Clear it in 3 steps
Start the environment
Investigate the target
Submit the flag
All challengesIn progress
Recover Executed Commands from Memory
Mission
Analyze the memory-string record `memdump.txt` to recover the executed command history. Decode the Base64 strings and read the flag from the arguments of the suspicious command piped into bash.
Not started
Hints
Hint 1Show
Extract long base64-looking strings from memdump.txt
Hint 2Show
The line piping a decoded blob into bash is the attacker command
Hint 3Show
The flag is near that command's arguments