Kernel Exploit
Level: Easy
Last updated
Was this helpful?
Level: Easy
Last updated
Was this helpful?
Upon inspecting the /tmp directory, we discovered a suspicious file named exploit. Upon analyzing it using VirusTotal, it was confirmed to be a malicious executable file.
By reviewing the History section on VirusTotal, we identified the first submission date of this file.
Using the Keyword Search, I found an interesting file named lsof_-nPl.txt, which corresponds to a Linux command. Upon opening it, we can see a list of files currently opened by Linux processes.
By examining the running_processes_full_paths.txt file, we can identify the username associated with the execution of this file.
By examining the pstree_-p_-n.txt file, we can identify the PID of the exploit file and the PPID of its parent process.
By reviewing the lsb-release file, we can determine the operating system and its version. However, there seems to be a discrepancy because the release version in the uname output differs. This mismatch likely indicates that the kernel version reported by uname hasn't been updated to align with the OS version shown in lsb-release.
Another file worth checking is hostnamectl.txt. This file contains information about the operating system and the kernel version.
By reviewing the Community section on VirusTotal, we can find reports and discussions, including references to CVEs related to the vulnerabilities exploited by this file.
