---
# System prepended metadata

title: Services/tasks

---

## Initial setup for each team member

**OUR VULNBOX IP: 10.60.61.2**

This is required so we are able to ssh into our vulnbox or setup ssh tunnel/forwarding to be able to develop exploits against services hosted on our own vulnbox.

1. Download team config(team token, ovpn):
```bash
wget https://cdn.discordapp.com/attachments/791979656705736704/791985628187066368/ructfe_2020.zip
unzip ructfe_2020.zip
```

2. Setup VPN tunnel:
```bash
sudo openvpn vpn.ovpn
```

3. Services/tasks on our vulnbox should be available via `10.60.61.2`. Password (dznK5e9fXrgn)

4. download tasks
```shell 
#copy ssh key
ssh-copy-id root@10.60.61.2
#copy tasks
scp root@10.60.61.2:*.zip .
```

#### SKIP 4-5 THIS FOR NOW // port forwarding

Leaving it here in case we need it.

4. Setup port forwarding:
```bash
pip3 install sshuttle
sshuttle -r root@team61.cloud.ructfe.org 10.0.0.0/8
```
this will forward all traffic to network `10.0.0.0/8` with tasks via our cloud VM, so you can access tasks locally browsing for example to `10.0.0.1:1337`.

5. If you don't want to forward the whole network traffic, you can forward each task separately:
```bash
ssh -L 17171:127.0.0.1:17171: root@team61.cloud.ructfe.org
```
this will forward all the traffic from a local port `17171` to port `17171` on the cloud VM. Then you can access tasks via `127.0.0.1:17171` (closing this SSH session will close the forwarding, if you don't want to open a session, add `-fNT` but then you will need to use `kill -9 <SSH.PID>` to cancel forwarding.


# Services/tasks
We know nothing about the setup yet. Most likely, there will be docker/lxc containers, or, a supervisord? Who knows.

During the setup phase we will:
1. (who: haqpl/disco) Create & snapshot vm on their cloud.
2. (who: haqpl/disco) Make any other necessary steps so all team members can login into the VM via ssh.
3. (who: haqpl/disco) Backup all tasks/services & interesting info (`ps auxf && ss -tuplen`).
4. (who: everybody) Setup VPN on your side.
5. Find tasks, check its basic info (type/technology), how to check task's logs etc.
2. Split our forces into tasks.
3. Find bugs, write exploits and patch vulns.

# Dump traffic for network analysis/getting exploits out

To dump traffic, use something like `tcpdump -nni <interface> -w <output> [<protocol>] port <port>`. The network interface can be found with `ip a` or `ifconfig --all`.

If you want to filter out just SOURCE or DESTINATION traffic, so only one side, then change `port` to `dst port` or `src port`.

Examples:

* tcp:`tcpdump -nni ens160 -w file.pcap tcp port 80`
* udp: `tcpdump -nni ens160 -w file.pcap udp port 1337`
* http(0.0-2.0): the same as tcp
* http(3.0): the same as udp
* read/filter pcap: `tcpdump -nnr file.pcap <filters here>`
* read/filter pcap with ASCII packet details: `tcpdump -nnr file.pcap -A <filters here>`

[tcpdump cheatsheet](https://www.andreafortuna.org/2018/07/18/tcpdump-a-simple-cheatsheet/)

Most likely we won't need it, but if the traffic is encryped

# Comprehensive WAF sollution

```
Setup:
# Create new chain
sudo iptables -N LOG_N_DROP
# Log packets to NFLOG
sudo iptables -A LOG_N_DROP -j NFLOG --nflog-group 1
# Drop packets in chain
sudo iptables -A LOG_N_DROP -j DROP

Usage:
# Look for string haqwaf in traffic to destination port 80 if matched forward to LOG_N_DROP
sudo iptables -A INPUT -p tcp --dport 80 -m string --algo bm --string 'haqwaf' -j LOG_N_DROP
# Same but for DNS with hex'es for non-text traffic
sudo iptables -p udp --dport 53 -m string --algo bm --hex-string '|03|www|09|net-filter|03|org|00|' -j LOG_N_DROP
```

```
# Capture logged and dropped packets with tcpdump:
sudo tcpdump -vvv -nn -i nflog:1 -w interesting.pcap
```

## Analysing logs

![](https://i.imgur.com/zYnfDI5.png)
