Skip to content

CTF exercise

Jump to bottom
reubenajohnston edited this page May 14, 2020 · 24 revisions

Overview

  • Teams will host their own insecure and secure nfs, kdc, and attack servers
    • teamX-nfs1: insecure nfs
    • teamX-nfs2: secure nfs
    • teamX-kdc: kerberos kdc
    • teamX-attack: attack VM performing attacks and also hosting an insecure email server to spam
  • Teams will maintain their servers (to ensure they are operational and accessible) during the event
  • Teams will attack other student servers to obtain points
  • Instructor will maintain webpage with current team scores
  • Kibana running on selks.netsec.isi.jhu.edu server will be available to support recon

Rules

  • teamX-attack needs to be its own VM or PC separate from the other servers
  • teamX-nfs1, teamX-nfs2, and teamX-kdc may be any combination of VMs, PCs, or Docker containers
    • Docker containers would share the MAC address of their host but would need to run on different ports
  • teamX-nfs1 needs
    • nfs share with rw, insecure, and no_root_squash attributes
    • goldenkey.txt key file will need to be placed in /root (if running in a Docker container, place in that container's /root directory)
    • /root should have drwx------ permissions
  • NFS servers need at least two users, with usernames
    • root
    • lowercase, first name of one of your team members (e.g., sally)
  • User passwords on NFS servers need to be from this list: //sitatunga/nwsec/lame.txtSources
  • Do not do anything malicious that would bring servers for other teams down or make them inaccessible (e.g., dos)

Scoring

  • nginx server (live scores are available here) will post the team names and names of their members, as well as current score for the team
  • Points
    • 1 point for identifying another team's nfs server ip address and port for nfs server
      • send me the ip address as proof
    • 1 point for identifying another team's attack-vm (email server)
      • send me the ip address as proof
    • 5 points for determining username/password on another team's nfs server
      • send me the credentials and ip address as proof
    • 25 points for obtaining root access on another team's nfs server via privilege escalation
      • acquire the golden key as proof
    • 5 points for spamming another team's attack VM
      • cc me on the email as proof
    • 10 points for spamming another team's attack VM via open relay server (include your team name in the email somewhere so we can score appropriately)
      • cc me on the email as proof
    • 1 point for unique, creative versions of attacks (e.g., something funny added)
      • include details when submitting proof for the verification of items above

Knowledge to gather

  • Ip addresses of servers
  • Function of servers (nfs insecure, nfs secure, or attack/email)
  • Usernames on servers
  • Passwords on servers
  • Open relay server IP
  • Dictionary for cracking passwords (see dictionary link above)

References

Clone this wiki locally