[[WarZone]]
 

WarZone

warzone
founder: root
depends on:
interested: biiter
tomsuch
ruza
software license:
hardware license: na
status: dead

Goals of the Project

  • hakc teh pla.net
  • improve our háčking skills
  • phun for members of our hackerspace and members of other hackerspaces, also for visitors of our space

Wargames (team)

“Capture the Flag (CTF) is a computer security wargame. Each team is given a machine (or small network) to defend on an isolated network. Teams are scored on both their success in defending their assigned machine and on their success in attacking other team's machines. Depending on the nature of the particular CTF game, teams may either be attempting to take an opponent's flag from their machine or teams may be attempting to plant their own flag on their opponent's machine.” – Wikipedia http://en.wikipedia.org/wiki/Capture_the_flag#Computer_security

Network setup

Vulnerable servers

TODO

  • Score keeping box

References

Wargames (single)

Access

Direct SSH

From teh Internetz

ssh level00@nat.brmlab.cz -p 2201

ChaosVPN

ssh level00@172.31.0.16 -p 2201

OpenVPN

WarZone is network segment physically located in brmlab hackerspace, isolated from other network infrastructure and remotely available via VPN. Files needed to access prepared Warzone VPN are downloadable here..

OpenVPN not working at this time

ruza@azur:~$ mkdir -p .openvpn/brmlab-warzone
ruza@azur:~$ cd .openvpn/brmlab-warzone
ruza@azur:~/.openvpn/brmlab-warzone$ wget -q http://nat.brmlab.cz/warzone/warzone-klient.zip
ruza@azur:~/.openvpn/brmlab-warzone$ unzip warzone-klient.zip 
Archive:  warzone-klient.zip
  inflating: ca.crt                  
  inflating: warzone-klient.crt      
  inflating: warzone-klient.key      
  inflating: warzone-klient.ovpn     
ruza@azur:~/.openvpn/brmlab-warzone$ sudo openvpn warzone-klient.ovpn 
...

If everything worked well last lines of openvpn output should look like this (openvpn adds route to 192.168.66.x network):

Wed Aug 17 02:42:12 2011 /sbin/route add -net 192.168.66.0 netmask 255.255.255.0 gw 192.168.66.129
Wed Aug 17 02:42:12 2011 Initialization Sequence Completed

Everything you need is to have openvpn installed. Download http://nat.brmlab.cz/warzone/warzone-klient.zip and successfully connect with config and certificates included in zip file.

If you want to use NetworkManager to connect to Warzone, you can.

Available challenges

BRMCTF

admin:biiter

IP 192.168.66.4 (internal DNS name ctf.war) runs server with CTF challenge (capture the flag). Everybody should start at level00. Your task is to get the password to the higher level (level01, etc.). More information in /home/level00/README

Please, do not publish solutions to the levels! Keep it to yourself and let others enjoy competition same as you've did.

Currently CTF has 8 functional levels. More info on http://192.168.66.4 or http://ctf.war/ (within LAN)

From the internetz:

ssh level00@nat.brmlab.cz -p 2201
pass: brmlab

In the brmlab local lan:

ssh level00@192.168.66.4
pass: brmlab

There is a parallel challenge with only one level so far but it's focused more on the logic than low level. This challenge is more difficult.

ssh brm00@192.168.66.4
pass: prtyhrd

OBSTACLE10g

admin:biiter

IP 192.168.66.8 runs server with Oracle database. Can you hack it?

==== DVWA ==== (temporarily down) admin:biiter IP 192.168.66.7 has Damn Vulnerable Web App (DVWA) installed and configured. Use login 'brmlab' with password 'brmlab'. After logging in, read the instructions <note> http://192.168.66.7/ user: brmlab
pass: brmlab </note> ==== WebGoat ==== (temporarily down) admin:biiter Other service available is at 192.168.66.7:8080 which has OWASP WebGoat Project (WebGoat) installed and configured. Use login 'brmlab' with 'brmlab' password. <note> http://brmlab:brmlab@192.168.66.7:8080/webgoat/attack </note>

Recommended readings

References

Similar public projects

SetUp

Internal setup info (only for brmlab members)

 
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Noncommercial-Share Alike 3.0 Unported
Recent changes RSS feed Donate Powered by PHP Valid XHTML 1.0 Valid CSS Driven by DokuWiki