---
# System prepended metadata

title: Cyber Team Canada Debrief
tags: [CyberSci, Cyber Team Canada]

---

# Cyber Team Canada Debrief

###### tags: `CyberSci` `Cyber Team Canada`

## What Went Well
- Finding the writeup (Recon)
- Not much resistance
- Tristan knew a lot about Windows management
- Were able to find indicators in the logs
## What We Did
- Only applied 1 firewall rule
- Found writeup for one of the boxes
## Notable Hiccups
- Very confusing
- Didn't know how to connect to anything
- No intel on how to connect
## Focus Items
- Web attack automation with Selenium (Robert)
- Persistence kit (Jason)
    - Kernel module
    - Process injection
    - Adding users
- Use SSH to our advantage? (Ethan)
- Try to ID auto-flag checks? (Trent)
- Stealth Filename Generator (Unassigned)
    - Something innocuous
    - Patch by default
    - Maybe command line arguments for known filename
- Modify SSH binary with hard-coded password/key (Jason)?
- Rootkit ready 
    - Trent has the source code
    - Maybe look into modifying it
    - Need user already
    - Already pretty stealthy
- Stealth
    - Packet fragmentation
    - Auto-delay on Selenium Oxide
- Speed
    - Enumeration that's speedy but not super-speedy
    - Web crawls with delay
- Scanners
    - Look into CVE scanners for our own box
    - Delete on unknown connection
- 
## ICC Intel
- Blue team will have direct access