Introduction
Welcome to ExfilNode, where the truth unravels in bits and bytes.
This time, we’re diving into the darker layers of Liam’s personal workstation — a Linux machine suspected to be the nerve center of his data exfiltration operation.
Previously, in the DiskFiltration investigation, forensic analysts found enough red flags on Liam’s company-issued Windows system to raise suspicions. But like every seasoned manipulator, Liam had an alibi ready: “It wasn’t my system.”
Cute.
So investigators shifted focus to his personal workstation, mounted at /mnt/liam_disk, with its disk image conveniently located at /home/ubuntu. Liam had full control here — full root access, full stealth capabilities, and (supposedly) full confidence that his tracks were covered. But digital forensics doesn’t forgive arrogance.
As it turns out, Liam wasn’t just dealing with TECH THM — he was also double-crossed. The investigation would reveal not just the mechanics of data theft, but the messy politics behind betrayal in the cyber underworld.
Tip: When exploring log files, you might run into binary-match errors.
Use this command to avoid them:
grep -i -a "string-pattern" /mnt/liam_disk/var/log/auth.logYou can use tools like Autopsy for analysis (optional, of course). If you do:
Navigate to /home/ubuntu/autopsy/autopsy-4.21.0/bin, execute ./autopsy --nosplash, open the GUI, and load the existing case:
Liam_Personal_Workstation.
Get Iram Jack’s stories in your inbox
Join Medium for free to get updates from this writer.
And now… let’s follow the trail of commands, timestamps, and deceit.
Section: The Analysis
When did Liam last log into the system?
(Format: YYYY-MM-DD HH:MM:SS)
grep "session opened" auth.log -a | grep gdmgdm=GNOME Display Manager: it is the normal way to log in to the system via GUI.
What was the timezone of Liam’s device?
On /mnt/liam_disk directory
cat etc/timezoneWhat is the serial number of the USB that was inserted by Liam?
On /mnt/liam_disk/var/log directory
grep -i usb ./*When was the USB connected to the system?
(Format: YYYY-MM-DD HH:MM:SS)
What command was executed when Liam ran transferfiles?
Let us check: .bashrc at home directory
What command did Liam execute to transfer the exfiltrated files to an external server?
Let us check: .bash_history at home directory
What is the IP address of the domain to which Liam transferred the files?
Which directory was the user in when they created the file mth?
Remember Henry — the external entity helping Liam during the exfiltration?
What was the amount in USD that Henry had to give Liam for this exfiltration task?
When was the USB disconnected by Liam?
(Format: YYYY-MM-DD HH:MM:SS)
There is a .hidden/ folder that Liam listed the contents of in his commands.
What is the full path of this directory?
Which files are likely timestomped in this .hidden/ directory?
(Answer in alphabetical order, ascending, separated by commas — e.g., example1.txt,example2.txt)
Liam thought the work was done, but the external entity had other plans.
Which IP address was connected via SSH to Liam’s machine a few hours after the exfiltration?
Which cronjob did the external entity set up inside Liam’s machine?
Check the cronjobs below
They say machines don’t lie. Logs don’t, either. Liam tried to hide behind his scripts and fake timestamps, but every exfiltration leaves residue. And sometimes… the ones who think they’re in control end up being the ones controlled.
— Miss Robot
