HackTheBox Sherlock Reverse Engineering Scenario "PhantomRing"
PhantomRing is a Linux malware reverse-engineering Sherlock. The provided evidence is a small password-protected archive containing a single executable named agent. The goal is to inspect the binary, recover its C2 configuration, understand the supported command set, and identify the Linux interfaces and filesystem paths used by the agent for discovery, privilege escalation, EDR evasion, and self-destruction.
The archive can be extracted with the challenge password:
unzip -P hacktheblue PhantomRing.zip
cd phantom_ring
file agent
sha256sum agent
Initial triage shows that the sample is a dynamically linked 64-bit Linux PIE executable. It is not stripped, which makes the challenge much more direct because function names such as main, process_cmd, cmd_users, cmd_privesc, cmd_killbpf, and cmd_selfdestruct are still present in the symbol table:
agent: ELF 64-bit LSB pie executable, x86-64, dynamically linked,
interpreter /lib64/ld-linux-x86-64.so.2,
BuildID[sha1]=1f617f2ea259a7ec724d7bbc01627982dc2f0495,
for GNU/Linux 3.2.0, not stripped
The binary imports liburing.so.2 and contains many helper wrappers around io_uring operations. This is a major theme of the challenge: the malware performs many operations through io_uring rather than only using the most obvious libc syscall wrappers.
This is a preview of an article or content section that is not ready to be disclosed.
It starts with limited visibility...
For this lab, use static analysis tools such as strings, readelf, objdump, Ghidra, Binary Ninja, IDA, or radare2 against the Linux ELF executable. Useful techniques include hashing the binary, reviewing .rodata strings, checking dynamic imports, following main's socket setup, converting hexadecimal constants, enumerating strncmp and strcmp branches in process_cmd, and then inspecting the individual command handlers for filesystem paths and anti-monitoring behavior.