CyberDefenders: Ulysses blueteam challenge.

Ulysses

SHA1SUM	b53238c60a72d6056dacff51ab041c9688553d07
Published	Oct. 19, 2020
Author	The Honeynet Project
Size	429M
Tags	Log Analysis Volatility Autopsy CVE

Instructions	Unzip the challenge (pass: cyberdefenders.org), investigate this case, and answer the provided questions. Use the latest version of Volatility, place the attached Volatility profile "Debian5_26.zip" in the following path volatility/volatility/plugins/overlays/linux, and verify the profile is listed there as in the following screenshot.

Your progress

0% Completed0/11 Questions

Your score

0/1100

Memory Image Forensics

Last solve

A Linux server was possibly compromised and a forensic analysis is required in order to understand what really happened. Hard disk dumps and memory snapshots of the machine are provided in order to solve the challenge.

Challenge Files:

victoria-v8.kcore.img: memory dump done by dd’ing /proc/kcore.
victoria-v8.memdump.img: memory dump done with memdump.
Debian5_26.zip: volatility custom Linux profile.

Supportive Tools:

#	Question	Weight	Solved
#1	The attacker was performing a Brute Force attack. What account triggered the alert?	50	80
Hint Report an issue

#2	How many were failed attempts there?	50	67
Hint Report an issue

#3	What kind of system runs on the targeted server?	50	64
Hint Report an issue

#4	What is the victim's IP address?	100	76
Hint Report an issue

#5	What are the attacker's two IP addresses? Format: comma-separated in ascending order	100	74
Hint Report an issue

#6	What is the "nc" service PID number that was running on the server?	150	70
Hint Report an issue

#7	What service was exploited to gain access to the system? (one word)	150	70
Hint Report an issue

#8	What is the CVE number of exploited vulnerability?	150	68
Hint Report an issue

#9	During this attack, the attacker downloaded two files to the server. Provide the name of the compressed file.	100	65
Hint Report an issue

#10	Two ports were involved in the process of data exfiltration. Provide the port number of the highest one.	100	69
Hint Report an issue

#11	Which port did the attacker try to block on the firewall?	100	50
Hint Report an issue