AUD507-J
Welcome to the J01 version of the AUD507 hands-on challenge!
The questions within this challenge are designed to reinforce the hands-on workbook activities that you have experienced while taking this class. With this in mind, this challenge has been designed to push you to expand your knowledge by applying the things that you have learned to similar, but not identical, situations and problems.
As you work through the challenge, please feel free to call on your instructor (or the SANS SME team, if you are taking this class as an OnDemand student) if you need any assistance. Keep in mind that you are not required to answer the questions in order, nor are you required to answer all of the questions in all of the levels. If you find a section isn't particularly relevant for you, it's okay to skip it!
The questions are presented in sections which are included in three levels. To reach Level Two, you must score 100 points. To reach Level Three, you must score 200.
General Knowledge
This section contains basic questions from a variety of the topics covered in the class. You should be able to answer all of these questions based on discussions with your instructor and the content of the course books.
Auditing
The primary objective of an auditor is to measure and report on _______________.
Hints
An auditor might have findings, but they are not the purpose.
The auditor is also not focused on finding vulnerabilities.
Control gaps and uncontrolled security issues represent the kinds of things that this term represents.
Answer
Risk
Explanation: While people may at times feel that an auditor's purpose is to find flaws and mistakes, the actual purpose is to measure and report on risk in relation to organizational policies and procedures.
Audit Standards
What is the numeric designator of the ISACA guideline which describes the required sections for an audit report? Your answer will be a 4-digit integer.
Hints
ISACA's IT Audit Framework (ITAF) includes comprehensive standards and guidelines for performing IT audits.
Standard 1401 requires issuance of a report for audits.
The guidelines for writing the report are related to Standard 1401 and presented in the next section of the ITAF.
Answer
2401
Audit Standard 1401 requires that a report be issued for an audit, Guideline 2401 describes the required report sections and other topics like subsequent events.
Control Objectives
The parts of the CIA triad of control objectives are confidentiality, ____________ and availability.
Hints
This control objective involves ensuring that systems and data are in a known-good state.
Controls for this objective will be concerned with completeness, accuracy and validity of data and transactions.
Controls like authentication and hashing support this objective.
Answer
integrity
Confidentiality, integrity and availability describe some of the common goals of controls.
Risk Assessment
A(n) _________ tree can be used to find the underlying causes of system and control failures by asking questions about what must be true for a failure to happen.
Hints
This tree is used as the second step for consequence/cause analysis (CCA).
It helps to identify missing controls by asking what condition allowed a failure to occur.
This type of analysis can find underlying faults in our control environment.
Answer
fault
A fault tree is used to determine the causes which could lead to a critical failure. It analyzes events by asking the question “for this event to have occurred, what underlying facts must be true?”
Capability Maturity Model
Which numeric level of the capability maturity model is commonly labeled "Optimizing?" Your answer should be an integer.
Hints
The CMM and CMMI level names may vary, but "optimizing" is generally used to describe this level in all versions of the model.
It's easy to search the web for descriptions of the maturity models.
Optimizing is very high in the model.
Answer
5
Optimizing is the highest level of the capability maturity model.
JSON Parsing
What is the name of the cross-platform tool which can "slice and filter and map and transform" JSON data, similarly to sed, awk and grep?
Hints
This tool is similar to sed, but used for JSON data.
At its simplest, it acts as a pretty-printer for JSON data.
It can also work with JSON arrays and create custom JSON objects.
Answer
jq
The author of jq describes it like this:
"jq is like sed for JSON data - you can use it to slice and filter and map and transform structured data with the same ease that sed, awk, grep and friends let you play with text."
Nmap
What is the nmap flag to specify TCP connect() scanning? Your answer should include the dash and is case sensitive.
Hints
nmap is installed on your Ubuntu and Alma VMs. nmap -h will get the help output.
There's also a good nmap book online.
You used this option in some of your labs.
Answer
-sT
By default, nmap will use SYN stealth scanning when possible. Full-connect scanning sends more packets, but can sometimes yield more reliable results.
Networking
What is the IPv4 address of the www.aud507.com public Wiki website?
Hints
Is there a way that you can translate the name of the server into an IP address?
Your web browser does this transparently, but it can be challenging to get the answer this way. You will most likely want to use a command interpreter to find an answer.
What happens when you try to ping the Wiki webserver?
Answer
74.208.236.95
Explanation: If you use nslookup, ping, or any other command line tool to force a DNS lookup, you will find that the IP address of the host is 74.208.236.95.
Cloud Service Models
What is the four-letter abbreviation for the cloud service model in which the customer is given full access to create and manage their own networks, virtual machines, storage and other services?
Hints
There are dozens of cloud service models, but this one is very commonly used.
In this model, the customer can manage the virtual infrastructure themselves.
The ability to manage infrastructure is provided as a service the customer can use.
Answer
IaaS
Infrastructure as a service (IaaS) gives the customer a virtual private cloud in which they have full administrative control.
Cloud Services
What is the abbreviated name for the AWS service which provides compute capabilities? Your answer will be three characters, and include letters and numbers.
Hints
This service allows customers to create and manage virtual machine instances.
The service is "elastic" because instances can be created and removed at will, either programmatically or through the web console.
This service allows customers to manage their own compute cloud.
Answer
EC2
The Elastic Compute Cloud (EC2) is Amazon's compute service. Virtual machines in EC2 are called "instances."
Shared Responsibility
Google introduced a cooperative concept beyond the shared responsibility model, called shared ________, which includes "prescriptive" guidance on how to use the cloud securely.
