SUPPLY_ME

The CTF airport is asking you to participate in a threat hunting campaign.

Please check for possible traces of compromise and search all the way back to find the origin of the attack (if there was one of course ;)) Here is a copy of the disk of one of our servers, it's up to you to analyze it. In case you need it the admin credentials are norzh:norzhCTF_2k21. But we suspect that you probably won't need them.

The flag is the concatenation of the name of the service that was exploited + the payload that triggers an exploit. Flag format NORZH{:}

PS: sorry for you if you have a crappy internet connection, the file is 5GB...