Forensicshard

Injected Heron

by Pavel Knespl (capyplivl)

A Linux memory dump of a node with a small injector process. The secret is not on disk or in argv/environ; it sits in an injected RWX anonymous mapping inside the process, recoverable with Volatility 3.

Solve

Decompress the dump and stage the supplied Debian 6.1.0-42 symbol table for Volatility 3:

zstd -d -f stonehaven_hp_dump.raw.zst -o stonehaven_hp_dump.raw
gunzip -kf linux-debian-6.1.0-42.json.gz
SYMDIR=$(python3 -c "import volatility3,os;print(os.path.join(os.path.dirname(volatility3.__file__),'symbols','linux'))")
cp linux-debian-6.1.0-42.json "$SYMDIR/"

Find the injector, the only userland process:
```
vol -f stonehaven_hp_dump.raw linux.psaux
```
It reports PID 82, mal_inject (/bin/mal_inject).
List its mappings and spot the RWX anonymous page with no file backing:
```
vol -f stonehaven_hp_dump.raw linux.proc.Maps --pid 82
```
The page 0x7f1bbcb8c000-0x7f1bbcb8d000 is rwx with no file backing.

linux.malfind flags that page; its contents are plain base64. Dump and decode:

vol -f stonehaven_hp_dump.raw linux.malfind --pid 82
echo -n "U1ZJVVNDR3tzdG9uZWhhdmVuX2dsYXNzX2hlcm9uX3N0Z185ZjFhMzN9" | base64 -d

Flag: SVIUSCG{stonehaven_glass_heron_stg_9f1a33}