Insider Lab

After Karen began working for TAAUSAI, she began conducting unauthorized and illicit activities within the corporate environment. TAAUSAI engaged your services as a SOC analyst to investigate her workstation.

A forensic disk image of Karen’s Linux system was acquired. Analyze the evidence and answer the investigation questions.

Author: @Champlain College Digital Forensics Association

Q1: Which Linux distribution is being used on this machine?

Task: Identify the Linux distribution running on the suspect workstation.

Checking /boot reveals kernel images and bootloader configurations with the -kali1-amd64 suffix, confirming the distribution is Kali Linux:

kali

Q2: What is the MD5 hash of the Apache access.log file?

Task: Compute the MD5 hash of Apache’s access.log.

Navigating to /var/log/apache2/, access.log has a file size of 0 bytes:

Hashing an empty (0-byte) file produces the standard MD5 null hash:

d41d8cd98f00b204e9800998ecf8427e

Q3: It is suspected that a credential dumping tool was downloaded. What is the name of the downloaded file?

Task: Identify the credential dumping utility downloaded to the system.

Inspecting /root/Downloads discovers a downloaded archive: mimikatz_trunk.zip:

mimikatz_trunk.zip

Q4: A super-secret file was created. What is the absolute path to this file?

Task: Determine the absolute path of the confidential file created by the user.

Inspecting /root/.bash_history reveals command execution where the user redirected output into a file on the Desktop:

/root/Desktop/SuperSecretFile.txt

Q5: What program used the file didyouthinkwedmakeiteasy.jpg during its execution?

Task: Identify the tool executed against didyouthinkwedmakeiteasy.jpg.

Continuing down /root/.bash_history, the image was passed as an argument to binwalk:

binwalk

Q6: What is the third goal from the checklist Karen created?

Task: Read the third goal listed in Karen’s checklist.

Get Azaki’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Opening /root/Desktop/Checklist displays three goals. The third item reads:

profit

Q7: How many times was Apache run?

Task: Determine how many times the Apache web service was started.

Inspecting the Apache log directory at /var/log/apache2/, all three logs (access.log, error.log, other_vhosts_access.log) have a file size of 0 bytes, confirming the service was never executed:

0

Q8: This machine was used to launch an attack on another. Which file contains the evidence for this?

Task: Identify the image artifact evidencing the attack against another host.

In /root, the image file irZLAohL.jpeg stores a screenshot showing a Windows command prompt running an attack simulator against a target:

irZLAohL.jpeg

Q9: It is believed that Karen was taunting a fellow computer expert through a bash script within the Documents directory. Who was the expert that Karen was taunting?

Task: Identify the individual targeted in Karen’s script comments.

Reviewing firstscript_fixed inside /root/Documents reveals an echo statement:

"Heck yeah! I can write bash too Young"

Young

Q10: A user executed the su command to gain root access multiple times at 11:26. Who was the user?

Task: Identify the account that attempted privilege escalation via su at 11:26.

Checking /var/log/auth.log for authentication events at 11:26 records multiple su escalation attempts by:

postgres

Q11: Based on the bash history, what is the current working directory?

Task: Identify the final current working directory based on bash history.

In .bash_history, the last cd command switched to ../Documents/myfirsthack/, followed by commands creating bob.txt in that directory:

/root/Documents/myfirsthack/

← All Lab