CyberDefenders: BlueTeam CTF Challenges

Seized

SHA1SUM	a2c209bb3c221bc70f3418e079e2a22db3cebc53
Published	May 28, 2022
Authors	2phi and Nofix
Size	162 MB
Tags	Linux Memory CentOS rootkit

Instructions	Unzip the challenge (pass: cyberdefenders.org), investigate this case, and answer the provided questions. Use the latest version of Volatility, place the attached Volatility profile "Centos7.3.10.1062.zip" in the following path volatility/volatility/plugins/overlays/linux.

Your progress

0% Completed0/9 Questions

Your score

Last solve

Using Volatility, utilize your memory analysis skills to Investigate the provided Linux memory snapshots and figure out attack details.

Supportive Tools:

#	Question	Weight	Solved
#1	What is the CentOS version installed on the machine?	50	267
Hint Report an issue

#2	There is a command containing a strange message in the bash history. Will you be able to read it?	100	223
Hint Report an issue

#3	What is the PID of the suspicious process?	100	217
Hint Report an issue

#4	The attacker downloaded a backdoor to gain persistence. What is the hidden message in this backdoor?	150	192
Hint Report an issue

#5	What are the attacker's IP address and the local port on the targeted machine?	100	206
Hint Report an issue

#6	What is the first command that the attacker executed?	100	204
Hint Report an issue

#7	After changing the user password, we found that the attacker still has access. Can you find out how?	100	186
Hint Report an issue

#8	What is the name of the rootkit that the attacker used?	100	180
Hint Report an issue

#9	The rootkit uses crc65 encryption. What is the key?	100	180
Hint Report an issue