Clear it in 3 steps
-
Start the environment
-
Investigate the target
-
Submit the flag
All challenges
In progress
Docker Forensics - Container Investigation
Mission
Investigate a `docker save`-style image record. The final `Config.Env` in `image_config.json` looks scrubbed, but layers are immutable. Inspect each layer's `created_by` command in `image_history.txt` and find the `DB_ADMIN_PASSWORD` value (the flag) left in plaintext in an intermediate `ARG`/`ENV`/`RUN` layer. Many decoy ENV vars (`NODE_ENV`, `APP_VERSION`, `FAKE_API_KEY`, ...) surround it.
Hints
Hint 1 Show
Config.Env in image_config.json looks scrubbed, but layers are immutable
Hint 2 Show
Inspect each layer's created_by command in image_history.txt one by one
Hint 3 Show
The DB_ADMIN_PASSWORD value left in plaintext in an intermediate ARG/ENV/RUN layer is the flag