Skip to main content

We use cookies to ensure you get the best user experience. For more information see our cookie policy.

Dead Endpoint

A photo gallery went dark. Trace the compromise on the Linux disk and recover the locked images.

Task 1: Disk Forensics Dead Endpoint

STRANGE & UNUSUAL ACTIVITY // FORENSICS

Dead Endpoint

HARD
An internal photo gallery has stopped working, and its images are unreadable. Examine the preserved Linux disk, trace the compromise, and find a way to recover the affected files.
LINUX FORENSICS MALWARE ANALYSIS DATA RECOVERY
 
+ INCIDENT BRIEF
STATUS: ACTIVE
01 // MISSION

Staff arrived to find their internal photo gallery unusable and its images unreadable. The Linux server’s disk has been preserved, but the cause is still unclear. Reconstruct how the application was compromised, analyze the executable left behind, and find a way to recover the affected images.

EVIDENCE PROVIDED
+ Linux Disk Image (.img)
02 // OBJECTIVES
01. Establish how the gallery application was compromised.
02. Identify the executable responsible for the affected images.
03. Analyze its behavior and determine how the files were encrypted.
04. Recover the images and retrieve the inspection checklist.
ANALYST NOTE
Examine the disk without modifying it and analyze the executable without running it. Correlate the application records, system logs, and recovered files to support your conclusions.
ANALYST WORKSPACE
Evidence: ~/Desktop/artifacts/
Additional tools: ~/Desktop/artifacts/tools/
Python 3’s cryptography library is installed for offline cryptographic analysis.
 
GALLERY_SERVICE_INCIDENT // CASE FILE OPEN
DEAD_ENDPOINT // FORENSICS // MALWARE_ANALYSIS

Answer the questions below

  1. Which application endpoint was abused to execute commands on the server?

  2. What was the full path of the executable responsible for encrypting the images?

  3. What is the SHA-256 hash of that executable?

  4. Which encryption algorithm and mode protected the images?

  5. What initial seed value was used to generate the encryption key?

  6. What flag appears in the recovered inspection checklist?

Room Icon

Dead Endpoint

A photo gallery went dark. Trace the compromise on the Linux disk and recover the locked images.

hard

60 min

Team room

157

User profile photo.
User profile photo.

To access material, start machines and answer questions login.

Score updated
Score updated

Set up your virtual environment

To successfully complete this room, you'll need to set up your virtual environment. This involves starting both your AttackBox (if you're not using your VPN) and Lab Machines, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.
Attacker machine
Status:Off
Lab machine
Status:Off
STRANGE & UNUSUAL ACTIVITY // FORENSICS

Dead Endpoint

HARD
An internal photo gallery has stopped working, and its images are unreadable. Examine the preserved disk, trace the compromise, and find a way to recover the affected files.
LINUX FORENSICS MALWARE ANALYSIS DATA RECOVERY
 
+ INCIDENT BRIEF
STATUS: ACTIVE
01 // MISSION

Staff arrived to find their internal photo gallery unusable and its images unreadable. The Linux server’s disk has been preserved, but the cause is still unclear. Reconstruct how the application was compromised, analyze the executable left behind, and find a way to recover the affected images.

EVIDENCE PROVIDED
+ Linux Disk Image (.img)
02 // OBJECTIVES
01. Establish how the gallery application was compromised.
02. Identify the executable responsible for the affected images.
03. Analyze its behavior and determine how the files were encrypted.
04. Recover the images and retrieve the inspection checklist.
ANALYST NOTE
Examine the disk without modifying it and analyze the executable without running it. Correlate the application records, system logs, and recovered files to support your conclusions.
ANALYST WORKSPACE
Evidence: ~/Desktop/artifacts/
Additional tools: ~/Desktop/artifacts/tools/
Python 3’s cryptography
 library is installed for offline cryptographic analysis.
 
GALLERY_SERVICE_INCIDENT // CASE FILE OPEN
DEAD_ENDPOINT // FORENSICS // MALWARE_ANALYSIS
Answer the questions below

Which application endpoint was abused to execute commands on the server?

What was the full path of the executable responsible for encrypting the images?

What is the SHA-256 hash of that executable?

Which encryption algorithm and mode protected the images?

What initial seed value was used to generate the encryption key?

What flag appears in the recovered inspection checklist?