Tag Archives: 2015

The “No Pictures” Policy

We, @ AACC always enforce a strict no pictures policy @ qualifiers, until its over. Then we enforce a no social media policy. Here’s why…

After qualifiers I went searching through social media and turned up a couple posts regarding MACCDC Qualifiers. This was one of those posts I found from a competing school:

This picture was taken before qualifiers began and was posted before they began. The caption read “Ready for this…”

Ready for this...
Ready for this…

The problem is what’s in the background:

Passwords on the whiteboard!!!!!

4URedSucksTeam
4URedSucksTeam

What other information can we see?

Listing Roles & Chain of Command, from Mubix's "How to Win CCDC" Presentation.
Listing Roles & Chain of Command, from Mubix’s “How to Win CCDC” Presentation.

WiFi networks @ your school:

WiFi Networks
WiFi Networks

We can almost read the Sticky Notes on the desktop:

Sticky Notes
Sticky Notes

After the competition, it becomes a little more revealing:

After
After

Lets zoom in on each piece: Enhance…. Enhance… Enhance…

A printed slide from Mubix's "How to win CCDC" presentation.
A printed slide from Mubix’s “How to Win CCDC” presentation.

Which tools are they using:

Another printed slide from Mubix's "How to win CCDC" presentation.
Another printed slide from Mubix’s “How to Win CCDC” presentation.

Looks like PBX to me:

root_at_10-10-10-110
root@ip-10-10-10-110:

MySQL service won’t stay started: (More on this in a future post.)

service mysql start
service mysql start

Crème de la Crème: Moar Passwords!!!!

Moar Passwords
Moar Passwords

This post is not meant to make fun of or point out any flaws in any one person. This post is to bring awareness to the rest of the BlueTeam community that seemingly harmless photos can sometimes be too revealing.

Personally, I don’t even like posting pictures after the competition just in-case I make it to regionals and maybe nationals I don’t want to accidentally reveal any information to prying eyes.

As a team you should discuss whether or not you want to have a Pictures/Posting Policy and what it should be.

What are the policies at your school? What should they be?

Let see if the red-team can guess which school this was based on the passwords?

MACCDC 2015 – Badges

This year’s competition was called “Operation Transit Storm” and was based on public transportation. It was only fitting that our badges fit the same theme. Larry Pesce (@haxorthematrix) did the badges as he has done in years past.

Upon entering on Thursday we were each given a blue etched badge on a lanyard with a RFID card glue to the back of it, a RasberryPi B+, a 3 page manual(Derpypot 1.0 Instructions) and verbal instructions that “this is a honey pot to use it if you wish. The login name and operating instructions are in the packet but you’ll have to figure out the password to login.”

Our blue badges were completely etched with something base64 encoded. We were all instructed to move into the auditorium were we would be briefed on the following days schedule of events.

Blue Etched Badge
MACCDC2015 Blue Etched Badge

While waiting we took out our badges and plugged in the etching into a base64 decoder.

BASE64 Decode
BASE64 Decode

rootkitthenutwork.net??? was this a typo? We checked the DNS TXT records, for rootkitthenutwork.net and didn’t get anything. We tried rootkitthenetwork.net and got:

DNS TXT Record
DNS TXT Record

We tried navigating to both sites but neither had any pages published.

A quick googling using the half of the quote that was given to us yielded the other half quickly.

What do I care about law?
What do I care about law?

Later that night it was confirmed that one of the teams bought rootkithenutwork.net and stood up a page with false clues for solving the puzzle. I forget which school it was but I thought that buying the domain that morning was pretty good.

The next morning I approached Larry and asked did he intentionally throw us off with the typo “nutwork”. He said no and that who ever owns that domain was just having fun with us. The difference was in translating the encoding from the badge to the decoder. If you thought it was a “1” it came out ‘nutwork’ if you thought it was a lower case “L” it comes out ‘network’.

cm9vdGtpdHRoZW51dHdvcmsuY29tlGRucyB0eHQ=

cm9vdGtpdHRoZW5ldHdvcmsuY29tlGRucyB0eHQ=

On the Pi is Tom’s Honeypot.