Clear it in 3 steps
-
Start the environment
-
Investigate the target
-
Submit the flag
All challenges
In progress
Detect Hidden Kernel Module in Memory
Mission
Compare `modules_list.txt` and `sysfs_modules.txt`, two reconstructed views of Linux kernel modules, to identify the hidden module that unlinked itself from the module list. Its sysfs-only row contains the flag.
Hints
Hint 1 Show
Diff the module names in modules_list.txt (the lsmod-style linked list) against sysfs_modules.txt (the ground truth)
Hint 2 Show
A module present in sysfs but absent from the linked list is the hidden rootkit that unlinked itself
Hint 3 Show
The flag is in the Note column of that module's sysfs row