CyberPsychosis

Technical Walkthrough

Writeup

Challenge

• Name: CyberPsychosis
• Category: Reversing
• Difficulty: Easy
• Mode: hybrid

Summary

The archive contains a modified Diamorphine Linux kernel rootkit. Static analysis shows it hooks directory listing syscalls and kill, hides names beginning with psychosis, and uses special signals to grant root or toggle module visibility. The remote service boots a QEMU VM with the rootkit active. The solve is to use the rootkit's own signal handlers to become root, reveal and unload the module, then read the hidden flag file under /opt/psychosis.

Artifact Inventory

• files/extracted/rev_cyberpsychosis/diamorphine.ko: x86-64 Linux kernel module, debug info present, not stripped.
• files/extracted/rev_cyberpsychosis/LICENSE.txt: Diamorphine license text.
• Remote service: <TARGET>:31455, QEMU VM console.
• Static analysis:

- analysis/diamorphine-strings.txt

- analysis/objdump-symbols.txt

- analysis/objdump-disasm.txt

• Remote validation:

- analysis/remote-solve-transcript-redacted.txt

- analysis/remote-solve-summary.json

Analysis

The module symbols identify the main behavior:

• hacked_getdents
• hacked_getdents64
• hacked_kill
• give_root
• module_hide
• module_show
• is_invisible

The string/disassembly evidence shows the hidden filename prefix is psychosis. The hacked_kill routine branches on three special signal values:

• 31 / 0x1f: toggle process invisibility.
• 64 / 0x40: call give_root.
• 46 / 0x2e: toggle module visibility.

The remote VM starts at a low-privileged shell. After running kill -64 $$, the current shell becomes UID 0. Running kill -46 $$ makes the hidden diamorphine module visible in /proc/modules. After rmmod diamorphine, normal directory listings are restored and /opt/psychosis/flag.txt is visible.

The advisory RAG query returned no useful match, so the decision was based on local module symbols/disassembly and remote validation.

Solve

Run:

python3 Reversing/CyberPsychosis/solve/solve.py

The solver:

1. Waits for the QEMU shell prompt.
2. Confirms the starting identity.
3. Runs kill -64 $$ to trigger give_root.
4. Runs kill -46 $$ to expose the module.
5. Runs rmmod diamorphine to unload the rootkit.
6. Finds and reads /opt/psychosis/flag.txt.

Outputs:

• loot/flag-candidate.txt
• loot/remote-solve-transcript.raw
• analysis/remote-solve-transcript-redacted.txt
• analysis/remote-solve-summary.json

The harness captured the final validated flag into loot/flag.txt.

Flag

Raw flag is stored in loot/flag.txt and intentionally not reproduced here.

Lessons

• Rootkit reversing should start from symbols and syscall hooks when debug info is available.
• Hidden-file prefixes may be recovered directly from hooked getdents logic.
• A rootkit's control channel can be used as the cleanest disarm path: escalate, expose the module, unload it, then inspect the filesystem normally.

Source-Backed Dossier

The sections below are merged from companion Markdown notes for the same case. They are rendered after sanitization so the article stays precise without publishing raw flags, credentials, or target-specific secrets.

Notes

Scope

• Challenge: CyberPsychosis
• Category: Reversing
• Difficulty: Easy
• Mode: hybrid
• Remote instance: <TARGET>:31455
• Start time: 2026-06-09T10:17:14Z
• Operator: harness
• State file: challenge-state.json

Harness Status

• Current phase: see challenge-state.json
• Next allowed actions: see next-action.json
• Raw flags and sensitive material stay in loot/ only. Do not paste them here.

Artifact Inventory

Evidence Ledger

Key Findings

• Archive contains diamorphine.ko, an x86-64 Linux kernel module with debug info and symbols.
• Module symbols include hacked_getdents, hacked_getdents64, hacked_kill, give_root, module_hide, module_show, and is_invisible.
• Strings/disassembly identify the hidden-name prefix as psychosis.
• hacked_kill branches on special signals:

- 31 (0x1f): toggles invisibility for a PID.

- 64 (0x40): calls give_root.

- 46 (0x2e): toggles module hide/show state.

• The rootkit hides directory entries matching the psychosis prefix via hooked getdents / getdents64.
• Remote service behaves like a QEMU VM console; initial boot transcript saved to analysis/remote-initial-probe.bin.
• Working hypothesis: gain root with the rootkit signal, reveal/unload the module to restore directory listing behavior, then read hidden psychosis* data.
• Prompt-aware solver confirmed the full chain:

- Shell starts as UID 1000.