Hints
Shared responsibility models assume that it's up to the customer to know how to operate securely.
This model provides automation templates to make it easier to create secure environments.
In this model, the fate of the customer's cloud deployment is shared with the provider.
Answer
fate
Google is notable for their embracing of the “Shared Fate” concept, in which they actively seek to advise customers on how to use their products securely. They even publish automation templates and other resources to make secure architecture and deployment easier.
Cloud Compliance
Which level of the Cloud Security Alliance (CSA) STAR program includes a 3rd-party certification? Your answer will be an integer.
Hints
STAR includes multiple levels, with self-assessment at the bottom.
Third-party testing offers a higher level of assurance than self assessment.
The highest level of STAR certification is not yet implemented.
Answer
2
STAR level two includes a certification by a third-party auditor. This will normally be a SOC2 attestation or ISO27701 certification.
Windows Systems
This section contains questions about your Windows VM. In most cases, we expect you to use the PowerShell cmdlets and techniques from the labs to answer the questions. If you use other tools, you might want to validate the response with the equivalent PowerShell technique to ensure your answers are in the correct format.
Win10 - Build Number
What is the value of the BuildNumber property reported by WMI for the Window OS installed on the Windows VM? Your answer will be a five-digit integer.
Hints
Get-CimInstance can be used for WMI queries
WMI has a class named Win32_OperatingSystem with information about the installed OS
The resulting object has a property named BuildNumber
Answer
19045
Use the Get-CimInstance cmdlet to retrieve the operating system information and get the build number:
Get-CimInstance Win32_OperatingSystem | Select-Object BuildNumber
Win10 - Serial Number
What is the value of the SerialNumber property reported by WMI for the Window OS installed on the Windows VM? Your answer will be a series of 20 alphanumeric characters separated by hyphens.
Hints
Get-CimInstance can be used for WMI queries
WMI has a class named Win32_OperatingSystem with information about the installed OS
The resulting object has a property named SerialNumber
Answer
00329-10186-30720-AA263
Use the Get-CimInstance cmdlet to retrieve the operating system information and get the serial number:
Get-CimInstance Win32_OperatingSystem | Select-Object SerialNumber
Win10 - Hotfix Date
What is the InstalledOn date for the KB5000736 Microsoft patch on the Windows VM? Your answer should include the full date+time string.
Hints
There is a cmdlet to get information about hotfixes.
It's called Get-Hotfix.
The InstalledOn property gives the date of installation.
Answer
4/9/2021 12:00:00 AM
The Get-Hotfix cmdlet returns information about installed patches.
Get-HotFix | Where-Object HotFixID -eq 'KB5000736'
Win10 - Hotfixes
What is the HotFixID of the other hotfix which was installed on the same date as KB5000736? Your answer should consist of two letters, followed by a string of numbers.
Hints
There's a command to get hotfix information
The InstalledOn property shows the date the hotfixes were installed
Using sort-object would allow you so sort by the InstalledOn dates
Answer
KB5001405
The Get-Hotfix cmdlet returns information about installed patches.
Get-HotFix | Sort-Object InstalledOn
Win10 - Permissions
The C:\Windows\System32 directory on the Windows VM has a single access control entry which grants permission on the file to the ephemeral Creator Owner group. What is the numeric representation of that permission? Your answer will be an integer.
Hints
Windows file/folder permissions are stored in access control lists (ACLs)
Some ACLs are listed with names and some are numeric
Get-Acl is used to query ACLs.
Answer
268435456
The Get-Acl cmdlet allows you to query permissions on a filesystem object. The AccessToString property has the human readable permissions.
Get-Acl C:\windows\system32 | Select-Object AccessToString | Format-List *
Win10 - Shares
What is the name of the Server Message Blocks (SMB) share on the Windows VM which is NOT associated with a filesystem? Your answer should include any special characters which are part of the name.
Hints
There is a command to get SMB share information
It's called Get-SmbShare
It has a property called path, which might be empty for some shares
Answer
IPC$
Get-FileShare (which must be run as an administrator) will show only SMB shares which are attached to a filesystem object like a drive or directory. Get-SmbShare will return a list of ALL SMB shares, including those administrative shares which have no attachment to a filesystem path.
Get-SmbShare | Where-Object Path -eq ""
Win10 - Groups
How many local groups on the Windows VM have the student user as a member?
Hints
This can be done manually by listing the members of every group
Get-LocalGroup gives a list of groups
Get-LocalGroupMember lists the members
The older net user command can yield this information, also.
Answer
2
The old net command will answer this:
net user student
Using PowerShell, this question can be solved with a foreach loop.
#Look at each group
foreach ($groupname in (Get-LocalGroup).Name) {
#check if the student user is in the group
if( (Get-LocalGroupMember -Name $groupname |
Where-Object { $_.name -like '*student' } ).Count -gt 0) {
#we're a member, so print the group name
$groupName
}
}
Win10 - Registry
What is the numeric setting for the registry key which controls whether the Local Security Authority (LSA) on the Windows VM restricts anonymous enumeration of SAM accounts and shares? Your answer will be an integer.
Hints
This is covered by the CIS Benchmark for Windows 10 Enterprise
The registry key is under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
The registry is mapped as PSDrives in PowerShell
Get-ItemProperty can be used to query values in registry keys
Answer
1
This setting is stored with the other LSA settings in the registry, under
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa. The setting is named restrictanonymoussam. You can query it with Get-ItemProperty.
Get-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Control\Lsa
Windows Domains
All of the questions in this section make use of the Windows domain controller running in your AWS lab range. You will need to connect with OpenVPN to access this system, just like you did in the labs for the Windows section.
