$ cat writeup.md…
$ cat writeup.md…
avitoctf
Task: Analyze an x86-64 Linux ELF memory core after a phishing compromise and identify the eBee rootkit's captured data. Solution: Reconstruct live eBPF IDRs and maps, reverse the eBeeKeys bytecode, and decode the split keylog records.
$ cat /etc/rate-limit
Rate limit reached (20 reads/hour per IP). Showing preview only — full content returns at the next hour roll-over.
Рабочая станция под управлением Linux была скомпрометирована в результате фишинговой атаки. На подпольных форумах упоминается Linux-руткит
eBee. Проанализируйте дамп памяти.
We were given a memory image from a compromised Linux workstation. The goal was to identify the eBee implant in memory and recover the useful data it had captured.
The investigation was performed strictly on the local dump. URLs found in memory were treated only as forensic indicators and were not contacted.
The original image was preserved and analyzed through an APFS clone. Its SHA-256 was:
184464b8b14df2068e23a2e66b3fa42e2e3a1b44336b85d24aa5ded327a1ecca
file identified the 1,619,139,427-byte artifact as an x86-64 QEMU-style ELF core:
ELF 64-bit LSB core file, x86-64, version 1 (SYSV), SVR4-style
The embedded kernel banner identified Ubuntu kernel Linux 6.17.0-35-generic.
Initial searches for a plaintext flag, including ASCII, UTF-16LE, flag-shaped strings, and likely shell-history residue, found nothing. The references to a Linux rootkit also suggested an LKM or LD_PRELOAD implant, but neither model explained the surviving objects. The decisive artifacts were live eBPF programs and maps: eBee was an eBPF rootkit rather than an LKM or user-space preload hook.
The ELF core contains several copies of the kernel banner in logs and page cache. Selecting the first match produced the false value _text = 0x54a3a3c0, which is not suitably aligned and caused invalid downstream object reconstruction.
The corrected locator tested every banner occurrence and accepted a candidate only when:
_text address was 2 MiB-aligned; andpage_offset_base global contained a canonical, aligned direct-map address.The unique valid layout was:
linked banner file offset: 0x565a7878 linked banner physical: 0x565c5d20 _text physical: 0x54c00000 direct-map base: 0xffff89ec40000000
The essential validation from extract_bpf.py was:
...
$ grep --similar