Fall 2023
<p><strong>NOTE: Any instance of <code>&lt;T&gt;</code> represents your
team number.</strong> For example, if you're on Team 8,
<code>172.18.13.&lt;T&gt;</code> translates to
<code>172.18.13.8</code></p>
<h2 id="dns">DNS</h2>
<p>Internal and External DNS server serving as the digital phonebook for
your network. Some assembly required!</p>
<h2 id="service-requirements">Service Requirements</h2>
<ul>
<li>DNS should be available internally at
<code>192.168.&lt;T&gt;.12</code></li>
<li>DNS should be available externally at
<code>172.18.13.&lt;T&gt;</code></li>
<li>DNS Forward lookups for the following domain names point to the
corresponding IP.</li>
<li>DNS Reverse lookups for the following IP Addresses point to the
corresponding domain name</li>
</ul>
<h3 id="scoring-details">Scoring Details</h3>
<h4 id="dns">DNS</h4>
<p>Required Domains:</p>
<table>
<colgroup>
<col style="width: 43%" />
<col style="width: 13%" />
<col style="width: 43%" />
</colgroup>
<thead>
<tr class="header">
<th>DNS Address</th>
<th>IP</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr class="odd">
<td><code>ns1.team&lt;T&gt;.cnyhackathon.org</code></td>
<td><code>172.18.13.&lt;T&gt;</code></td>
<td>Public DNS Nameserver</td>
</tr>
<tr class="even">
<td><code>www.team&lt;T&gt;.cnyhackathon.org</code></td>
<td><code>172.18.13.&lt;T&gt;</code></td>
<td>Public Web Nameserver</td>
</tr>
<tr class="odd">
<td><code>shell.team&lt;T&gt;.cnyhackathon.org</code></td>
<td><code>172.18.14.&lt;T&gt;</code></td>
<td>Public SSH server</td>
</tr>
<tr class="even">
<td><code>files.team&lt;T&gt;.cnyhackathon.org</code></td>
<td><code>172.18.14.&lt;T&gt;</code></td>
<td>Public File Share</td>
</tr>
<tr class="odd">
<td><code>www.team&lt;T&gt;.net</code></td>
<td><code>192.168.&lt;T&gt;.5</code></td>
<td>Internal Alias for Web server</td>
</tr>
<tr class="even">
<td><code>db.team&lt;T&gt;.net</code></td>
<td><code>192.168.&lt;T&gt;.7</code></td>
<td>Internal Alias for MySQL server</td>
</tr>
<tr class="odd">
<td><code>ns1.team&lt;T&gt;.net</code></td>
<td><code>192.168.&lt;T&gt;.12</code></td>
<td>Internal Alias for DNS Server</td>
</tr>
</tbody>
</table>
<p><em>Note that <code>&lt;T&gt;</code> represents the team's
number</em></p>
<h5 id="dns-lookup-external">DNS Lookup (External)</h5>
<p>The above addresses containing <code>.cnyhackathon.org</code> should
be publicly available and <em>will be scored through the router</em>,
and checked for both forward and reverse lookups.</p>
<ul>
<li>Green: Domain names resolved correctly</li>
<li>Yellow: DNS Server was queried, but one or more IPs or domain names
did not resolve correctly</li>
<li>Red: Could not connect to DNS server, or all domain names were
missing</li>
</ul>
<h5 id="dns-lookup-internal">DNS Lookup (Internal)</h5>
<p>The above addresses containing <code>.team&lt;T&gt;.net</code>
<em>will be scored from inside the participant's network</em>, and
checked for both forward and reverse lookups.</p>
<ul>
<li>Green: IPs resolved correctly</li>
<li>Yellow: DNS Server was queried, but one or more IPs or domain names
did not resolve correctly</li>
<li>Red: Could not connect to DNS server, or all IPs were missing</li>
</ul>
<h2 id="web">Web</h2>
<p>A suspiciously sourced PHP Web Application with a MySQL backend
Database. The docs said the config file is found in
<code>/var/www/html</code> and the MySQL database can be recovered using
the setup file <code>betterblog.sql</code>, but not much else. It also
claimed to be “super secure” when configured correctly, whatever that
means.</p>
<h2 id="service-requirements">Service Requirements</h2>
<ul>
<li>Web Server stays up</li>
<li>MySQL connection stays available to web server</li>
<li>Web content is correct (no errors) and fully functional</li>
<li>Scoring User is able to log in and use site as expected</li>
