Payload-TryHackMe-Ramya Radjesh
This room simulates a real-world supply chain compromise where a production ML model was silently swapped out by a malicious third party. The investigation spans log analysis, binary reverse engineering, and artefact correlation.
- Read the deployment log at /opt/supply-chain/incident/logs/deployment.log. The replacement model came from a different organisation than the original. What is the name of that organisation? — trustworthy-ai-lab
2. How many days passed between the replacement model being deployed and the SOC alert firing? — 21
3. Decompile the production model. What Python function does the payload use to execute the shell command? — system
Get Ramya Radjesh’s stories in your inbox
Join Medium for free to get updates from this writer.
4. What shell command does the payload use to capture the host’s identity? — hostname
5. The beacon capture log shows the HTTP method used in the outbound request. What is it? — POST
6. The engineering team staged candidate_model.h5 as a replacement but have not yet deployed it. Run inspect_h5_model.py against it. What is the name of the suspicious layer it contains? — manipulate_output
7. The attacker split the campaign ID across two artefacts to avoid full exposure in any single capture. Examine beacon_capture.log and the candidate model to recover the complete flag. — See Prefix and Suffix of the Flag
