Suspicious Threat Forensics Challenge
by yolocalman - Saturday August 3, 2024 at 11:07 AM
#1
Hello, can somebody help me with the challenge, i found all the broken symlinks but cant do shit with them.

Thanks in advance.  Smile
Reply
#2
(Aug 03, 2024, 03:16 PM)0xKrushB1tt Wrote:
(Aug 03, 2024, 11:07 AM)yolocalman Wrote: Hello, can somebody help me with the challenge, i found all the broken symlinks but cant do shit with them.

Thanks in advance.  Smile

This challenge is so easy it doesn't even need a writeup... you are a true script kiddie

Heart Heart
Reply
#3
Solution belwo.........

Hidden Content
You must register or login to view this content.


This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching | http://c66go4clkqodr7tdjfu76jztjs7w7d3fajdeypxn73v4ju3dt7g5yyyd.onion/Forum-Ban-Appeals if you feel this is incorrect.
Reply
#4
Thanks for share <3
Reply
#5
lololol i give answer, but dont get credits for unlocks ????...

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching | http://c66go4clkqodr7tdjfu76jztjs7w7d3fajdeypxn73v4ju3dt7g5yyyd.onion/Forum-Ban-Appeals if you feel this is incorrect.
Reply
#6
thanks for solution. i was trying to solve it. got stuck on a basic point
Reply
#7
any hints to start with this challange to identify the rootkit?

thanks!

OK, got it Wink If you want some hints:

the flag/toolkit is in: /var
check the file: ls /usr/lib/x86_64-linux-gnu
move the rootkit: mv /usr/lib/x86_64-linux-gnu/libc.hook.so.6 /tmp
search for the flag: find / -name "flag*"
you will find the flag here: /var/pr3l04d_/flag.txt

have fun with it Smile
Reply
#8
You need a virtual machine analyser.
That is best for.There are lots of QEMU forks for that
Reply
#9
(Sep 09, 2024, 02:28 PM)Fl0W Wrote: any hints to start with this challange to identify the rootkit?

thanks!

OK, got it Wink If you want some hints:

the flag/toolkit is in: /var
check the file:  ls /usr/lib/x86_64-linux-gnu
move the rootkit: mv /usr/lib/x86_64-linux-gnu/libc.hook.so.6 /tmp
search for the flag: find / -name "flag*"
you will find the flag here: /var/pr3l04d_/flag.txt

have fun with it Smile

Thanks for sharing the hint ! Appreciate it
Reply
#10
(Sep 11, 2024, 07:37 AM)kewlsunny Wrote:
(Sep 09, 2024, 02:28 PM)Fl0W Wrote: any hints to start with this challange to identify the rootkit?

thanks!

OK, got it Wink If you want some hints:

the flag/toolkit is in: /var
check the file:  ls /usr/lib/x86_64-linux-gnu
move the rootkit: mv /usr/lib/x86_64-linux-gnu/libc.hook.so.6 /tmp
search for the flag: find / -name "flag*"
you will find the flag here: /var/pr3l04d_/flag.txt

have fun with it Smile

Thanks for sharing the hint ! Appreciate it

Well this tactic works on some of them.
But if you want to really analyse whats going on , 
you can use Panda VM ! which is based on Qemu VM
Reply


Possibly Related Threads…
Thread Author Replies Views Last Post
  Hack the box Pro Labs, VIP, VIP+ 1 month free Method RedBlock 26 2,542 2 minutes ago
Last Post: d39ug
  [FREE] HackTheBox Academy - CBBH CDSA CPTS All Modules Flags Techtom 37 3,172 26 minutes ago
Last Post: xosec
  CBBH Write Ups hiddenhacker 26 6,616 52 minutes ago
Last Post: d39ug
  [FREE] HackTheBox Dante - complete writeup written by Tamarisk Tamarisk 606 94,097 1 hour ago
Last Post: Gotoschool
  [FREE] 300+ Writeups PDF HackTheBox/HTB premium retired Tamarisk 384 95,320 1 hour ago
Last Post: Gotoschool

Forum Jump:


 Users browsing this forum: 1 Guest(s)