2022 notes

Notes after each competition round.

Stop: Doing short meeting so we can use all 6 hours Bringing unprepared computers Image filename has mshs or just hs in the name. Middle school shouldn’t mess with images that are just named for high school.

Start: Improve attendance Bring 60-80 Review forensics questions first Communicating between team members After downloading Windows updates, you need to restart. May need to repeat several times. Team members could talk more in middle school.

Continue: High school team communicated well

What is the secret encoded message? 52756e6e696e6720557020546861742048696c6c

Decode hex to text!

What is the secret encoded message?

M3G1R86<@0RP@#0H-“E%B8G-R869U>G9E9VT@<‘EN=GIF(&=B(‘5N:7(@=‘9I M<F$@:&,@2X@57(@<FER82!F=G1A<G$@9W5V9B#B@)Q6(%1V:7(@2&,@ M4FEV»G2!N<W-V<6YI=F<@9V(@;F-C>6P@<V)E(&IB97@@;F<@9W5R(&YT M<F%P;"X@#0I*<N*F65R(‘IN>‘9A="!18F)S<F%F=7IV96=M(&QB:&4@97)F M8V)A9G9O=GEV9VP@<6AE=F%T(‘5V9B!C96)O;F=V8F$@8W)E=F)Q+B-"D9U M8FH@=79Z(&=U<B!E8F-R9BP@;F%Q('%B8>*F6<@>7)G(‘5V>B!B:&<@8G,@ <;&)H92!F=G1U9RX-"@T6F)A8G1E;GH@8FAG(0`` `

Two steps: use uudecode, then rot13!

What is the encoded message? https://pastebin.com/Nv9Xzg49

QWdlbnQgUCwgDQoNCkRvb2ZlbnNobWlydHogY2xhaW1zIHRvIGhhdmUgZ2l2ZW4gdXAgZXZpbC4gSGUgZXZlbiBzaWduZWQgdGhpcyDigJxJIEdpdmUgVXAgRXZpbOKAnSBhZmZpZGF2aXQgdG8gYXBwbHkgZm9yIHdvcmsgYXQgdGhlIGFnZW5jeS4gDQpXZeKAmXJlIG1ha2luZyBEb29mZW5zaG1pcnR6IHlvdXIgcmVzcG9uc2liaWxpdHkgZHVyaW5nIGhpcyBwcm9iYXRpb24gcGVyaW9kLiANClNob3cgaGltIHRoZSByb3BlcywgYW5kIGRvbuKAmXQgbGV0IGhpbSBvdXQgb2YgeW91ciBzaWdodC4NCg0KTW9ub2dyYW0gb3V0IQ==

Base64 decode

Image stenography.

eleven@hawkins-national-labratory:~/Desktop$ sudo apt install ruby
eleven@hawkins-national-labratory:~/Desktop$ sudo gem install zsteg
eleven@hawkins-national-labratory:~/Desktop$ zsteg Doll.png
imagedata           .. file: shared library
b1,r,lsb,xy         .. text: "I3J>?JZ "
b1,rgb,lsb,xy       .. text: "Hop is alive. He looks ford too date. Pleeze to make resarvazion, call 7-642-184-4152... Open twelve day P.E.T.T. No govt, pls. Kind regards, Enzo."

Windows 2019

“hidden secret” file with no extension

UUwEBRQAAAAIAFJnZFVhZeTRPwAAAEIAAAALAAAAbWVzc2FnZS50eHQNyNsNgCAMBdBV7gSO4g4VqjTpwxQfYXv4OsnZ44g64JFGCv44QaWE3Sq9cQX5eJr4BWPy5fkqxLGu44/Uuk1QSwECPwAUAAAACABSZ2RVYWXk0T8AAABCAAAACwAkAAAAAAAAACAAAAAAAAAAbWVzc2FnZS50eHQKACAAAAAAAAEAGABptmEPd/DYAWn9H3t38NgBspJWD3fw2AFQSwUGAAAAAAEAAQBdAAAAaAAAAAAA

Windows 2019 had task manager disabled. How would would you disable, then re-enable it?

Coach notes: Windows 10

  • Stop “CCS Client” service to poke around un-bothered
  • End Task to “SetTeam” in C:\Cyberpatriot to stop siren for not setting a team ID
  • Trash C:\Cyberpatriot to be sure stuff isn’t running

2022 Round 1 Answers?

  • Start menu was empty. On the left side of the start menu, the third icond down, there’s an icon to show the installed applications.

  • This company’s security policies require that all user accounts be password protected.

    • Open Start, Windows System, Windows Administrative Tools
    • Open Local Security Policy
    • Navigate to Account Policies, Password Policy, set Minimum password length to >0

  • Employees are required to choose secure passwords, however this policy may not be currently enforced on this computer.

