Linux month is upon us and I must admit, it's probably my least comfortable operating system in terms of knowledge of structure and artifacts. So I tried to keep an open mind when looking at this week's question.
Challenge 5 (Nov. 2-9) Had-A-Loop Around the Block (75)
What is the original filename for block 1073741825?
Doing a little research knowing this was Ali Hadi's training images gave me a little more background on what we were looking at. The question wording gives a hint we are looking at a Hadoop server configuration that was compromised (oh look another elephant!!!). Without knowing much about block storage I decided to run a keyword search on "1073741825" to see if anything pops up.
We can see in the screenshot below from X-Ways, we get some hits in some namenode and datanode log files.
Note: This search could probably be performed using any tool (GREP), X-Ways just seemed to be the quickest for what I had available in my toolkit
Timestamped at 2017-11-08 20:46:33,602 shows some information commits to the specific block we are looking for:
2017-11-08 20:46:33,602 INFO org.apache.hadoop.hdfs.server.namenode.FSNamesystem: BLOCK* blk_1073741825_1001 is COMMITTED but not COMPLETE(numNodes= 0 < minimum = 1) in file /text/AptSource._COPYING_
The mentioned commit is to file "AptSource._COPYING_" which as a first educated guess, ended up being the correct answer. I'm looking forward to learning more about Linux and Hadoop in the coming weeks.