Signal9Signal9 — home
online
back to labs

Python: Hash-Scan a Quarantine Folder

MediumDevOps30-45 min
The brief

Your IOC extractor produces blocklists of SHA-256 hashes; now put one to work. You are logged in as 'student' (no sudo). Write /home/student/hashscan.py so that python3 ~/hashscan.py --blocklist BLOCKLIST DIR hashes every file under DIR with hashlib and prints MATCH <sha256> <path relative to DIR> for each file whose hash is on the blocklist. The full spec is in ~/case/brief.txt; the short version:

- Match on content, never on the file name, and read files in chunks.

- Walk every subdirectory, but do not follow symlinks: a symlink is not a file to report, and a directory symlink can loop forever.

- The same sample saved under two names is two matches. Paths can contain spaces.

- From the blocklist use only sha256 <hash> lines, in any case; ignore comments, blank lines and other IOC types.

- A file you can't read gets a warning naming it on stderr, and the scan carries on.

- Exit 0 when nothing matched, 1 when something did, 2 on an error such as a missing folder (message on stderr, no traceback).

Self-test against ~/case/sample, then scan ~/case/quarantine with ~/case/blocklist.txt.

Grading runs your script, as you, on a different quarantine folder and blocklist that you never see. A script that prints today's matches scores nothing.

What you'll do
  • Hash file contents with hashlib, reading in chunks
  • Walk a directory tree with os.walk without following symlinks
  • Parse a blocklist robustly and match case-insensitively
  • Build a scanner with a usable contract: warnings on stderr and clamscan-style exit codes

Hands-on lab: you work on a real Linux box in your browser, graded on the machine's actual state.