As a reminder, here are the credentials and IP address of this VM:
- Address:
10.55.7.100 - Username:
student - Password:
Password1
General
What is the IP address of the Windows domain controller provided to you in the Lab and used in this challenge?
Hints
Have you read the directions for this section?
Have you read the directions for this section?
Have you read the directions for this section?
Answer
10.55.7.100
Explanation: This answer requires you to read the directions for the section.
AD Users
Retrieve a list of all users in the AUD507 domain using Get-ADUser. What is the SAMAccountName of the last user returned by the query?
Hints
Create a set of credentials to pass with $cred=Get-Credential
Remember to specify a server, since you are not a member of the domain
You must specify a filter of * to retrieve all users
Answer
JEAAuditor
Explanation: To answer this question, you must use Get-ADUser with a filter of “*” to get a list of all users. The SAMAccountName is one of the properties returned by default.
$cred=Get-Credential -username student
Get-ADUser -Server 10.55.7.100 -Credential $cred -Filter * | Select-Object -Last 1
Disabled Users
How many users in the AUD507 domain are marked as disabled? (Your answer should be an integer)
Hints
Change the filter from '' to limit results using the 'Enabled' property*
Remember that false is specified as $false
-Filter 'Enabled -eq $False'
Answer
11
Explanation: The Get-ADUser cmdlet allows you to filter by account property values:
Get-ADUser -Credential $cred -server 10.55.7.100 -Filter 'Enabled -eq $False' | Measure-Object
User Attributes
Only one user in the AUD507 domain has the office property configured in Active Directory for their account. What is the SAMAccountName of that user?
Hints
Could you create a Get-ADUser filter to remove all users with nothing in the office attribute?
-like "*" would find only users with a value in an attribute.
The office attribute is named either “office” or “physicalDeliveryOfficeName”
Answer
BGarroch
Explanation: To find this user, you must filter for only users with a value in their “office” attribute:
Get-ADUser -Server 10.55.7.100 -Credential $cred -Filter 'Office -like "*"'
Attribute Value
Only one user in the AUD507 domain has the office property configured in Active Directory for their account. What is the value saved in the “office” attribute for that user?
Hints
Create a filter to return the correct user
Use the -Properties flag for Get-ADUser to return the correct AD attribute
The Select-Object command can be used to limit the number of properties returned
Answer
AUD507SecretOffice
Explanation: To find this solution, you must locate the correct user, and then query AD for the correct attributes from their account:
Get-ADUser -Server 10.55.7.100 -Credential $cred -Filter 'Office -like "*"' -Properties Office | Select-Object SamAccountName,Office
AD Groups
There is a group in the AUD507 domain that has the word “audit” as part of the name. What is the fully qualified name of that group? (Your answer should start with “CN=” and end with “local” -- don’t include any surrounding quotations marks!)
Hints
Get-ADGroup is used for querying groups.
Groups have a “name” property you can filter on.
‘’ characters serve as wildcards in name filters.*
Answer
CN=JEAAuditors,OU=Audit and Security,DC=AUD507,DC=local
Explanation: The Get-ADGroup cmdlet allows you to query for groups in the domain:
Get-ADGroup -Server 10.55.7.100 -Credential $cred -Filter 'Name -like "*audit*"'
Domain Admins
How many users are Domain Administrators on the AUD507 domain?
Hints
Get-ADGroupMember is a good command for this.
Remember that groups can be members of other groups. You’ll need to expand these nested groups recursively.
Measure-Object is a good command for counting results.
Answer
71
Explanation:
Get-ADGroupMember -Identity "Domain Admins" -Server 10.55.7.100 -Credential $cred -Recursive | Measure-Object
Password Settings
How many enabled users have passwords which are set to never expire?
Hints
There are users with non-expiring passwords whose accounts are disabled. Don't count them.
You'll need to search for accounts where Enabled -eq $true
Get-ADUser has a filter for "PasswordNeverExpires" as well
Answer
8
Explanation: To find and count users who are both enabled AND have a non-expiring password, use this command:
Get-ADUser -Server 10.55.7.100 -Credential $cred -Filter '(PasswordNeverExpires -eq $true ) -and (Enabled -eq $True)' | Measure-Object
Kubernetes
This section contains questions about the Kubernetes installation on the Ubuntu VM.
If you have not yet configured kubectl on the Ubuntu VM, you should run these commands in BASH on an SSH session to the Ubuntu VM before you answer the questions.
mkdir -p /home/student/.kube
microk8s config > /home/student/.kube/config
K8s - Pods
How many pods are running on the k8s cluster?
Hints
kubectl can answer most of your questions
You can use it to get information from the API
The API resource for pods is called pods
Answer
4
The kubectl get pods command shows the pods on the k8s cluster
K8s - Services
The "juice-shop" service on Kubernetes is forwarding TCP port 8000 on the hosted container to which TCP port? Your answer will be a five-digit integer.
Hints
You'll need to get service information
The PORT(S) field shows the ports being forwarded
The port number before the : is listening in the container. The port number after the colon is being provided by the service to the network
Answer
30020
Kubernetes is serving the hosted container's port 8000 to the network on port 30020.
kubectl get services
K8s - Service Image
What is the full name of the container image being used by the k8s pod hosting the "juice-shop" application? The image name will include numbers, letters, colons and hyphens.
It will look similar to this: docker.io/maintainer/image-name:v1.2.3
Hints
You need to see more information than kubectl's get command provides
Kubectl can describe pods in detail
kubectl describe --help
Answer
docker.io/bkimminich/juice-shop:v14.1.1
Kubectl's describe pods command gives more detailed information about the pods in the cluster.
kubectl describe pods juice-shop
K8s - Namespace Count
How many active namespaces are there on the k8s cluster?
