• 3 Posts
  • 14 Comments
Joined 8 hours ago
cake
Cake day: February 8th, 2026

help-circle



  • First image is the second half of the tree from my /home/. contains a whopping 37 directories.

    2nd is what I believe to be the poisoned .Dll in the output of foremost’s audit.text

    3rd is the beginning of the audit.

    4th is the first half of the tree for home. Sorry for out of order.

    5th is photorec which is currently digging through the img…

    6th is the out put from my first attempt at using foremost to file carve. didn’t work because the img was mounted

    7th is my poor desktop which is now just the default kde screen the browser I’m talking to you on and the Win10.iso I burned onto my housemates laptop.




  • I didn’t own the network, that was the problem. My distro has security updates still, everything comes from repositories. I didn’t containerise everything. That was my fault. WINE had network access and filesystem access and it wasn’t in a container, and the password to the router was very short and plain text, once you have access to a machine on the network. Absolutely chilling, finding the root /run/. 128TB man. I use clamav and it identified winexpiro hidden in a .DLL called .BRM. Supposedly for Windows 6. WINE is just a compatability layer, so you can push any .DLL into it. This is why I NEED to learn commandline docker, because it’s just not fucking safe. I don’t know whose machine it got to first, but once you’re connected to a machine as admin that’s connected to a router as admin. To resolve it, I unplugged the router, shut down the wifi cards and closed all the logical ports. After my data was wiped. I took a look in cron hourly/daily/weekly/monthly and crontab. Found scripts in /tmp/ found a whole bunch .services that run at startup. Found tonnes of scripts to start privoxy. Found Keyloggers in the .services. Found user login credentials and ssh keys I’d never seen. Like Fuck me.