</ul>
<h3 id="scoring-details">Scoring Details</h3>
<h3 id="www">WWW</h3>
<p><em>Note that all Web checks are scored through the router</em></p>
<ul>
<li>Web Scoring User: <code>tester</code></li>
<li>Web Scoring Password: <code>testtesttest</code></li>
</ul>
<h4 id="www-content">WWW Content</h4>
<ul>
<li>Green: Page is served and no errors (Full functionality)</li>
<li>Yellow: Page is served with errors (Limited functionality, site is
still up)</li>
<li>Red: Web Server is inaccessible</li>
</ul>
<h4 id="www-ssl">WWW SSL</h4>
<p>The Root CA cert for the ca.cnyhackathon.org server has the hash
<code>761e8fbafabceac17680a28c82a097d2</code>.</p>
<p>A valid certificate can be generated by using the following
command:</p>
<div class="sourceCode" id="cb1"><pre
class="sourceCode bash"><code class="sourceCode bash"><span id="cb1-1"><a href="#cb1-1" aria-hidden="true" tabindex="-1"></a><span class="ex">certbot</span> <span class="at">--server</span>  https://ca.cnyhackathon.org/acme/acme/directory</span></code></pre></div>
<p><em>Warning</em>: Certbot will add a random sleep delay when run
non-interactively. When automating certbot SSL renewal, use the flag
<code>--no-random-sleep-on-renew</code> to ensure the check runs within
the allotted time, as our renewal window is shorter than a standard
certificate.</p>
<p><strong>NOTE: The domain
<code>www.team&lt;T&gt;.cnyhackathon.org</code> will be resolved using
the participants DNS server!</strong></p>
<ul>
<li>Green: Page is served with a valid SSL certificate for the domain
<code>www.team&lt;T&gt;.cnyhackathon.org</code>.</li>
<li>Yellow: HTTP content is served using SSL and an invalid
certificate</li>
<li>Red: HTTP content is not served over SSL</li>
</ul>
<h2 id="mysql">Mysql</h2>
<p>Data storage server used to power the web application. An initial
backup of the MySQL database was taken and stored at
<code>/root/betterblog.sql</code>. The data is synced to the QA
department via an automated task that reads MySQL directly. The QA
Department occasionally writes data back to the database as well.</p>
<h3 id="service-requirements">Service Requirements</h3>
<ul>
<li>The MySql Scoring user is able to log into MySQL</li>
<li>The MySql Scoring user can Read data</li>
<li>The MySql Scoring user can Write data</li>
</ul>
<h3 id="scoring-details">Scoring Details</h3>
<h4 id="mysql">MySQL</h4>
<p><strong>The MySQL services are scored from the internal team network,
using the internal IP address of
<code>192.168.&lt;T&gt;.7</code>.</strong></p>
<ul>
<li>MySQL scoring user: <code>betterblog</code></li>
<li>MySQL scoring password: <code>betterblog!</code></li>
<li>MySQL Scoring user can login, read and write to the database
<code>betterblog</code></li>
<li>MySQL Scoring user can login, read and write to the table
<code>posts</code></li>
</ul>
<h3 id="recovery-instructions">Recovery Instructions</h3>
<p>MySQL Commands for restoring the database schema:</p>
<div class="sourceCode" id="cb2"><pre
class="sourceCode bash"><code class="sourceCode bash"><span id="cb2-1"><a href="#cb2-1" aria-hidden="true" tabindex="-1"></a><span class="ex">mysql</span> betterblog <span class="at">-u</span> betterblog <span class="at">-p</span> <span class="op">&lt;</span> /root/betterblog.sql</span></code></pre></div>
<h4 id="mysql-1">MySQL</h4>
<ul>
<li>Green: MySQL scoring user is able to connect, authenticate, read and
write data</li>
<li>Yellow: MySQL is accessible, but the scoring user is unable to
authenticate or read/write data</li>
<li>Red: MySql is inaccessible</li>
</ul>
<h2 id="ssh-ftp">SSH &amp; FTP</h2>
<p>Established Shell Server and File Share for staff and external
associates, and must be kept online at all costs.</p>
<h3 id="service-requirements">Service Requirements</h3>
<ul>