Hints
How can you get namespace information in Kubernetes?
You can use kubectl to retrieve namespace information.
There is a column for the namespace status in the command output.
Answer
4
The namespaces can be seen using
kubectl get namespaces
K8S - Service Namespace
What is the name of the k8s namespace in which the Juice Shop service is running? Your answer will be the case-insensitive name of the namespace.
Hints
Use the namespaces you found in the question above to help you search.
kubectl can get the services in a namepace.
You may have to try several to find the right one.
Answer
default
To see this answer, you'll need to query for services in the namespaces.
kubectl get namespaces
kubectl get services --namespace default
Linux
This section uses the Alma VM located in the "Alma" folder in your 507VMs directory.
Windows Terminal on your Windows VM has a saved session for this machine. Remember that you may need to use the sudo command to receive root privileges for some of your commands. The student user has sudo permissions.
Hostname
What is the fully qualified host name of this Linux server? (The answer will include a host name and domain name separated by dots)
Hints
The hostname command will give you the correct answer
Include both the hostname and domain name in your answer
The answer should start with “alma” and end with the word "local"
Answer
alma.aud507.local
Explanation: The full hostname can be retrieved on this system using the hostname command.
Permissions
There is one file somewhere under the /usr directory which has “world execute” as its only permission flag. What is the full path to this file? Include all slashes, directory names and the filename. Remember that Linux filenames are case-sensitive!
Hints
You can use the find command to locate files.
Remember to use the -perm flag and specify the starting directory of /usr
sudo find /usr -perm 001 should give you the file path.
Answer
/usr/local/share/AUD507Flag
Explanation: The find command is perfect for locating this type of file. Combined with the -perm flag, it will show you the location of the file.
File Contents
What is the complete content of the file you found in the question above? The last character of your answer should be an exclamation point.
Hints
Which command lets you view the contents of a file?
Use this command to “concatenate” the file to the screen.
Simply use cat and the filename obtained in the question above. Use sudo if you need higher privileges.
Answer
AUD507Rocks!
Explanation: To view the contents of the file, simply use the cat command with the file path.
sudo cat /usr/local/share/AUD507Flag
OS Version
What is the release number of the Linux distribution running on this host? Your answer will be two numbers separated by dots, like this: x.y.
Hints
There is a command to view information about the “Linux Standard Base.”
man -k lsb could help you decide which command to use.
The "-a" option will show all information. The "-r" option will show just the release number.
Answer
8.6
The lsb_release -a command reveals that this host is running AlmaLinux version 8.6.
Services
The Alma host has an SMTP server listening on TCP port 25. What IPv4 address is the SMTP service on the ALMA host listening on?
Hints
Is there a command to view listening ports?
Listening ports will have a state of LISTEN.
Ports assigned to an IPv4 address will have a proto of tcp. IPv6 will have a proto value of tcp6.
Answer
0.0.0.0
You can view information about the services listening on port 25 with the netstat command.
sudo netstat -antp | grep ":25.*LISTEN"
TCP Ports
What is the lowest TCP port number listening on any interface on this system? Your answer should be a number.
Hints
What command lets you view listening ports?
Use the flags for numeric output and to show only TCP ports.
Answer
22
Explanation: You can obtain this information with the netstat command.
Kernel Settings
What is the numeric setting for address space layout randomization (ASLR) on the Alma host? Your answer will be an integer.
Hints
The setting for ASLR is called randomize_va_space.
It's in the kernel settings.
sysctl is useful for querying kernel settings, and the /proc/sys/ pseudo-filesystem also contains the settings.
Answer
2
ASLR is controlled by the kernel.randomize_va_space sysctl setting. You can view the setting using either of these commands:
cat /proc/sys/kernel/randomize_va_space
sysctl kernel.randomize_va_space
Failed Logons
What IP address was the source for the earliest failed logon attempt for the user named “trip” in the /var/log/secure.CTF file?
Hints
This file is an archived version of a secure log, which tracks things like authentication events.
grep is a good tool for searching logs.
IP addresses are included in many entries in the log.
Answer
10.50.7.100
Explanation: Failed logon attempts can normally be viewed with the lastb command or by viewing the "secure" logs in /var/log. Since this is an archived log, you can use grep to search it.
sudo grep -i trip /var/log/secure.CTF
Systemd Services
How many systemd unit files with “.service” in their name are currently in the “enabled” state?
Hints
The systemctl command can list all unit files.
The flag for that is list-unit-files
Using grep on the output would let you find only lines with “.service” and “enabled” on them.
Answer
29
Explanation:
systemctl list-unit-files | grep -c "\.service.*enabled"
NFS
How many file systems are being exported by this host via NFS?
Hints
Is there a command to view exported file systems?
You could also view the configuration file for NFS exports.
The command sudo exportfs will show you the currently exported file systems.
Answer
2
Explanation: Exported file system information can be found using the exportfs command or by viewing the contents of the “/etc/exports” file.
NFS Permissions
What subnet is allowed to mount the NFS exports from this host? Your answer should be in the form of a network address and subnet mask in “slash” notation, i.e. 1.2.3.4/16
Hints
The answer is in the output from the previous question.
Each entry in the “/etc/exports” file can have at least one network definition to allow access to that share.
The correct answer starts with "10" and ends with "/24"
Answer
10.50.7.0/24
Explanation: The allowed client addresses are in the second column of the “/etc/exports” file and the output of the exportfs command.
