Cyberpsychosis

Platform: HackTheBox | Category: Reversing | Type: Challenge | Difficulty: Medium | OS: Linux | Author: D3v0o0Nu11 | Date: 2026-02-05 | Status: Solved Techniques: file_hiding_bypass, kernel_module_disassembly, lkm_rootkit_analysis, rootkit_backdoor_exploitation, syscall_hook_identification

Summary

The challenge provides a ZIP archive (password: hackthebox) with diamorphine.ko (Linux kernel module) and LICENSE.txt, as well as a remote QEMU VM instance via netcat.

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: HackTheBox | ID: 20260205_hackthebox_cyberpsychosis
• Tags: linux, rootkit, lkm, kernel_module, diamorphine, syscall_hooking
• Indicators: diamorphine.ko, .ko kernel module, hacked_kill, hacked_getdents, sys_call_table hooking
• Source: 20260205_hackthebox_cyberpsychosis.md

Foothold

Vulnerability / Misconfiguration

1. File_hiding_bypass
2. Kernel_module_disassembly
3. Lkm_rootkit_analysis
4. Rootkit_backdoor_exploitation
5. Syscall_hook_identification

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• file_hiding_bypass
• kernel_module_disassembly
• lkm_rootkit_analysis
• rootkit_backdoor_exploitation
• syscall_hook_identification
• Tags: linux, rootkit, lkm, kernel_module, diamorphine, syscall_hooking

Original Writeup

<details><summary>Click to expand original content</summary>

Description

Malicious actors have infiltrated our systems and we believe they've implanted a custom rootkit. Can you disarm the rootkit and find the hidden data?

The challenge provides a ZIP archive (password: hackthebox) with diamorphine.ko (Linux kernel module) and LICENSE.txt, as well as a remote QEMU VM instance via netcat.

Analysis

File Identification

$ file diamorphine.ko
diamorphine.ko: ELF 64-bit LSB relocatable, x86-64, version 1 (SYSV), BuildID[sha1]=..., not stripped

Linux kernel module for kernel 5.15.0-82-generic. Modified version of the open-source rootkit Diamorphine (m0nad), compiled from /dev/shm/diamorphine.c (tmpfs — anti-forensics).

Hooked System Calls

Magic Signals (Backdoor)

File Hiding Mechanism — "psychosis" Prefix

movabs r9, 0x69736f6863797370    ; "psychosi" (little-endian)
cmp    qword ptr [rbx + 0x12], r9 ; d_name[0:8] == "psychosi"?
jne    skip
cmp    byte ptr [rdi + 0x8], 0x73  ; d_name[8] == 's'?
jne    skip

Differences from Standard Diamorphine

Solution

# Connect to VM via netcat, wait ~150 sec for boot

# 1. Get root via rootkit backdoor (signal 64)
kill -64 $$

# 2. Make module visible in lsmod (signal 46)
kill -46 $$

# 3. Unload rootkit from kernel
rmmod diamorphine

# 4. Find hidden directory
find / -name "psychosis*" 2>/dev/null
# /opt/psychosis

cat /opt/psychosis/flag.txt
# HTB{REDACTED}

The directory /opt/psychosis/ was hidden by the rootkit (name starts with the magic prefix "psychosis"). After unloading the module — it became visible.

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR