Suspicious Threat

Technical Walkthrough

Writeup

Challenge

• Name: Suspicious-Threat
• Category: Forensics
• Difficulty: Easy
• Mode: remote

Summary

The target used a userland rootkit technique through /etc/ld.so.preload. The preload file injected /lib/x86_64-linux-gnu/libc.hook.so.6 into standard utilities, which explained the strange loader behavior and the misleading filesystem view. After confirming the hook and bypassing the preload layer temporarily, the hidden flag file became visible and could be read directly. The preload configuration was then restored.

Artifact Inventory

There were no provided local artifacts. The challenge surface was the remote SSH service on <TARGET>:31174.

Key remote evidence:

• analysis/remote/tty-loader-check.txt
• analysis/remote/hook-strings-python.txt
• analysis/remote/deeper-flag-search.txt
• analysis/remote/preload-restored-final.txt

Analysis

1. The loader manipulation was verified directly:

- analysis/remote/tty-loader-check.txt shows /etc/ld.so.preload contains /lib/x86_64-linux-gnu/libc.hook.so.6.

- ldd /bin/ls and ldd /usr/sbin/sshd show the hook library injected into normal binaries.

1. The hook is userland file-hiding logic:

- analysis/remote/hook-strings-python.txt includes readdir, readdir64, and fopen, which is consistent with hiding paths from standard tools.

1. The trusted-view search revealed the real path:

- analysis/remote/deeper-flag-search.txt shows /var/pr3l04d_/flag.txt once the preload layer is out of the way.

1. Post-capture cleanup restored the original state:

- analysis/remote/preload-restored-final.txt shows /etc/ld.so.preload restored to /lib/x86_64-linux-gnu/libc.hook.so.6.

Solve

The reproducible solve script is [solve.py](<local workspace>).

Usage:

cd <local workspace>
<secret redacted>='hackthebox' python3 solve/solve.py --output loot/flag-candidate.txt

What it does:

1. Connects to the challenge SSH service.
2. Temporarily moves /etc/ld.so.preload aside.
3. Reads /var/pr3l04d_/flag.txt.
4. Restores /etc/ld.so.preload before exiting.
5. Writes the candidate flag to loot/flag-candidate.txt.

Flag

Raw flag is stored in loot/flag.txt and intentionally not reproduced here.

Lessons

• When ldd shows an unexpected library from /etc/ld.so.preload, assume standard userland tools may be lying.
• Root access plus a temporary preload bypass is often cleaner than trying to out-enumerate a readdir/fopen hook.

Source-Backed Dossier

The sections below are merged from companion Markdown notes for the same case. They are rendered after sanitization so the article stays precise without publishing raw flags, credentials, or target-specific secrets.

Notes

Scope

• Challenge: Suspicious-Threat
• Category: Forensics
• Difficulty: Easy
• Mode: remote
• Remote instance: <TARGET>:31174
• Start time: 2026-06-09T07:40:25Z
• Operator: harness
• State file: challenge-state.json

Harness Status

• Current phase: see challenge-state.json
• Next allowed actions: see next-action.json
• Raw flags and sensitive material stay in loot/ only. Do not paste them here.

Artifact Inventory

Evidence Ledger

Key Findings

• /etc/ld.so.preload injects /lib/x86_64-linux-gnu/libc.hook.so.6 into normal userland binaries.
• The hook library advertises readdir, readdir64, and fopen behavior, which matches hidden filesystem entries.
• The hidden flag path is /var/pr3l04d_/flag.txt.
• A temporary preload bypass reveals the trusted filesystem view and allows direct flag capture.

RAG / Advisory Memory

RAG output is advisory only. Record evaluated retrievals with:

scripts/challenge_harness.py rag-record <workspace> --query "..." --tag MATCHED|PARTIAL|MISSING|<secret redacted>|GENERIC --validation "..."

Secrets/Flags

Raw flags and sensitive material stay in loot/ only. Use scripts/challenge_harness.py capture-flag to validate and record flag capture without printing the value.

Scenario

Our SSH server is showing strange library linking errors, and critical folders seem to be missing despite their confirmed existence. Investigate the anomalies in the library loading process and filesystem. Look for hidden manipulations that could indicate a userland rootkit.

Operator Question

Identify userland rootkit-style manipulation of SSH/library loading/filesystem visibility on the remote instance and capture the challenge flag.

Memory Summary

Metadata

• Platform: HackTheBox Challenges
• Category: Forensics
• Challenge: Suspicious-Threat
• Difficulty: Easy
• Source workspace: <local workspace>

Validated Solve Chain

Concepts only. Do not include raw flags, reusable credentials, tokens, cookies, private keys, or live secrets.

