A Linux server was possibly compromised and a forensic analysis is required in order to understand what really happened. Hard disk dumps and memory snapshots of the machine are provided in order to solve the challenge.
Challenge Files:
- victoria-v8.kcore.img: memory dump done by dd’ing /proc/kcore.
- victoria-v8.memdump.img: memory dump done with memdump.
- Debian5_26.zip: volatility custom Linux profile.
Supportive Tools:
| # | Question | Weight | Solved | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1 | The attacker was performing a Brute Force attack. What account triggered the alert? | 50 | 54 | ||||||||||||
| 2 | How many were failed attempts there? | 50 | 42 | ||||||||||||
| 3 | What kind of system runs on the targeted server? | 50 | 46 | ||||||||||||
| 4 | What is the victim's IP address? | 100 | 55 | ||||||||||||
| 5 | What are the attacker's two IP addresses? (comma separated without spaces) | 100 | 54 | ||||||||||||
| 6 | What is the "nc" service PID number that was running on the server? | 150 | 52 | ||||||||||||
| 7 | What service was exploited to gain access to the system? | 150 | 50 | ||||||||||||
| 8 | What is the CVE number of exploited vulnerability? | 150 | 48 | ||||||||||||
| 9 | During this attack, the attacker downloaded two files to the server. What are they? | 100 | 45 | ||||||||||||
| 10 | What are the two port numbers involved in the process of data exfiltration? (comma separated without spaces) | 100 | 51 | ||||||||||||
| 11 | Which port did the attacker try to open on the firewall? | 100 | 35 | ||||||||||||