JaBbA's Hut

First of all - The Track 4 SANS Class Rocks! Just had to get that out of the way.

Today we got to put our new knowledge to use. The task was to find 4 flags (text files) on a specific network, then use the information in the flags to discover the 'Phrase that pays'. First 4 people to find the phrase win a little goodie.

The network wasn't connected to the internet, so we could attack to our heart's content - the only rules were 1) no DOS 2) no arp cache poisoning 3) no rootkits - no changing the OS of the servers to keep other people out (This is, after all, supposed to be a learning experience). At 9:30, we had our instructions, and we started.

9:30. Formed team of 4 people. I fired up nessus to scan network. S used null sessions to attack machines that were quickly Id'd by nessus as W2k and started enumerating users. Others started poking at Linux machines.

9:45. Discovered that IIS on machine 9 was vulnerable to directory traversal. Started exploring hard drive. found netcat on drive. Started listener, connected to shell. excellent. flag1 found and recorded.

9:55 S reported that she had broken passwords on W2K domain. She was able to connect to server 15, and discovered user in admin group. got flag2.

10:15 reading over information in flag1 and flag2 I realized where the phrase that pays was hidden, but I needed key. Used domain user information to try accessing Linux boxes. got root on server 55 via bad misconfiguration on box. flag4 on server 55 gave me the key I needed.

11:25 finally was able to compile software I needed to extract phrase that pays. Still don't have flag3, but I don't need it. I win!

I spent the rest of the day cracking root on the other boxes. Server 35, the one with flag3, was a worthy challenge, and getting flag3 required root. I figured out what to do without the info in flag3 by guessing, but I finally got root on the box at 1:30 via a kernel exploit that was NOT provided on our tools CD, I had to go to the internet room and figure out a exploit.

Very cool. I now have a spiffy new SANS hat for my efforts.