schedule
===
###### tags: `schedule`

## upper

| | AD | 1 | 2 | 3 | 4 | 5 |
|:--- |:---------------------- |:--- |:--- |:--- |:--- |:--- |
| D-1 | proxy logon (丘) | | | | | |
| D-2 | zero logon (謝) | | | | | |
| D-3 | gold/silver ticket(陳) | | | | | |

| id | 題目 |
| --- | --------- |
| 0 | base64 |
| 1 | LFI(8282) |
| 2 | LFI(8181) |
| 3 | webshell |
| 4 | command |
| 5 | xxe |
| 6 | sql |
| 7 | pwn |
| 8 | ubuntu |
| 9 | win |
| a | zeus |
| b | hades |
| c | posiedon |
| d | keqin |
| e | kejian |
| f | kenan |
## lower
### 甲方
| | os | 1 | 2 | 3 | 4 | 5 | 6 |
|:---- |:------ |:---------------- |:---------------- |:----------------- |:----------------- |:----------------- |:----------------- |
| D1-1 | win10 | ~~LFI(王)~~ 8282 | ~~pwn(陳)~~ | ~~base64(楊)~~ | ~~weak pass(楊)~~ | | |
| D1-2 | win7 | ~~LFI(王)~~ 8181 | ~~cookie(王)~~ | ~~ms17-010(謝)~~ | ~~bluekeep(謝)~~ | ~~pwn(陳)~~ | ~~weak pass(楊)~~ |
| D1-3 | u20.04 | ~~command(丘)~~ | ~~webshell(丘)~~ | ~~cookie(王)~~ 80 | ~~weak pass(楊)~~ | | |
| D2-1 | win10 | ~~webshell(丘)~~ | ~~sql(陳)~~ | ~~pwn(陳)~~ | ~~weak pass(楊)~~ | | |
| D2-2 | win7 | ~~ms17-010(謝)~~ | ~~bluekeep(謝)~~ | ~~xxe(陳)~~ | ~~pwn(陳)~~ | ~~weak pass(楊)~~ | |
| D2-3 | u20.04 | ~~webshell(丘)~~ | ~~base64(楊)~~ | ~~weak pass(楊)~~ | | | |
| D3-1 | win10 | ~~xxe(陳)~~ | ~~pwn(陳)~~ | ~~weak pass(楊)~~ | | | |
| D3-2 | win7 | ~~sql(陳)~~ | ~~ms17-010(謝)~~ | ~~bluekeep(謝)~~ | ~~weak pass(楊)~~ | ~~pwn(陳)~~ | |
| D3-3 | u20.04 | ~~command(丘)~~ | ~~base64(楊)~~ | ~~weak pass(楊)~~ | | | |
### 乙方
| | os | 1 | 2 | 3 | 4 | 5 | 6 |
|:---- |:------ |:---------------- | ---------------- |:----------------- |:----------------- |:----------------- |:----------------- |
| N1-1 | win10 | ~~LFI(王)~~ 8282 | ~~pwn(陳)~~ | ~~base64(楊)~~ | ~~weak pass(楊)~~ | | |
| N1-2 | win7 | ~~LFI(王)~~ 8181 | ~~cookie(王)~~ | ~~ms17-010(謝)~~ | ~~bluekeep(謝)~~ | ~~pwn(陳)~~ | ~~weak pass(楊)~~ |
| N1-3 | u20.04 | ~~command(丘)~~ | ~~webshell(丘)~~ | ~~cookie(王)~~ | ~~weak pass(楊)~~ | | |
| N2-1 | win10 | ~~webshell(丘)~~ | ~~sql(陳)~~ | ~~pwn(陳)~~ | ~~weak pass(楊)~~ | | |
| N2-2 | win7 | ~~ms17-010(謝)~~ | ~~bluekeep(謝)~~ | ~~xxe(陳)~~ | ~~pwn(陳)~~ | ~~weak pass(楊)~~ | |
| N2-3 | u20.04 | ~~webshell(丘)~~ | ~~base64(楊)~~ | ~~weak pass(楊)~~ | | | |
| N3-1 | win10 | ~~xxe(陳)~~ | ~~pwn(陳)~~ | ~~weak pass(楊)~~ | | | |
| N3-2 | win7 | ~~sql(陳)~~ | ~~ms17-010(謝)~~ | ~~bluekeep(謝)~~ | ~~weak pass(楊)~~ | ~~pwn(陳)~~ | |
| N3-3 | u20.04 | ~~command(丘)~~ | ~~base64(楊)~~ | ~~weak pass(楊)~~ | | | |

# IP list
| | Intra | Extra | |
|:------:|:-------------:|:---------------:| ---- |
| D1-W10 | 192.168.1.1 | 192.168.168.111 | 8282 |
| D1-W7 | 192.168.1.2 | 192.168.168.112 | 8181 |
| D1-U20 | 192.168.1.3 | 192.168.168.113 | 80 |
| D1-S | 192.168.1.253 | 192.168.168.114 | |
| D2-W10 | 192.168.2.1 | 192.168.168.121 | |
| D2-W7 | 192.168.2.2 | 192.168.168.122 | |
| D2-U20 | 192.168.2.3 | 192.168.168.123 | |
| D2-S | 192.168.2.253 | 192.168.168.124 | |
| D3-W10 | 192.168.3.1 | 192.168.168.131 | |
| D3-W7 | 192.168.3.2 | 192.168.168.132 | |
| D3-U20 | 192.168.3.3 | 192.168.168.133 | |
| D3-S | 192.168.3.253 | 192.168.168.134 | |
| N1-W10 | 172.16.1.1 | 192.168.168.111 | 8282 |
| N1-W7 | 172.16.1.2 | 192.168.168.112 | 8181 |
| N1-U20 | 172.16.1.3 | 192.168.168.113 | 80 |
| N1-S | 172.16.1.253 | 192.168.168.114 | |
| N2-W10 | 172.16.2.1 | 192.168.168.121 | |
| N2-W7 | 172.16.2.2 | 192.168.168.122 | |
| N2-U20 | 172.16.2.3 | 192.168.168.123 | |
| N2-S | 172.16.2.253 | 192.168.168.124 | |
| N3-W10 | 172.16.3.1 | 192.168.168.131 | |
| N3-W7 | 172.16.3.2 | 192.168.168.132 | |
| N3-U20 | 172.16.3.3 | 192.168.168.133 | |
| N3-S | 172.16.3.253 | 192.168.168.134 | |
| 楊 | | 192.168.168.145 | |
| 丘 | | 192.168.168.146 | |
| 陳 | | 192.168.168.147 | |
| G | | 192.168.168.148 | |
| Jacob | | 192.168.168.149 | |

# vlan
* 甲軍(D):
* extra:376
* intra:335
* 乙軍(N):
* extra:476
* intra:435

# refer
- weak pass
- pwn
- ms17-010
- bluekeep