1. Verify userland loader manipulation by checking /etc/ld.so.preload and ldd on common binaries.
2. Inspect the preload library enough to confirm it is hiding filesystem entries through userland hooks such as readdir and fopen.
3. Obtain a trusted filesystem view by temporarily bypassing the preload layer.
4. Search again from that trusted view, read the hidden flag file, and restore the preload configuration immediately after capture.

Reusable Lessons

• If a challenge gives root SSH and mentions missing folders plus linker anomalies, treat /etc/ld.so.preload as the first suspect.
• A temporary preload bypass can be safer and faster than trying to reverse every hide rule in the hook.

Dead Ends

• Parallel SSH sessions were flaky near the end of the run; serial access was more reliable for final capture and restoration.

Tool Quirks

• The target lacked file, strings, readelf, and objdump, but did have python3, which was enough to extract printable strings from the hook library.
• Forced TTY output introduced prompt noise and CRLFs. Once the preload layer was absent, non-TTY SSH behaved more predictably.

Evidence Paths

• analysis/remote/tty-loader-check.txt
• analysis/remote/hook-strings-python.txt
• analysis/remote/deeper-flag-search.txt
• analysis/remote/preload-restored-final.txt

Ingestion Decision

• Proposed for LightRAG: yes
• Requires user approval before ingestion: yes

Hypothesis Board

Keep no more than 3 active hypotheses on Easy/Medium and 5 on Hard unless the user explicitly asks for breadth.

Closed Branches

Memory Summary

approval_required: true

Sanitized Memory Summary

Metadata

• Platform: HackTheBox Challenges
• Category: Forensics
• Challenge: Suspicious-Threat
• Difficulty: Easy
• Source workspace: <local workspace>

Validated Solve Chain

Concepts only. Do not include raw flags, reusable credentials, tokens, cookies, private keys, or live secrets.

1. Verify userland loader manipulation by checking /etc/ld.so.preload and ldd on common binaries.
2. Inspect the preload library enough to confirm it is hiding filesystem entries through userland hooks such as readdir and fopen.
3. Obtain a trusted filesystem view by temporarily bypassing the preload layer.
4. Search again from that trusted view, read the hidden flag file, and restore the preload configuration immediately after capture.

Reusable Lessons

• If a challenge gives root SSH and mentions missing folders plus linker anomalies, treat /etc/ld.so.preload as the first suspect.
• A temporary preload bypass can be safer and faster than trying to reverse every hide rule in the hook.

Dead Ends

• Parallel SSH sessions were flaky near the end of the run; serial access was more reliable for final capture and restoration.

Tool Quirks

• The target lacked file, strings, readelf, and objdump, but did have python3, which was enough to extract printable strings from the hook library.
• Forced TTY output introduced prompt noise and CRLFs. Once the preload layer was absent, non-TTY SSH behaved more predictably.

Evidence Paths

• analysis/remote/tty-loader-check.txt
• analysis/remote/hook-strings-python.txt
• analysis/remote/deeper-flag-search.txt
• analysis/remote/preload-restored-final.txt

Ingestion Decision

• Proposed for LightRAG: yes
• Requires user approval before ingestion: yes

Notes

Notes

Scope

• Challenge: Suspicious-Threat
• Category: Forensics
• Difficulty: Easy
• Mode: remote
• Remote instance: <TARGET>:31174
• Start time: 2026-06-09T07:40:25Z
• Operator: harness
• State file: challenge-state.json

Harness Status

• Current phase: see challenge-state.json
• Next allowed actions: see next-action.json
• Raw flags and sensitive material stay in loot/ only. Do not paste them here.

Artifact Inventory

Evidence Ledger

Key Findings

• /etc/ld.so.preload injects /lib/x86_64-linux-gnu/libc.hook.so.6 into normal userland binaries.
• The hook library advertises readdir, readdir64, and fopen behavior, which matches hidden filesystem entries.
• The hidden flag path is /var/pr3l04d_/flag.txt.
• A temporary preload bypass reveals the trusted filesystem view and allows direct flag capture.

RAG / Advisory Memory

RAG output is advisory only. Record evaluated retrievals with:

scripts/challenge_harness.py rag-record <workspace> --query "..." --tag MATCHED|PARTIAL|MISSING|<secret redacted>|GENERIC --validation "..."

Secrets/Flags

Raw flags and sensitive material stay in loot/ only. Use scripts/challenge_harness.py capture-flag to validate and record flag capture without printing the value.

Scenario

Our SSH server is showing strange library linking errors, and critical folders seem to be missing despite their confirmed existence. Investigate the anomalies in the library loading process and filesystem. Look for hidden manipulations that could indicate a userland rootkit.

Operator Question

Identify userland rootkit-style manipulation of SSH/library loading/filesystem visibility on the remote instance and capture the challenge flag.