Permissions - SUID
One file in the /usr/lib directory has the SUID bit set. What is the full path of the file?
Hints
You'll need to "find" the file in the /usr/lib directory.
Remember that SUID has a value of 4, and SGID has a value of 2.
Be careful using the "-perm" flag to find the file! Don't do an exact match.
Answer
/usr/lib/polkit-1/polkit-agent-helper-1
The command sudo find /usr/lib -perm -4000 will reveal the one file with the SUID bit set.
File Ownership
What is the name of the group which owns the /var/log/lastlog file?
Hints
The ls command lists files and information about them.
You'll need to do a long listing.
Long listings use the -l flag.
Answer
utmp
The user and group which own the file are part of the long format output of ls.
ls -l /var/log/lastlog
Octal Permissions
What is the three-digit octal representation of the permissions on the /var/log/lastlog file? Your answer will be a three-digit integer.
Hints
The ls command lists files and information about them.
You'll need to do a long listing and add up the values.
The stat command also returns permission information.
Answer
664
The permissions for the file are part of the long format output of ls. You'll convert them by adding the values for the user, group, and others:
- read = 4
- write = 2
- execute = 1
sudo ls -l /var/log/lastlog
The stat command also return the (4-digit) octal permissions as part of its output.
sudo stat /var/log/lastlog
Auditd
How many auditd rules are operating on the Alma VM? Your answer should be an integer.
Hints
You'll need to list the active rules on the system.
There is a command which is used to control auditd that will be useful.
It's called auditctl.
Answer
0
There are no auditd rules on a system by default. It appears that the administrators have not added any to this host.
sudo auditctl -l
User Account Defaults
What is the default maximum password age in days which will be applied to new accounts created on the Alma VM? Your answer will be an integer.
Hints
While the maximum password age for existing users is in /etc/shadow, the default settings for new users are stored elsewhere.
There is a file in the /etc directory with default values for new login accounts.
It has a value called PASS_MAX_DAYS.
Answer
99999
The maximum password age for new accounts is defined in the /etc/login.defs file. The setting is called PASS_MAX_DAYS.
The answer is available with this command:
grep 'PASS_MAX_DAYS' /etc/login.defs
Local Groups
How many total groups are there on the Alma VM? Your answer will be an integer.
Hints
There's a file in the /etc directory with the information you need.
Its name is obvious when you think of it.
The word count (wc) command is good for counting lines in a file.
Answer
52
The /etc/group file lists all the groups on the system, similarly to the passwd and shadow files for users. You can count the lines in a file using the wc (word count) command.
cat /etc/group | wc -l
User Accounts
One of the users on the Alma Linux server has some suspicious settings in the /etc/passwd file. What is the username with the unusual settings?
Hints
Look at all the columns in the passwd file.
Pay special attention to the user ID column.
Is there a user with a repeated user ID?
Look for users with an id equal to zero.
Answer
noaccess
Explanation: The user "noaccess" has user and group IDs of 0000. This is the same as root.
Password Hashes
What is the password hash of the account identified in the question above? Enter the entire hash and salt. It will start with "6" and end at the next colon. Do not enter any of the colons from the shadow file.
Hints
The hash is the second column in the shadow file.
It ends with the characters "adZ1"
Be sure to leave off any colons or password settings from the shadow file.
Answer
6kIlxjs/K$6/hztxQKCJr7QBGqyOZDJI.O9gXhOPolQi8mbdOgEG.Ifs62hhiVn16x7GN1yF7ApYNs01q7bFLoa23.MYadZ1
Explanation: The password hash is the second column in the /etc/shadow file.
OSQuery & Fleet
The questions in this section can be answered using OSQuery and its related tools, like Fleet DM. Some questions are for the Windows VM and some are for the Ubuntu VM.
Create and run queries either in the Fleet DM web UI, or using the osqueryi command on the VMs. Remember that you can exit osqueryi with the .quit command.
For the Ubuntu VM, some queries may require root privileges, but most will not.
Win10 - Program Version
What is the version number reported by OSQuery on the Windows VM for the SoapUI program? Your answer will be three numbers separated by dots.
Hints
The programs table has information about installed programs.
That table has a column named version.
The version number starts with a '5'.
Answer
5.7.0
The answer can be obtained by querying the programs table in OSQuery.
select name, version from programs where name like '%soap%';
Win10 - Package Version
SetDefaultBrowser, a utility to manage the default browser on Windows systems, has been installed on the Windows VM using the chocolatey package manager. What does OSQuery report as the version of SetDefaultBrowser installed by chocolatey? Your answer will be three integers separated by dots.
Hints
Terraform may not appear in the programs table!
It was installed as a chocolatey package.
There is a table specifically for "chocolatey_packages".
Answer
1.5.0
This question can be answered by querying the chocolatey_packages table.
select name,version from chocolatey_packages where name like '%setdefault%';
Win10 - Firefox Addons
The Windows VM has the FoxyProxy Firefox addon installed to allow fast switching of proxies during web application testing. What is the addon "identifier" which OSQuery reports for this addon? It will look similar to an email address.
Hints
The identifier for each addon is unique.
There is a table for Firefox addons.
Answer
The addon identifier is stored in the firefox_addons table in the identifier column.
select name, identifier, version from firefox_addons;
Win10 - SSH Keys
What does OSQuery report as the numeric value of the encrypted field for the SSH key for the Alma VM, which has "almakey" as part of its file path? Your answer will be an integer.
