---
# System prepended metadata

title: schedule
tags: [schedule]

---

schedule
===
###### tags: `schedule`

## upper

|     | AD                     | 1   | 2   | 3   | 4   | 5   |
|:--- |:---------------------- |:--- |:--- |:--- |:--- |:--- |
| D-1 | proxy logon (丘)       |     |     |     |     |     |
| D-2 | zero logon  (謝)       |     |     |     |     |     |
| D-3 | gold/silver ticket(陳) |     |     |     |     |     |



| id  | 題目      |
| --- | --------- |
| 0   | base64    |
| 1   | LFI(8282) |
| 2   | LFI(8181) |
| 3   | webshell  |
| 4   | command   |
| 5   | xxe       |
| 6   | sql       |
| 7   | pwn       |
| 8   | ubuntu    |
| 9   | win       |
| a   | zeus      |
| b   | hades     |
| c   | posiedon  |
| d   | keqin     |
| e   | kejian    |
| f   | kenan     |
## lower
### 甲方
|      | os     | 1                | 2                | 3                 | 4                 | 5                 | 6                 |
|:---- |:------ |:---------------- |:---------------- |:----------------- |:----------------- |:----------------- |:----------------- |
| D1-1 | win10  | ~~LFI(王)~~ 8282 | ~~pwn(陳)~~      | ~~base64(楊)~~    | ~~weak pass(楊)~~ |                   |                   |
| D1-2 | win7   | ~~LFI(王)~~ 8181 | ~~cookie(王)~~   | ~~ms17-010(謝)~~  | ~~bluekeep(謝)~~  | ~~pwn(陳)~~       | ~~weak pass(楊)~~ |
| D1-3 | u20.04 | ~~command(丘)~~  | ~~webshell(丘)~~ | ~~cookie(王)~~ 80 | ~~weak pass(楊)~~ |                   |                   |
| D2-1 | win10  | ~~webshell(丘)~~ | ~~sql(陳)~~      | ~~pwn(陳)~~       | ~~weak pass(楊)~~ |                   |                   |
| D2-2 | win7   | ~~ms17-010(謝)~~ | ~~bluekeep(謝)~~ | ~~xxe(陳)~~       | ~~pwn(陳)~~       | ~~weak pass(楊)~~ |                   |
| D2-3 | u20.04 | ~~webshell(丘)~~ | ~~base64(楊)~~   | ~~weak pass(楊)~~ |                   |                   |                   |
| D3-1 | win10  | ~~xxe(陳)~~      | ~~pwn(陳)~~      | ~~weak pass(楊)~~ |                   |                   |                   |
| D3-2 | win7   | ~~sql(陳)~~      | ~~ms17-010(謝)~~ | ~~bluekeep(謝)~~  | ~~weak pass(楊)~~ | ~~pwn(陳)~~       |                   |
| D3-3 | u20.04 | ~~command(丘)~~  | ~~base64(楊)~~   | ~~weak pass(楊)~~ |                   |                   |                   |
### 乙方
|      | os     | 1                | 2                | 3                 | 4                 | 5                 | 6                 |
|:---- |:------ |:---------------- | ---------------- |:----------------- |:----------------- |:----------------- |:----------------- |
| N1-1 | win10  | ~~LFI(王)~~ 8282 | ~~pwn(陳)~~          | ~~base64(楊)~~        | ~~weak pass(楊)~~ |                   |                   |
| N1-2 | win7   | ~~LFI(王)~~ 8181 | ~~cookie(王)~~   | ~~ms17-010(謝)~~  | ~~bluekeep(謝)~~  | ~~pwn(陳)~~           | ~~weak pass(楊)~~ |
| N1-3 | u20.04 | ~~command(丘)~~  | ~~webshell(丘)~~ | ~~cookie(王)~~    | ~~weak pass(楊)~~ |                   |                   |
| N2-1 | win10  | ~~webshell(丘)~~     | ~~sql(陳)~~          | ~~pwn(陳)~~           | ~~weak pass(楊)~~ |                   |                   |
| N2-2 | win7   | ~~ms17-010(謝)~~ | ~~bluekeep(謝)~~ | ~~xxe(陳)~~       | ~~pwn(陳)~~           | ~~weak pass(楊)~~ |                   |
| N2-3 | u20.04 | ~~webshell(丘)~~ | ~~base64(楊)~~       | ~~weak pass(楊)~~ |                   |                   |                   |
| N3-1 | win10  | ~~xxe(陳)~~      | ~~pwn(陳)~~          | ~~weak pass(楊)~~ |                   |                   |                   |
| N3-2 | win7   | ~~sql(陳)~~          | ~~ms17-010(謝)~~ | ~~bluekeep(謝)~~  | ~~weak pass(楊)~~ | ~~pwn(陳)~~           |                   |
| N3-3 | u20.04 | ~~command(丘)~~  | ~~base64(楊)~~       | ~~weak pass(楊)~~ |                   |                   |                   |

# IP list
|        |     Intra     |      Extra      |      |
|:------:|:-------------:|:---------------:| ---- |
| D1-W10 |  192.168.1.1  | 192.168.168.111 | 8282 |
| D1-W7  |  192.168.1.2  | 192.168.168.112 | 8181 |
| D1-U20 |  192.168.1.3  | 192.168.168.113 | 80   |
|  D1-S  | 192.168.1.253 | 192.168.168.114 |      |
| D2-W10 |  192.168.2.1  | 192.168.168.121 |      |
| D2-W7  |  192.168.2.2  | 192.168.168.122 |      |
| D2-U20 |  192.168.2.3  | 192.168.168.123 |      |
|  D2-S  | 192.168.2.253 | 192.168.168.124 |      |
| D3-W10 |  192.168.3.1  | 192.168.168.131 |      |
| D3-W7  |  192.168.3.2  | 192.168.168.132 |      |
| D3-U20 |  192.168.3.3  | 192.168.168.133 |      |
|  D3-S  | 192.168.3.253 | 192.168.168.134 |      |
| N1-W10 |  172.16.1.1   | 192.168.168.111 | 8282 |
| N1-W7  |  172.16.1.2   | 192.168.168.112 | 8181 |
| N1-U20 |  172.16.1.3   | 192.168.168.113 | 80   |
|  N1-S  | 172.16.1.253  | 192.168.168.114 |      |
| N2-W10 |  172.16.2.1   | 192.168.168.121 |      |
| N2-W7  |  172.16.2.2   | 192.168.168.122 |      |
| N2-U20 |  172.16.2.3   | 192.168.168.123 |      |
|  N2-S  | 172.16.2.253  | 192.168.168.124 |      |
| N3-W10 |  172.16.3.1   | 192.168.168.131 |      |
| N3-W7  |  172.16.3.2   | 192.168.168.132 |      |
| N3-U20 |  172.16.3.3   | 192.168.168.133 |      |
|  N3-S  | 172.16.3.253  | 192.168.168.134 |      |
|   楊   |               | 192.168.168.145 |      |
|   丘   |               | 192.168.168.146 |      |
|   陳   |               | 192.168.168.147 |      |
|   G   |               | 192.168.168.148 |      |
|   Jacob   |               | 192.168.168.149 |      |

# vlan
* 甲軍(D):
    * extra:376
    * intra:335
* 乙軍(N):
    * extra:476
    * intra:435



# refer
- weak pass
- pwn
- ms17-010
- bluekeep
