Post cover image

October 14, 2026

Profiles (THM) Tryhackme Walkthrough

Description : No profile? No problem.

By Lawvye

3 min read

Difficulty : Medium

Note : All of the content and images are from https://tryhackme.com/

Room : https://tryhackme.com/room/profilesroom

Enjoy.

Walkthrough :

Initial Step: Creating a Custom Linux Profile

The primary challenge of this room is that the memory dump originates from a specific Linux kernel that does not have a built-in profile in Volatility. You must build the profile first.

  1. Identify the Kernel Banner: Use the linux_banner plugin (which can run without a profile) to check the target OS version:
volatility -f evidence.mem linux_banner
  1. You will see the distribution details (e.g., Ubuntu/Debian) along with the exact kernel version.
  2. Generate the Profile File (.zip):
  • Deploy or use a virtual machine (VM/Docker) running the exact same OS and kernel version as the target.
  • Install the required build tools: sudo apt install dwarfdump build-essential linux-headers-$(uname -r).
  • Navigate to the Volatility directory (volatility/tools/linux) and run make to generate the module.dwarf file.
  • Package both module.dwarf and the System.map file from /boot/ on that machine into a ZIP file:
zip Ubuntu_profile.zip module.dwarf /boot/System.map-xxxxx
  • Move this .zip file into the volatility/plugins/overlays/linux/ directory on your analysis machine.

Once the profile is placed, verify it is recognized by Volatility:

volatility --info | grep Linux

Question Solutions & Forensic Analysis

Q1: What is the exposed root password?

  • Answer: Ftrccw45PHyq
  • Analysis: Use the linux_bash plugin to view the command history typed in the terminal before the memory was dumped.
volatility -f evidence.mem --profile=Your_Profile_Name linux_bash
  • Review the output; you will find a command where the attacker or admin accidentally typed a password in plain text (e.g., executing a command with a hardcoded password parameter).

Q2: And what time was the users.db file approximately accessed?

  • Answer: 2023-11-07 03:49:45
  • Analysis: Use the linux_enumerate_files plugin to list all files interacting with the memory, then filter specifically for users.db.
volatility -f evidence.mem --profile=Your_Profile_Name linux_enumerate_files | grep "users.db"
  • The output will display the file structure, inode address, and the exact timestamp of when the file was accessed by the system.

Q3: What is the MD5 hash of the malicious file found?

  • Answer: 0511ccaad402d6d13ce801e1e9136ba2
  • Analysis:
  1. From your previous activity tracking (linux_bash or linux_enumerate_files), you will find an anomalous binary file inside a directory like /tmp or /opt.
  2. Carve this file out of the memory dump using its virtual memory address or inode via the linux_find_file plugin:
volatility -f evidence.mem --profile=Your_Profile_Name linux_find_file -i [Inode_Address] -O output_filename
  1. Once extracted to your local machine, calculate its MD5 hash:
md5sum output_filename

Q4: What is the IP address and port of the malicious actor?

  • Answer: 10.0.2.72:1337
  • Analysis: Use the linux_netstat plugin to view active or open network connections at the time of the memory capture.
volatility -f evidence.mem --profile=Your_Profile_Name linux_netstat
  • Look for suspicious outbound connections, particularly those originating from the Process ID (PID) of the malicious file identified in Q3, connecting to a common reverse shell port (like 1337).

Q5: What is the full path of the cronjob file and its inode number?

  • Answer: /var/spool/cron/crontabs/root:131127
  • Analysis: Attackers often establish persistence using cronjobs. Search for standard Linux cron configuration files using linux_enumerate_files:
volatility -f evidence.mem --profile=Your_Profile_Name linux_enumerate_files | grep -i "cron"
  • You will spot the cron file belonging to the root user along with its inode number listed in the left-hand column.

Q6: What command is found inside the cronjob file?

  • Answer: * * * * * cp /opt/.bashrc /root/.bashrc
  • Analysis: Extract the root cronjob file found in Q5 using linux_find_file:
volatility -f evidence.mem --profile=Your_Profile_Name linux_find_file -i 131127 -O cron_root
  • Read the contents of the extracted file using cat:
cat cron_root
  • Inside, you will find a hidden .bashrc manipulation command scheduled to execute every single minute.

Task 1 The Incident

The incident response team has alerted you that there was some suspicious activity on one of the Linux database servers.

A memory dump of the server was taken and provided to you for analysis. You advise the team that you are missing crucial information from the server, but it has already been taken offline. They just made your job a little harder, but not impossible.

Click on the Download Task Files button at the top of this task. You will be provided with an evidence.zip file.

Extract the zip file's contents and begin your analysis in order to answer the questions.

Note: The challenge is best done using your own environment. I recommend using Volatility 2.6.1 to handle this task and strongly advise using this article by Sean Whalen to aid you with the Volatility installation.

Answer the questions below

Q1.) What is the exposed root password?

Answer : Ftrccw45PHyq

Q2.) And what time was the users.db file approximately accessed? Format is YYYY-MM-DD HH:MM:SS

Answer : 2023–11–07 03:49:45

Q3.) What is the MD5 hash of the malicious file found?

Answer : 0511ccaad402d6d13ce801e1e9136ba2

Q4.) What is the IP address and port of the malicious actor? Format is IP:Port

Answer : 10.0.2.72:1337

Q5.) What is the full path of the cronjob file and its inode number? Format is filename:inode number

Answer : /var/spool/cron/crontabs/root:131127

Q6.) What command is found inside the cronjob file?

Answer : * * * * * cp /opt/.bashrc /root/.bashrc

None None

I hope you enjoyed reading this post as much as I enjoyed writing it. Thanks for reading my blog sir ;) Lawvye