Suspicious Threat Forensics Challenge
by yolocalman - Saturday August 3, 2024 at 11:07 AM
#1
Hello, can somebody help me with the challenge, i found all the broken symlinks but cant do shit with them.

Thanks in advance.  Smile
Reply
#2
(Aug 03, 2024, 03:16 PM)0xKrushB1tt Wrote:
(Aug 03, 2024, 11:07 AM)yolocalman Wrote: Hello, can somebody help me with the challenge, i found all the broken symlinks but cant do shit with them.

Thanks in advance.  Smile

This challenge is so easy it doesn't even need a writeup... you are a true script kiddie

Heart Heart
Reply
#3
Solution belwo.........

Hidden Content
You must register or login to view this content.


This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching | http://c66go4clkqodr7tdjfu76jztjs7w7d3fajdeypxn73v4ju3dt7g5yyyd.onion/Forum-Ban-Appeals if you feel this is incorrect.
Reply
#4
Thanks for share <3
Reply
#5
lololol i give answer, but dont get credits for unlocks ????...

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching | http://c66go4clkqodr7tdjfu76jztjs7w7d3fajdeypxn73v4ju3dt7g5yyyd.onion/Forum-Ban-Appeals if you feel this is incorrect.
Reply
#6
thanks for solution. i was trying to solve it. got stuck on a basic point
Reply
#7
any hints to start with this challange to identify the rootkit?

thanks!

OK, got it Wink If you want some hints:

the flag/toolkit is in: /var
check the file: ls /usr/lib/x86_64-linux-gnu
move the rootkit: mv /usr/lib/x86_64-linux-gnu/libc.hook.so.6 /tmp
search for the flag: find / -name "flag*"
you will find the flag here: /var/pr3l04d_/flag.txt

have fun with it Smile
Reply
#8
You need a virtual machine analyser.
That is best for.There are lots of QEMU forks for that
Reply
#9
(Sep 09, 2024, 02:28 PM)Fl0W Wrote: any hints to start with this challange to identify the rootkit?

thanks!

OK, got it Wink If you want some hints:

the flag/toolkit is in: /var
check the file:  ls /usr/lib/x86_64-linux-gnu
move the rootkit: mv /usr/lib/x86_64-linux-gnu/libc.hook.so.6 /tmp
search for the flag: find / -name "flag*"
you will find the flag here: /var/pr3l04d_/flag.txt

have fun with it Smile

Thanks for sharing the hint ! Appreciate it
Reply
#10
(Sep 11, 2024, 07:37 AM)kewlsunny Wrote:
(Sep 09, 2024, 02:28 PM)Fl0W Wrote: any hints to start with this challange to identify the rootkit?

thanks!

OK, got it Wink If you want some hints:

the flag/toolkit is in: /var
check the file:  ls /usr/lib/x86_64-linux-gnu
move the rootkit: mv /usr/lib/x86_64-linux-gnu/libc.hook.so.6 /tmp
search for the flag: find / -name "flag*"
you will find the flag here: /var/pr3l04d_/flag.txt

have fun with it Smile

Thanks for sharing the hint ! Appreciate it

Well this tactic works on some of them.
But if you want to really analyse whats going on , 
you can use Panda VM ! which is based on Qemu VM
Reply


Possibly Related Threads…
Thread Author Replies Views Last Post
  [FREE] HackTheBox Academy - CBBH CDSA CPTS All Modules Flags Techtom 34 3,124 2 hours ago
Last Post: 0xff0day
  [MEGALEAK] HackTheBox ProLabs, Fortress, Endgame - Alchemy, 250 Flags, leak htb-bot htb-bot 93 8,519 2 hours ago
Last Post: shx
  Hack the box Pro Labs, VIP, VIP+ 1 month free Method RedBlock 25 2,530 Yesterday, 02:43 PM
Last Post: cry_elite
  CBBH Write Ups hiddenhacker 25 6,591 Yesterday, 02:41 PM
Last Post: cry_elite
  [FREE] CPTS 12 FLAGS pulsebreaker 84 2,924 Yesterday, 02:33 PM
Last Post: justhelpmefly

Forum Jump:


 Users browsing this forum: 1 Guest(s)