forensicsmedium

Mem

spbctf

Linux memory dump forensics. Attacker obfuscated THEFLAG.txt through 5-step encoding chain (od -t x4, base64, xxd -E -b, tr, GPG), then shredded originals. Solution: extract bash history from RAM to reveal commands and GPG passphrase, reverse each transformation step, handle little-endian byte order from od -t x4.

$ ls tags/ techniques/
linuxbase64little_endianbash_historymemory_forensicsxxdgpgodtrtsort
string_extractionmemory_dump_analysisbash_history_recoverygpg_symmetric_decryptionmulti_step_encoding_reversallittle_endian_byte_reversalcommand_line_forensics
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub, then upgrade to Pro.

$ssh [email protected]