Hints
OSQuery associates SSH keys with users
You may need to study the OSQuery schema to find the right table
The .tables command will give you a list of all tables in the database
Answer
1
SSH keys for users are stored in the user_ssh_keys table.
select * from user_ssh_keys;
Ubuntu - Sudoers
OSQuery's sudoers table on Ubuntu has only one entry which has a header of %sudo. What is the contents of the rule_details column for this entry. Include the full contents of the column, including any punctuation marks.
Hints
The sudoers table is not accessible by the student user from the osqueryi command line.
The root user CAN access it.
The Fleet DM web UI can query it also.
Answer
ALL=(ALL:ALL) NOPASSWD:ALL
The contents of the sudoers table is only available to root. Using Fleet's web interface, or running OSQuery as root, allows you to see the data using this query:
select * from sudoers;
Ubuntu - Authorized Keys
What is the value of the comment column returned for the only SSH authorized key stored for the student user in the OSQuery database on the Ubuntu VM?
Hints
Authorized keys for SSH are included in their own table. The user has access to it, so don't run osqueryi as root!
That table has a comment column
On the Ubuntu VM, it has only one entry
Answer
The authorized keys for users are exposed by OSQuery in the authorized_keys table. The comment portion of an authorized key often looks like an email address, identifying the user and system which created the key.
select comment,key_file from authorized_keys;
Ubuntu - Docker
What does OSQuery report for the tags column associated with the nodejsscan docker image which is saved on the Ubuntu VM? Your answer should include the entire column contents, including numbers, letters, colons, slashes and dots.
Hints
What table has information about docker images?
That table has a tags column
"nodejsscan" will be part of the tag
Answer
opensecurity/nodejsscan:5x7.22.1
The docker_images table has information about the locally stored docker container images.
select * from docker_images;
Ubuntu - Hosts
What IPv4 address does OSQuery report is associated with the hostname esxi1 in the Ubuntu VM's host file?
Hints
The hosts file in Linux is stored in the /etc directory
OSQuery has a table for the contents of the /etc/hosts file
That table has the same information as the source file on disk
Answer
10.50.7.31
The Linux /etc/hosts file is exposed by OSQuery in the etc_hosts table.
select * from etc_hosts where hostnames='esxi1';
Ubuntu - Mounted Filesystems
How many mounted filesystems of type ext4 does OSQuery report for the Ubuntu VM? Your answer will be an integer.
Hints
There is a table for mounted filesystems
It has a LOT of filesystems listed, because the Ubuntu VM has a lot of them mounted
A where clause could be helpful here
Answer
1
The mounts table has information on mounted filesystems.
select device,type,path from mounts where type='ext4';
Or simply,
select count(device) from mounts where type='ext4';
Ubuntu - Root Mount
What does OSQuery report as the device column for the ext4 filesystem mounted to the root (/) directory on the Ubuntu VM? Include the full device path, including slashes, letters and numbers.
Hints
You'll query the same table for this question as you did in the previous question about mounted filesystems
You could you a where clause for a path of '/'
Or just look at every ext4 filesystem
Answer
/dev/sda2
The Ubuntu VM uses Logical Volume Management for its root partition. The virtual device name can be obtained with this query:
select device,type,path from mounts where path ='/';
Cloud Services
This module requires you to query information from the AWS lab range you used during the course labs. The credentials you received from your instructor will work for these challenges, as well. If you have already run aws configure on your course VMs, you'll be ready to go!
If you wish to use the PowerShell module for AWS, remember to run
Import-Module AWSPowerShell.NetCore
To validate your access, you can run the following command and ensure that it returns valid JSON data.
aws sts get-caller-identity
If you are not able to retrieve data from AWS, contact your instructor or teaching assistant for help before proceeding.
For questions which request property values, DO NOT include any quotation marks from your command output.
IAM - Users
How many IAM users are provisioned in the AWS account?
Hints
You need to get a list of IAM users and count them
The aws iam command can help you
Is there a subcommand to list users?
Answer
8
You can get the list of users with either PowerShell or the AWS CLI.
aws iam list-users | jq '.Users[].UserName'
Get-IAMUsers | Measure-Object
IAM - Password Policy
What is the minimum password length for IAM users in this AWS account? Your answer will be an integer.
Hints
The minimum password length is part of the password policy
The aws iam command gives you information about IAM settings
Find the subcommand to get the password policy and use it
Answer
8
You can review the MinimumPasswordLength property for the password policy using either the CLI or PowerShell.
aws iam get-account-password-policy
Get-IAMAccountPasswordPolicy
IAM - Attached Policies
One user in the AWS account has an account name which begins with "JAllen". That user has an IAM user policy attached directly to their user account (not through a group or role). What is the name of the attached policy for that user? Your answer will be the contents of the PolicyName property for the policy.
Hints
Remember that the full username will not be "JAllen," since there's a random string at the end of many of the AWS objects we provision for the course. Find the correct username first.
Use the CLI or PowerShell to get a list of attached policies for the user
aws iam has a subcommand to list attached user policies for a user
Answer
AWSSupportAccess
The policy name for attached user policies can be obtained with either of these commands:
$username = (Get-IAMUsers | Where-Object UserName -like "JAllen*").UserName
aws iam list-attached-user-policies --user-name $username
$username = (Get-IAMUsers | Where-Object UserName -like "JAllen*").UserName
Get-IAMAttachedUserPolicies -UserName $username
S3 - Buckets
How many S3 storage buckets have been provisioned in the AWS account? Your answer will be an integer
Hints
Simply list the buckets and count them
The aws s3 command has a different format for subcommands than some other CLI commands
Is there an option to list the buckets?
