Clear it in 3 steps
Start the environment
Investigate the target
Submit the flag
All challengesIn progress
Linux-eBPF Rootkit. Unmasking a Hidden Process
Mission
This challenge safely recreates eBPF-rootkit investigation as offline evidence analysis. Without loading eBPF or touching the host kernel, inspect the supplied bpftool snapshot and map dump to recover the hidden file path.
Not started
Hints
Hint 1Show
The visible flag.txt is a decoy
Hint 2Show
Check evidence/bpftool-prog-show.txt for the suspicious program name and map ID
Hint 3Show
The hexadecimal value in evidence/bpftool-map-17.dump represents a path; xxd -r -p can recover it