Rootkit Cold Case

Date

Validations

470 Compromissions 16%

Note  Notation

1
2
3
4
5
5 Votes

Description

We found this Linux machine that was running in 2003. At the time, we suspected an infection but we had never managed to find the origin.
Show us your skills by analyzing the running machine. Your goal is to recover the password of the stolen user and the PID of the malicious process.
This machine is associated with the "Forensic / Cold case" challenge.

Compromission time

2 hours

Operating system

 linux

start this virtual environnement

CTF Results CTF Results for Rootkit Cold Case

Pseudo Virtual Environnement Attackers count Time start Environnement compromised in
- Rootkit Cold Case 0 2 March 2019 at 23:55 -
- Rootkit Cold Case 1 28 February 2019 at 22:19 -
- Rootkit Cold Case 1 28 February 2019 at 17:22 -
- Rootkit Cold Case 0 28 February 2019 at 17:43 -
- Rootkit Cold Case 3 27 February 2019 at 22:19 -

 177 Virtual Environnements

Results Name Validations Difficulty ↓↑  Difficulty Author Note  Notation
pas_valide Challenge SecuriTech 1% 13
pas_valide SP - Christophe 3% 3
pas_valide HackDay-Albania 11% 23
pas_valide Homeless 9% 13
pas_valide Kuya 22% 25
pas_valide Lampiao 8% 22
pas_valide Lazysysadmin 16% 56
pas_valide Node 19% 33
pas_valide Basilic 4% 19
pas_valide NullByte 26% 46
pas_valide SP - Eric 30% 40
pas_valide Gemini-Pentest-v2 12% 9
pas_valide The Ether : EvilScience 6% 10
pas_valide Typhoon-v1 33% 32
pas_valide Replay 1 16% 8
pas_valide Bash considered harmful 8% 138 sbrk
pas_valide System Disaster 7% 137 sbrk
pas_valide Shared Objects Hijacking 13% 568 das
pas_valide k8s 10% 168 sambecks
pas_valide DC-4 17% 160
pas_valide Gittysburg 3% 2
pas_valide Gemini-Pentest-v1 7% 29
pas_valide DC-7 27% 49
pas_valide Billu-b0x2 9% 123
pas_valide JIS-CTF-VulnUpload-CTF01 24% 30
pas_valide Kevgir-VM 16% 31
pas_valide lin.security_v1.0 44% 94
pas_valide Moonraker 11% 8
pas_valide OwlNest v1.0.2 10% 4
pas_valide Raven 2 13% 10
pas_valide Sambox v4 3% 104 sambecks
pas_valide Django unchained 23% 634 TiWim
pas_valide Billu-b0x 8% 34
pas_valide g0rmint 8% 11
pas_valide BlackMarket 11% 67
pas_valide Born2rootv2 34% 92
pas_valide Bee-box v1 6% 41
pas_valide Command Injection OS 19% 58
pas_valide DC-1 15% 348
pas_valide digitalworld.local - BRAVERY 11% 17
pas_valide digitalworld.local - DEVELOPMENT 9% 12
pas_valide DonkeyDocker v1 23% 17
pas_valide DC-6 30% 115
pas_valide DC-9 32% 110
pas_valide DeRPnStiNK 28% 43
pas_valide AppArmorJail1 0% 0 nivram
pas_valide Open My Vault 0% 0
pas_valide Windows - sAMAccountName spoofing 26% 206
pas_valide OpenClassrooms_SkillProgram_AD1 1% 73 Pixis, EtienneC
pas_valide CTFair 0% 0