LetsDefend: Kernel Exploit — working a forensic image with find and grep

A forensic image and a privilege escalation to reconstruct. Where I look first, how to use VirusTotal properly, and the two commands that do most of the work.

Anomalous traffic from a critical transaction processing server, a suspected breach, and a forensic image to go digging in.

I do a lot of these challenges — the goal is one a day at the weekend — so this one is about building the instincts that make the next one faster.

Careful

That is genuinely most of it. Let me explain how I got to each one.

Not because a hint said to. Because of instinct built from doing these repeatedly: if I wanted to drop something on a machine, the temporary folder is exactly where I would put it. World-writable, unremarkable, cleaned up on reboot.

If you haven't used VirusTotal, it analyses files, URLs and hashes against a large set of engines.

I uploaded the file itself rather than the hash — drag it in and it analyses automatically.

Tip

The question wants a five-digit PID. So: where do process IDs live?

Careful

Tip

Same question again: which file would hold this?

Honest moment: I completely missed the kernel version the first time. It was on screen, in the file I already had open, and I skimmed straight past it because I was fixated on finding the OS. I had to go back for it.

I Google everything. I keep notes as I go, and I'm building a file of every command I use with a short explanation of what it does.

I hope this was as fun for you as it was for me!

Contents

Skills covered