Clear it in 3 steps
-
Start the environment
-
Investigate the target
-
Submit the flag
All challenges
In progress
Linux-eBPF Rootkit. Unmasking a Hidden Process
Mission
This challenge safely recreates eBPF-rootkit investigation as offline evidence analysis. Without loading eBPF or touching the host kernel, inspect the supplied bpftool snapshot and map dump to recover the hidden file path.
Hints
Hint 1 Show
The visible flag.txt is a decoy
Hint 2 Show
Check evidence/bpftool-prog-show.txt for the suspicious program name and map ID
Hint 3 Show
The hexadecimal value in evidence/bpftool-map-17.dump represents a path; xxd -r -p can recover it