<li>Scoring Users are able to successfully SSH using Public Key
Authentication.</li>
</ul>
<h3 id="scoring-details">Scoring Details</h3>
<h4 id="ssh">SSH</h4>
<ul>
<li>SSH Scoring Users:
<ul>
<li><code>night_in_the_woods</code></li>
<li><code>starship_troopers_terran_command</code></li>
<li><code>angry_birds_2</code></li>
<li><code>planet_crafter</code></li>
<li><code>beat_saber</code></li>
<li><code>monument_valley</code></li>
<li><code>return_of_the_obra_dinn</code></li>
<li><code>hollow_knight</code></li>
<li><code>rimworld</code></li>
<li><code>subnautica</code></li>
<li><code>deaths_door</code></li>
<li><code>gunfire_reborn</code></li>
<li><code>pokemon_go</code></li>
<li><code>cities_skylines</code></li>
</ul></li>
<li>Scoring Public Key:</li>
</ul>
<pre><code>ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCcM4aDj8Y4COv+f8bd2WsrIynlbRGgDj2+q9aBeW1Umj5euxnO1vWsjfkpKnyE/ORsI6gkkME9ojAzNAPquWMh2YG+n11FB1iZl2S6yuZB7dkVQZSKpVYwRvZv2RnYDQdcVnX9oWMiGrBWEAi4jxcYykz8nunaO2SxjEwzuKdW8lnnh2BvOO9RkzmSXIIdPYgSf8bFFC7XFMfRrlMXlsxbG3u/NaFjirfvcXKexz06L6qYUzob8IBPsKGaRjO+vEdg6B4lH1lMk1JQ4GtGOJH6zePfB6Gf7rp31261VRfkpbpaDAznTzh7bgpq78E7SenatNbezLDaGq3Zra3j53u7XaSVipkW0S3YcXczhte2J9kvo6u6s094vrcQfB9YigH4KhXpCErFk08NkYAEJDdqFqXIjvzsro+2/EW1KKB9aNPSSM9EZzhYc+cBAl4+ohmEPej1m15vcpw3k+kpo1NC2rwEXIFxmvTme1A2oIZZBpgzUqfmvSPwLXF0EyfN9Lk= SCORING KEY DO NOT REMOVE</code></pre>
<h5 id="ssh-login">SSH Login</h5>
<ul>
<li>Green: Scoring Users are able to log in via SSH key</li>
<li>Yellow: SSH is accessible, Scoring users are unable to login</li>
<li>Red: SSH is inaccessible (Port closed, invalid response from
SSH)</li>
</ul>
<h4 id="ftp">FTP</h4>
<ul>
<li>FTP Scoring User Password Hash:
<ul>
<li><code>$6$PljFlMmWUAI2AEV9$5DM0zDEIOCJHQ4ggafxpnkOIJmLklqMjqAuWza1NyI3hsPdhAjAT2jWr8eKPPTbdi51vZkAof6vDkGzyHP8bk1</code></li>
</ul></li>
<li>FTP Scoring Users:
<ul>
<li><code>night_in_the_woods</code></li>
<li><code>starship_troopers_terran_command</code></li>
<li><code>angry_birds_2</code></li>
<li><code>planet_crafter</code></li>
<li><code>beat_saber</code></li>
<li><code>monument_valley</code></li>
<li><code>return_of_the_obra_dinn</code></li>
<li><code>hollow_knight</code></li>
<li><code>rimworld</code></li>
<li><code>subnautica</code></li>
<li><code>deaths_door</code></li>
<li><code>gunfire_reborn</code></li>
<li><code>pokemon_go</code></li>
<li><code>cities_skylines</code></li>
</ul></li>
<li>FTP Scoring Directory: <code>/mnt/files</code></li>
<li>FTP Files:
<ul>
<li>name: 1.bin</li>
<li>name: 2.bin</li>
<li>name: 3.bin</li>
<li>name: 4.bin</li>
<li>name: 5.bin</li>
<li>name: 6.bin</li>
<li>name: 7.bin</li>
<li>name: 8.bin</li>
<li>name: 9.bin</li>
<li>name: 10.bin</li>
<li>name: 11.bin</li>
<li>name: 12.bin</li>
<li>name: 13.bin</li>
<li>name: 14.bin</li>
<li>name: 15.bin</li>
<li>name: 16.bin</li>
<li>name: 17.bin</li>
<li>name: 18.bin</li>
<li>name: data_dump_1.bin</li>
<li>name: data_dump_2.bin</li>
<li>name: data_dump_3.bin</li>
<li>name: datadump.bin</li>
</ul></li>
</ul>
<h5 id="ftp-login">FTP Login</h5>
<ul>
<li>Green: Scoring users are able to log in via ftp.</li>
<li>Yellow: FTP is accessible, scoring users are unable to login.</li>
<li>Red: FTP is inaccessible (Port closed, timeout/invalid response from
FTP)</li>
</ul>
<h5 id="ftp-write">FTP Write</h5>
<ul>
<li>Green: Scoring users are able to write a file to the remote FTP
server.</li>
<li>Yellow: FTP is accessible, but scoring users are unable to write new
files.</li>
<li>Red: FTP is inaccessible (Port closed, timeout/invalid response from
FTP)</li>
</ul>
<h5 id="ftp-content">FTP Content</h5>
<ul>
<li>Green: Files from the above list exists, can be downloaded, and
contents pass an integrity check.</li>
<li>Yellow: Login is successful, some files are missing or fail the
integrity check.</li>
<li>Red: Login failed.</li>
</ul>