example

apt-mark showmanual includes john, hydra, aisleriot, x11vnc, and vsftpd. README: SSH-administered web server. Purge the first four. vsftpd isn't in the README either, so it goes too. ls /opt shows /opt/teamviewer; it's not a package, so sudo systemctl disable --now teamviewerd and sudo rm -r /opt/teamviewer.

Try it

1. Install nmap and hydra on a practice image, find them with the dpkg -l grep, purge them.
2. Read apt-mark showmanual on a fresh install and save it as your allow list.

Build it

A packages.sh that prints apt-mark showmanual entries not in allowed-packages.txt, plus /opt and /usr/local/bin listings.

Next

Prohibited Files