    • Open Start, Windows System, Windows Administrative Tools
    • Open Local Security Policy
    • Navigate to Account Policies, Password Policy, set “Password must meet complexity requirements” to “Enabled”

  • The presence of any non-work related media files and “hacking tools” on any computers is strictly prohibited.

    • Probably prohibited apps
      • Hola VPN (bypass company network filters)
      • L0phtCrack 7 (password recovery tool)
      • Network Stumbler (wifi network sniffer)
      • Wireshark (wired network traffic sniffer)
    • Not sure if allowed
      • JDownloader (not listed in authorized apps, manager to download lots of files from the Internet)
      • Adaware Web Companion (not listed in authorized apps)
    • Apps & features options in the Windows Settings didn’t show them listed for uninstallation and search function was broken
      • Use Control Panel instead. Icon was on the desktop or can open using the Search icon from the taskbar. Click “Programs and Features” to see programs to remove.

  • Delete MP3 files from the user’s Music folder

  • Adding a new user

    • Search for Computer Management
    • Expand Local Users and Groups
    • Click Users folder
    • in the Action menu, click New User…

  • Firewall & Network protection was turned off

    • Open Control Panel, Windows Security, Enable Firewall & network protection.

  • Virus & threat protection was turned off

    • Open Control Panel, Windows Security, turn on Virus & threat protection settings

  • Open Firefox 56

    • visit about:config, Void the warranty
      • search for app.update.auto, toggle to true
      • search for app.update.enabled, toggle to true
    • for Firefox 56:
      • click hamburger menu, click the round question mark icon in bottom right, About Firefox, Check for updates or Restart to update Firefox. REPEAT AS NECESSARY.
    • for Firefox 72+:
      • click hamburger menu, Help menu, About Firefox, Restart to Update Firefox. REPEAT AS NECESSARY.
    • If prompted with Mozilla update security prompt, say Yes.

Ubuntu 20.04

  • Prevent the root user from logging in

    • Prevent remote logins by SSH
      • sudo gedit /etc/ssh/sshd_config
      • make sure there’s a line for PermitRootLogin no, save and exit
      • sudo systemctl restart ssh
    • Prevent local logins
      • This locks the account and removes the account password into the bargain. Even if the root user is physically sitting at your computer they won’t be able to log in.
      • sudo passwd root -ld

  • If administrators need to run commands as root, they are required to use the “sudo” command

    • sudo gedit /etc/sudoers to verify there are no cases of “NOPASSWD” for any of the lines

  • Management has decided that the default web browser for all users on this computer should be the latest stable version of Firefox.

    • In the applications menu, search for Default Applications. Verify Firefox is set for Web.

  • Probably unauthorized apps

    • nmap (network scanning tool, can be used for attack reconnaissance)
    • Deluge (often used to download pirated software or copyrighted videos, can have legit uses)
    • XHydra
    • To look for an installed application in the commandline,
      • apt list –installed | grep nmap
      • apt list –installed | grep deluge
      • apt list –installed | grep hydra
      • the app may be listed in RED
      • sudo apt remove nmap nmapsi4
      • sudo apt remove deluge-common deluge-gtk
      • sudo apt remove hydra hydra-gtk

  • Your company just hired a new employee. Make a new account for this employee named “esinclair”.

    • sudo useradd esinclair

  • Some users have just been placed into a new working group by management. Make a new group called “dragonfire” and add the following users to the “dragonfire” group: emunson, gareth, jeff, mwheeler, dhenderson, lsinclair, esinclair.2

    • sudo groupadd dragonfire
    • sudo usermod -a -G dragonfire emunson
    • sudo usermod -a -G dragonfire gareth
    • sudo usermod -a -G dragonfire jeff
    • sudo usermod -a -G dragonfire mwheeler
    • sudo usermod -a -G dragonfire dhenderson
    • sudo usermod -a -G dragonfire lsinclair
    • sudo usermod -a -G dragonfire esinclair
    • Verify with groups jeff

  • This company’s security policies require that all user accounts be password protected. Employees are required to choose secure passwords, however this policy may not be currently enforced on this computer.

    • sudo apt install libpam-pwquality
    • sudo gedit /etc/pam.d/common-password
    • update the line that says password requisite pam_pwquality.so retry=3
    • password requisite pam_pwquality.so retry=3 minlen=12 maxrepeat=3 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1 difok=3 reject_username

  • MP3 files found in Music folder should be deleted

Round 2 issues:

Students enabled firewall, but then something turns it back off. Maybe if they looked in the Event Viewer, they could see what is doing it?

net start Wlansvc net start dot3svc

← Cisco
How to join →