- kill -64 $$ changes the current shell to UID 0.

- kill -46 $$ exposes the hidden diamorphine module.

- rmmod diamorphine unloads the rootkit and restores normal directory listings.

- /opt/psychosis/flag.txt becomes visible and readable.

• Raw VM transcript is stored in loot/remote-solve-transcript.raw; redacted transcript is stored in analysis/remote-solve-transcript-redacted.txt.
• Harness captured the final flag into loot/flag.txt.

RAG / Advisory Memory

RAG output is advisory only. Record evaluated retrievals with:

scripts/challenge_harness.py rag-record <workspace> --query "..." --tag MATCHED|PARTIAL|MISSING|<secret redacted>|GENERIC --validation "..."

Secrets/Flags

Raw flags and sensitive material stay in loot/ only. Use scripts/challenge_harness.py capture-flag to validate and record flag capture without printing the value.

Memory Summary

Metadata

• Platform: HackTheBox Challenges
• Category: Reversing
• Challenge: CyberPsychosis
• Difficulty: Easy
• Source workspace: <local workspace>

Validated Solve Chain

Concepts only. Do not include raw flags, reusable credentials, tokens, cookies, private keys, or live secrets.

1.

Reusable Lessons

-

Dead Ends

-

Tool Quirks

-

Evidence Paths

-

Ingestion Decision

• Proposed for LightRAG: yes/no
• Requires user approval before ingestion: yes

Hypothesis Board

Keep no more than 3 active hypotheses on Easy/Medium and 5 on Hard unless the user explicitly asks for breadth.

Closed Branches

Memory Summary

approval_required: true

Sanitized Memory Summary

Metadata

• Platform: HackTheBox Challenges
• Category: Reversing
• Challenge: CyberPsychosis
• Difficulty: Easy
• Source workspace: <local workspace>

Validated Solve Chain

Concepts only. Do not include raw flags, reusable credentials, tokens, cookies, private keys, or live secrets.

1.

Reusable Lessons

-

Dead Ends

-

Tool Quirks

-

Evidence Paths

-

Ingestion Decision

• Proposed for LightRAG: yes/no
• Requires user approval before ingestion: yes

Notes

Notes

Scope

• Challenge: CyberPsychosis
• Category: Reversing
• Difficulty: Easy
• Mode: hybrid
• Remote instance: <TARGET>:31455
• Start time: 2026-06-09T10:17:14Z
• Operator: harness
• State file: challenge-state.json

Harness Status

• Current phase: see challenge-state.json
• Next allowed actions: see next-action.json
• Raw flags and sensitive material stay in loot/ only. Do not paste them here.

Artifact Inventory

Evidence Ledger

Key Findings

• Archive contains diamorphine.ko, an x86-64 Linux kernel module with debug info and symbols.
• Module symbols include hacked_getdents, hacked_getdents64, hacked_kill, give_root, module_hide, module_show, and is_invisible.
• Strings/disassembly identify the hidden-name prefix as psychosis.
• hacked_kill branches on special signals:

- 31 (0x1f): toggles invisibility for a PID.

- 64 (0x40): calls give_root.

- 46 (0x2e): toggles module hide/show state.

• The rootkit hides directory entries matching the psychosis prefix via hooked getdents / getdents64.
• Remote service behaves like a QEMU VM console; initial boot transcript saved to analysis/remote-initial-probe.bin.
• Working hypothesis: gain root with the rootkit signal, reveal/unload the module to restore directory listing behavior, then read hidden psychosis* data.
• Prompt-aware solver confirmed the full chain:

- Shell starts as UID 1000.

- kill -64 $$ changes the current shell to UID 0.

- kill -46 $$ exposes the hidden diamorphine module.

- rmmod diamorphine unloads the rootkit and restores normal directory listings.

- /opt/psychosis/flag.txt becomes visible and readable.

• Raw VM transcript is stored in loot/remote-solve-transcript.raw; redacted transcript is stored in analysis/remote-solve-transcript-redacted.txt.
• Harness captured the final flag into loot/flag.txt.

RAG / Advisory Memory

RAG output is advisory only. Record evaluated retrievals with:

scripts/challenge_harness.py rag-record <workspace> --query "..." --tag MATCHED|PARTIAL|MISSING|<secret redacted>|GENERIC --validation "..."

Secrets/Flags

Raw flags and sensitive material stay in loot/ only. Use scripts/challenge_harness.py capture-flag to validate and record flag capture without printing the value.