CTF exercise

Rules

• Teams will have 4 servers
  • teamX-nfs1: insecure nfs
    • golden key file will need to be placed in /root
    • /root should have drwx------ permissions
  • teamX-nfs2: secure nfs
  • teamX-kdc: kerberos kdc
  • teamX-attack: attack VM performing attacks and also hosting an insecure email server to spam
• teamX-attack needs to be its own VM or PC separate from the other servers
• teamX-nfs1, teamX-nfs2, and teamX-kdc may be any combination of VMs, PCs, or Docker containers
  • Docker containers would share the MAC address of their host but would need to run on different ports
• NFS servers need at least two users, with usernames
  • root
  • first name of one of your team members
• User passwords on NFS servers need to be a combination of words and no more than 10 characters

Scoring

• nginx server (todo: url here) will post the team names and names of their members, as well as current score for the team
• Points
  • 1 point for identifying another team's nfs server ip address and port for nfs server
  • 1 point for identifying another team's kdc server
  • 1 point for identifying another team's attack-vm (email server)
  • 5 points for determining username/password on another team's nfs server
  • 25 points for obtaining root access on another team's nfs server (do not do anything malicious that would bring the server down)
    • will need to acquire the golden key as proof
  • 5 points for spamming another team's attack VM
  • 10 points for spamming another team's attack VM via open relay server (include your team name in the email somewhere so we can score appropriately)

Knowledge to gather

• Ip addresses of servers
• Function of servers (nfs insecure, nfs secure, kdc, or attack/email)
• Usernames on servers
• Passwords on servers