PhantomRing
Author: 0xIDA
Platform: HTB Sherlock · Category: malware/forensics · Difficulty: Very Easy
Solvers
Summary
Static analysis of a Linux post-exploitation agent using io_uring (liburing) for C2 I/O to evade syscall-based EDR. Zip password hacktheblue.
Solution
7z x -phacktheblue PhantomRing.zip
sha256sum phantom_ring/agent
# 2d7b1b2178f76c26893b2a56cbf9b36700235259e76b893d53817d5b66b634a5
# C2: 192.168.56.1:4445, sleep(120) reconnect
# 11 commands; self-delete via sdestruct → unlink /proc/self/exe
Answers
| # | Answer |
|---|---|
| 1 | 2d7b1b2178f76c26893b2a56cbf9b36700235259e76b893d53817d5b66b634a5 |
| 2 | 192.168.56.1 |
| 3 | 4445 |
| 4 | 120 |
| 5 | 11 |
| 6 | io_uring |
| 7 | /var/run/utmp |
| 8 | /usr/bin |
| 9 | anon_inode:bpf-map |
| 10 | /sys/kernel/debug/tracing/tracing_on |
| 11 | /proc/self/exe |
| 12 | sdestruct |
Flag
Sherlock owned (12/12 tasks). Rank 313.