Antarctic Vault 2/2

Description

As a result of the previously reported intrusion, Antarctic Vault initiated a procedure to clean up the attacker’s tracks.

We suspect that this was not sufficient and that the attacker became angry. Indeed, we have lost access to the node. Unfortunately, we do not have a team on site (unlike the attacker) and the next boat will take about two months to reach the node. We absolutely need to get our hands on this safe.

During the previous attack, we dumped the filesystem while removing sensitive data (logs, secrets, etc.). Besides, while looking at the network traces given by our Wi-Fi access point, we noticed some unusual frames. We think that the memory image of the first part, the partial filesystem, as well as this capture will allow you to give us back the control on our equipment, all this without travelling.

We count on you!

Notes:

1. a generous anonymous benefactor has provided a profile for Volatility2. The patch applied to the profile generator is included. It has been adapted to match the Linux version in use.
2. Since Volatility2 does not work on the most recent Linux kernels, additional patches to the profile generator will have to be done.

This challenge has been split into two parts:

• Antarctic Vault 1/2.
• Antarctic Vault 2/2.