Layer Cake

intro
July 11, 2024 FCSC 2024 #forensics #docker

This is a three part challenge :

First part

docker pull anssi/fcsc2024-forensics-layer-cake-1 
docker history --no-trunc anssi/fcsc2024-forensics-layer-cake-1 | grep FCSC

Second part

We are going to look in all the files of the docker image’s layers.

docker pull anssi/fcsc2024-forensics-layer-cake-2 
for i in $(docker inspect anssi/fcsc2024-forensics-layer-cake-2 | grep /var/lib/docker | cut -d '/' -f 6) ; do grep -nir FCSC /var/lib/docker/overlay2/$i ; done 

Third part

We are going to use exactly the same strategy, I guess in at least one of the cases something else was expected, but anyway:

docker pull anssi/fcsc2024-forensics-layer-cake-3 
for i in $(docker inspect anssi/fcsc2024-forensics-layer-cake-3 | grep /var/lib/docker | cut -d '/' -f 6) ; do grep -nir FCSC /var/lib/docker/overlay2/$i ; done