Answer
4
You can see the S3 buckets with the CLI or PowerShell
aws s3 ls
Get-S3Bucket
S3 - MFA Delete
How many of the S3 buckets have MFA Delete enabled? Your answer will be an integer.
Hints
We find this one to be easiest to answer using PowerShell
Piping the output from Get-S3Bucket into another cmdlet can work well
Is there a cmdlet to get versioning information for S3 buckets?
Answer
0
The PowerShell pipeline can be used to check the settings for all buckets.
Get-S3Bucket | Get-S3BucketVersioning
S3 - Tags
One of the S3 buckets in the AWS account has a name which begins with "s3-website-test.aud1.com-" followed by a random string. How many tags are attached to that bucket?
Hints
Start by getting the full bucket name
Is there a command to get bucket tagging?
Remember that a single tag consists of a key=value pair
Answer
1
After obtaining the bucket name, you can query for the tags associated with the bucket.
$bucketName = (Get-S3Bucket | Where-Object BucketName -like "s3-website-test.aud1.com*").BucketName
Get-S3BucketTagging -BucketName $bucketName
EC2 - Instance Size
One of the EC2 instances in the AWS account has a Platform property value of "Windows". What is the value of the InstanceType property for that EC2 instance? Include any letters and dots in the property value.
Hints
Only one of the instances has the Platform property set
It's the Windows domain controller you queried during the Active Directory exercises
Simply find the InstanceType property for that instance
Answer
m5.large
This property is easily visible using either the CLI or PowerShell
(Get-EC2Instance).Instances | Where-Object Platform -eq "Windows"
aws ec2 describe-instances | jq '.Reservations[].Instances[] | {Platform:.Platform, InstanceType:.InstanceType}'
EC2 - IMDS
What number of EC2 instances in the AWS account require the use of Version 2 of the Instance Metadata Service (IMDSv2)? Your answer will be an integer.
Hints
What command gets information about EC2 instances?
The MetadataOptions property for EC2 instances has information about IMDS
IMDSv2 requires the use of HTTP Tokens
Answer
0
The MetadataOptions property for an instance has a property named HttpTokens which tells you whether IMDSv2 tokens are required.
(Get-EC2Instance).Instances.MetadataOptions
EC2 - Tags
One of the EC2 instances in the AWS account has a tag whose Key value is SpecialTag. What is the Value property for that tag?
Hints
Tags are key=value pairs
Every instance can have its own tags
Search for a tag with a Key of "SpecialTag"
Answer
ClayWasHere
You can view the tags for instances with these commands:
aws ec2 describe-instances | jq '.Reservations[].Instances[].Tags'
(Get-EC2Instance).Instances.Tags | Where-Object Key -eq "SpecialTag"
EC2 - VPC Count
How many virtual private clouds (VPCs) exist in the AWS account?
Hints
Find a command to list the VPCs
VPCs are managed by the EC2 service
Simply count the number of results returned
Answer
3
You can see the VPC with either of these commands:
aws ec2 describe-vpcs | jq '.Vpcs[].VpcId'
Get-EC2Vpc
EC2 - VPC
One of the EC2 VPCs has a CIDRBlock property value of 10.55.0.0/16. What is the text value of the IsDefault property for that VPC? The answer is case-insensitive.
Hints
The default VPC is created when the AWS account is created
Any new VPCs created will not be the default
Find a command to get EC2 VPC information to find the answer
Answer
False
You can find the property value with these commands:
Get-EC2Vpc | Where-Object CidrBlock -eq '10.55.0.0/16'
aws ec2 describe-vpcs | jq '.Vpcs[] | {CIDR: .CidrBlock,IsDefault: .IsDefault}'
EC2 - Security Group Rules
One of the EC2 security group rules for the AWS account has a ToPort value of 22. What is the CidrIpv4 property value for that rule? Include the full network address, including any numbers, dots and slashes.
Hints
Security group rules are handled by the EC2 service
Find a command to get security group rules
Only one rule has a ToPort of 22
Answer
0.0.0.0/0
You can view the security group rules with these commands:
aws ec2 describe-security-group-rules | jq '.SecurityGroupRules[] | {ToPort: .ToPort, CidrIpv4: .CidrIpv4}'
Get-EC2SecurityGroupRule | Where-Object ToPort -eq 22
Web Applications
This module requires that you dig into the security and configuration of a web application. All of the questions found in this section can be answered by both analyzing the application in question and by applying the techniques and tools discussed during the Web Applications section of the course.
The web application that you will be asked to analyze is found on the Ubuntu VM.
WackoPicko, the web application used for the majority of these questions, is located at http://10.50.7.23
General
What is the IP address of the WackoPicko web application? Include just the IP address, and not the URL (leave out the "http://" and any slashes or port numbers).
Hints
The address is given in the section introduction.
The address is given in the section introduction.
The address is given in the section introduction.
Answer
10.50.7.23
Explanation: The address is given in the section introduction.
Website Title
Please access the IP address of the WackoPicko web application using a web browser. When that page appears, the answer to this question is the complete title that appears at the top of the web page.
Hints
The answer is in the title of the browser tab.
It's also at the top of the page.
It's also between the "title" tags in the source code
Answer
WackoPicko.com
Explanation: Once the Ubuntu server is running, you simply need to access the web application to see what the title bar says: http://10.50.7.23
Server Headers - Kubernetes
What is the version number of the Nginx server providing your access to the Wacko Picko server? Your answer should be three numbers separated by dots. i.e. X.Y.Z
Hints
Remember the server header.
You can examine it with a proxy or with other tools.
