Member-only story
THM - Hide and Seek
A writeup for the room “Hide and Seek” on TryHackMe
Conduct a live system analysis to uncover post-compromise activity related to persistence mechanisms.
As explained in the room description, there are multiple fragments of the flag to be found.
We have suggestions as to where each fragment is located within the system.
Time is on my side, always running like clockwork.
For the first fragment, we are searching for something that runs periodically, which, on a Linux system, are usually cron jobs.
We can identify something suspicious by examining the cron job definitions as root users.
sudo crontab -l
By decoding the Base64 string, we obtain a URL composed of a first domain in hexadecimal form.
Decoding this value will give us the first part of the flag.
