Penetration Testing mailing list archives
Re: Best attack strategy for a Red Team?
From: Georgia Weidman <georgiaderabolon () gmail com>
Date: Tue, 10 Mar 2009 13:18:47 -0400
Hi Scott, Were you at qualifier? If so, typically regionals is a little bit different. At qualifiers the red team gets to go after the systems before the student teams do resulting in all the systems having default passwords and being unpatched. Last year at regionals student teams had a few hours to secure their systems before the red team was allowed to attack. Still, there are alot of systems with alot of passwords, some of which are not obvious. For instance last year we had voip phones (and we will this year) which teams didn't have much experience on and didn't know there was a default password in the phone itself not just the pbx system that allowed the red team to own every team's phones for the whole competition. So I would study the diagram and look for passwords that academic teams might miss. Also, the systems are unpatched when the academic teams sit down. The teams are allowed to patch, but the systems are not directly attached to the internet. In the hustle and bustle of things patches get missed. The teams will not simply be able to call windows update and have it look for missed patches. So a good route of attack is to scan for missed patches and exploit them. Last year when the red team started attacking my team at least had not finished patching (they deliberately make the downloads slow). Talk to the other red team members; they are only mean to students when their is scotch involved. I know at least one of them is pretty new to red teaming as well. I can put you in contact with him if you write me off list. Have fun, Georgia On Mon, Mar 9, 2009 at 1:55 PM, Scott <opiesan () gmail com> wrote:
Howdy folks! I'm part of a Red Team for the Mid-Atlantic region CCDC competition (Collegiate Cyber Defense Competition). There are some pretty talented folks on the team and I'm arguably the least experienced (for now). The short version explanation is that teams of college students are tasked with operating and defending a "corporate" network of systems ranging from web, email, DB, MS Domain servers, VoIP, and normal workstations. They have to patch a wide variety of holes while keeping designated services available for scoring. The team with the most uptime wins. Meanwhile, the red team is busy attacking these services along with anything else we can get into and create havoc for the student teams. My question to all of you is what you would recommend for an attack strategy here. In previous competitions it's been challenging to know where to start as there are many options. Should I find a hole and dig in with backdoors, create new user accounts, take over the admin accounts and lock out the student teams??? Technically the red team is supposed to bring down or deny access to the services the students are scored on (primary objective). There's always more going than that however. I'd like to stay focused when we go into the 3 day event this month so I need a plan. How would you do it if you didn't know more than possibly what types of systems you'll find on the target networks? Thanks. Scott
Current thread:
- Best attack strategy for a Red Team? Scott (Mar 10)
- Message not available
- Re: Best attack strategy for a Red Team? Scott (Mar 12)
- Re: Best attack strategy for a Red Team? Mike Acker (Mar 15)
- Re: Best attack strategy for a Red Team? Scott (Mar 12)
- Message not available
- Message not available
- Re: Best attack strategy for a Red Team? Scott (Mar 12)
- Message not available
- Re: Best attack strategy for a Red Team? Scott (Mar 12)
- Re: Best attack strategy for a Red Team? sr. (Mar 15)
- Re: Best attack strategy for a Red Team? Scott (Mar 12)
- Re: Best attack strategy for a Red Team? Scott (Mar 12)
- Re: Best attack strategy for a Red Team? Adriel T. Desautels (Mar 12)
- Message not available
- Re: Best attack strategy for a Red Team? Adriel T. Desautels (Mar 15)
- <Possible follow-ups>
- Re: Best attack strategy for a Red Team? vijay . upadhyaya (Mar 12)
- Re: Best attack strategy for a Red Team? krymson (Mar 12)