It starts with "Server:" and ends with "(Ubuntu)"
Answer
1.18.0
Explanation: Capturing the headers with a proxy will allow you to see the server header:
nginx 1.18.0 (Ubuntu)
Server Headers - Apache
Like most of the web applications in your lab environment, WackoPicko is running in a container on a Kubernetes cluster, with Nginx used to "load balance" (proxy)the service to the lab network.
The Kubernetes service is running on TCP port 30023. What is the version number of the Apache server hosting the Wacko Picko server in Kubernetes?
Your answer should be three numbers separated by dots. i.e. X.Y.Z
Hints
Remember the server header.
You can examine it with a proxy or with other tools.
It starts with "Server:" and ends with "((Ubuntu))"
Answer
2.4.7
Explanation: Capturing the headers with a proxy will allow you to see the server header:
Server: Apache/2.4.7 ((Ubuntu))
Hidden Content
There is a hidden form field on the home page that is generated by a script. What is the name of the hidden field? Do not include any quotation marks around the field name.
Hints
To view hidden content, you must examine the source code of the page.
Use the "find" tool to look for the content you want.
The field you want is of type=hidden.
Answer
MAX_FILE_SIZE
Explanation: This field can be found by searching the source code of the page for the word "hidden."
Authentication URL
What is the complete URL for the login page in the WackoPicko application? Your answer should include everything from the "http" to the very end of the URL!
Hints
Have you successfully opened the main page of the application?
Try clicking on the "login" tab.
What is the URL in the browser URL bar?
Answer
http://10.50.7.23/users/login.php
Explanation: Simply click on the "Login" button and view the URL.
Authentication HTTP Method
Which HTTP method is used to submit the credentials when a user logs in?
Hints
You can find the answer by viewing the source code of the page.
Looking at the source code you could next search for "form" tags.
One of the form tags is for a search page, the other is for the login page. Make sure you're looking at the right one.
Answer
POST
Explanation: While on the login page, simply right-click and view the source code. Next, locate the FORM tag and take note of the METHOD that has been specified.
Authentication Input Type
Which input type is being used for the username field on the logon form?
Hints
You can examine the form more closely by viewing the source code of the page.
Looking at the source code, find the form that relates to the logon page.
The input type will be in quotation marks. You can identify the correct one by looking at the "name" value for the field.
Answer
TEXT
Explanation: While viewing the source code for the login page, locate the "Username" field. Within the INPUT tag, take note that the TYPE is set to TEXT.
Authentication Admin URL
What is the complete URL for the login page for administrators?
Hints
The admin login page is not the same as the normal login page.
There is a link at the bottom of any page that can take you here.
Don't forget to include the parameter in your answer; it is part of the complete URL.
Answer
http://10.50.7.23/admin/index.php?page=login
Explanation: To answer this question, you must take note that there is an "Admin" link in the footer of the page. If you click on that link, you will find yourself at the Admin login page.
Authentication Attacks
The administrator's username is "admin". What is the administrators password?
Hints
Did we see any tools that can be used to brute force passwords?
You *could use the fuzzer (intruder) in Burp to try to brute force the password.*
Alternatively, you could try guessing manually... Can you come up with four or five really bad passwords?
Answer
admin
Explanation: Either brute forcing or good guessing will get you the answer to this question.
Fuzzing
To answer this question, you must have a registered username on the application and be logged in.
What is the LOWEST valid ID number for a photo which can be accessed using this URL:
http://10.50.7.23/pictures/view.php?picid=10
Your answer should be a positive integer
Hints
The "picid" parameter in the URL is the ID number for the photo being accessed.
Is there a tool you could use to try multiple values for this ID to see which ones are valid?
The Burp Intruder is built for this.
Answer
7
Explanation: While you could answer this one by guessing, the Burp Intruder tool is built for this sort of fuzzing attack.
XSS Defined
What does XSS stand for? Your answer should be three separate words; no dashes!
Hints
This is simply a definition.
Answer
Cross Site Scripting
Explanation: This is simply a definition. XSS stands for Cross-Site Scripting.
Guestbook XSS
For this question you will first need to register an account for yourself on the website. After doing so, log in and visit the Guestbook page.
One of the form elements below the blue bar is vulnerable to a XSS flaw. What type of input field is it? In other words, what is the HTML tag type used for this input?
Hints
Experiment by sending a XSS test to each field.
A good string to use is <script>alert(1)</script>
Once you find the field, view the source code of the page to determine the input type of that field.
Answer
TEXTAREA
Explanation: The first task is to locate the vulnerable field. After trying to insert script into each field, you should find that the large comment area is vulnerable. Now that you have found this, simply view the source code and identify the HTML for this field. This will reveal that it is a TEXTAREA.
Login XSS
Something on the login page is vulnerable to XSS. After you find an injectable parameter, check the source code of the web page and identify the "id" value for this field. Your answer should be only the ID value, not the surrounding quotation marks.
Hints
A good (and simple) way to quickly test for XSS is to attempt to send <script>alert(1)</script> in each form element.
Remember that some modern browsers will make it appear that you are not vulnerable. You may need to view the source code of the returned page to verify.
To determine the ID of the form element that is vulnerable you must first find the vulnerability and then view the source code of the original page.
Answer
query2
Explanation: The simplest way to find this is to either manually insert the XSS test into each field sequentially or to use the repeater in Burp to successively replace the various inputs in a sample request until you see your script tag returned in the response.
The vulnerable field is <input id="query2" name="query" size="15" style="padding: 2px; font-size: 16px; text-decoration:none;border:none;vertical-align:middle;" type="text" value=""/>