Hackfinity Battle 2025 CTF: Sneaky Patch (TryHackMe)

Search for a command to run...

No comments yet. Be the first to comment.
Link to the challenge on TryHackMe: Modern Web Stacks Introduction During a time-boxed engagement, the first tester to identify Apache/2.4.49 in a Server: header already knows the exact CVE before the

Link to the challenge/walkthrough on TryHackMe: Broken Authentication Introduction Authentication is the process by which a web application verifies the identity of the user making a request. It typic

Link to the HealthGPT AI security CTF challenge on TryHackMe. Meet HealthGPT, a well-meaning virtual assistant used by a busy healthcare team. It helps clinicians look up procedures, draft notes, and

Link to the section of the AI Odyssey CTF on TryHackMe: Token City. It covers challenges like: ML Sec: The Loan Arranger | AI Sec + DFIR: Rogue Commit | AI Sec + Web App Sec: Sealed Substation | Agent

Link to the Privilege Escalation Challenge on TryHackMe: Linux Privilege Escalation: Automation Introduction By now, you should have an understanding of basic privilege escalation techniques and how t

In this challenge, a high-value system was suspected to be compromised by a stealthy kernel-level backdoor. Traditional security tools failed to detect the attacker’s presence, signaling the need for a manual forensic investigation. The objective was to inspect the system’s kernel modules, identify malicious artifacts, and extract hidden information that could reveal the attacker’s persistence method.
A high-value system has been compromised. Security analysts have detected suspicious activity within the kernel, but the attacker’s presence remains hidden. Traditional detection tools have failed, and the intruder has established deep persistence. Investigate a live system suspected of running a kernel-level backdoor.
ls /proc | grep -E '^[0-9]+$'
cat /proc/modules

uname -r find /lib/modules/$(uname -r) -type f -name "spatch.ko" 2>/dev/null

strings /lib/modules/6.8.0-1016-aws/kernel/drivers/misc/spatch.ko | less

used dcode.fr to decode the ASCII Code

Through systematic inspection of the /proc filesystem and loaded kernel modules, the malicious file spatch.ko was uncovered. By analyzing the module with strings, hidden ASCII-encoded data was retrieved and later decoded to reveal the attacker’s secret. This investigation highlights the importance of low-level forensic analysis when dealing with advanced threats, as attackers often bypass conventional detection by embedding themselves deep within the kernel.