ITX8063 2012

2012-12-04T18:55:38Z

Kasak: /* 04.12 VI */

ITX8063 2012 Results

2012-12-04T17:35:35Z

2012-11-27T18:55:19Z

Kasak:

* '''Last update: 06 Nov 2012 15:50'''

{| border=1 style="text-align:center; border-style: solid; border-width: 1px;"
| align="center" style="background:#f0f0f0;"|'''Student Code'''
| align="center" style="background:#f0f0f0;"|'''Practical Tasks (max 20)'''
| align="center" style="background:#f0f0f0;"|'''Lab Report (max 20)'''
| align="center" style="background:#f0f0f0;"|'''Bonus: Homework'''
| align="center" style="background:#f0f0f0;"|'''Bonus: Labs'''
| align="center" style="background:#f0f0f0;"|'''Bonus: Other'''
| align="center" style="background:#f0f0f0;"|'''Exam Time'''
| align="center" style="background:#f0f0f0;"|'''Exam (max 60)'''
| align="center" style="background:#f0f0f0;"|'''Total'''
| align="center" style="background:#f0f0f0;"|'''Grade'''
|-
| 121730IVCMM||||||||||||||||||
|-
| 114220IVCMM||||||10||||||||||||
|-
| 110956IVCMM||||||||||||||||||
|-
| 114224IVCMM||||||||||||||||||
|-
| 111610IVCMM||||||||||||||||||
|-
| 090202IAPMM||||||||||||||||||
|-
| 114221IVCMM||||||||||||||||||
|-
| 114381IVCMM||||||10||||||||||||
|-
| 114225IVCMM||||||10||||||||||||
|-
| 122363IVCMM||||||10||||||||||||
|-
| 110961IVCMM||||||10||||||||||||
|-
| 106939IVCMM||||||||||||||||||
|-
| 095539IVCMM||||||||||||||||||
|-
| 111799IVCMM||||||||||||||||||
|-
| 111609IVCMM||||||||||||||||||
|-
| 111505IVCMM||||||||||||||||||
|-
| 122792IVCMM||||||||||||||||||
|-
| 111605IVCMM||||||10||||||||||||
|-
| 121448IV||||||||||||||||||
|-
| 122347IVCMM||||||||||||||||||
|-
| 104704IAPMM||||||||||||||||||
|-
| 111601IVCMM||||||||||||||||||
|-
| 113485IVCMM||||||||||||||||||
|-
| 110958IVCMM||||||||||||||||||
|-
| 111262IABMM||||||||||||||||||
|-
| 111653IVCMM||||||10||||||||||||
|-
| 121996IVCMM||||||10||||||||||||
|-
| 111506IVCMM||||||||||||||||||
|-
| 111507IVCMM||||||||||||||||||
|-
| 111607IVCMM||||||||||||||||||
|-
| 110966IVCMM||||||||||||||||||
|-
| 111704IABMM||||||||||||||||||
|-
| 123112IVCMM||||||10||||||||||||
|-
| 111606IVCMM||||||||||||||||||
|-
| 111603IVCMM||||||||||||||||||
|-
| 113832IVCMM||||||10||||||||||||
|-
| 122002IVCMM||||||||||||||||||
|-
| 111504IVCMM||||||||||||||||||
|-
| 113487IVCMM||||||10||||||||||||
|-
| 114222IVCMM||||||||||||||||||
|-
| 113490IVCMM||||||10||||||||||||
|-
|
|}

ITX8063 2012

2012-11-27T18:48:37Z

Kasak: /* 27.11 V */

ITX8063 2012 Homework

2012-11-27T13:17:23Z

Kasak: /* Description */

=Homework=

==Introduction==
* The homework is not mandatory.
* Expected solving time: up to 3 hours.
* Tools:
** [http://www.aircrack-ng.org/ aircrack-ng suite]: aircrack-ng, airdecap-ng
** [http://fbcdn.mooo.com/itx8063/resources/common-passwords.dic.bz2 Dictionary] for WiFi cracking
** [http://www.wireshark.org/ Wireshark]
** Media player with Ogg Vorbis Support [http://www.videolan.org/vlc/ link] [http://www.vorbis.com/setup/ link]
** [http://steghide.sourceforge.net/ Steghide]
* Scoring: up 10 points. Cheaters will get their overall course score multiplied by 0.
* Deadline: '''30 November 2012'''
* 1 minus point for every day the submission has delayed. '''Zero points''' after '''9 December 2012'''.
* Questions regarding the homework should be sent to ''mait.peekma[=at=]eesti.ee''

==Task==
You are working at a law enforcement agency. Your colleagues are hunting a huge group of bad guys who are hiding a cyberweapon at an unknown location. It is known that those bad guys are communicating to each other by hiding messages inside pictures on a popular public gallery and one of the pictures contain the address of the cyberweapon. A password is required to extract the hidden message from the picture file. Moreover, without that password it is not possible to tell whether the picture contains a hidden message or not. As the public gallery is very popular, it is not possible to identify whether the person who downloaded the picture was a member of the group or just an internet user. Your colleagues have captured a piece of encrypted WiFi traffic nearby one of the suspect's home. They believe that it contains a recording from an answering machine that contains the password to extract the hidden information.
Your task is to find the hidden information - the street address of hidden cyberweapon.

== Description ==

# Grab the [http://fbcdn.mooo.com/itx8063/resources/pcap/ .pcap file] that contains the encrypted WiFi traffic. Examine the file using Wireshark, find the SSID of the AP.
# Use [http://www.aircrack-ng.org/doku.php?id=aircrack-ng#usage aircrack-ng] and a [http://fbcdn.mooo.com/itx8063/resources/common-passwords.dic.bz2 dictionary] to brute-force the WiFi password.
# Decrypt the .pcap file using [http://www.aircrack-ng.org/doku.php?id=airdecap-ng airdecap-ng]
# Open the decrypted .pcap file using Wireshark. The file contains some HTTP traffic including an audio file (.ogg). Try to extract the audio file (File -> Export -> Objects -> HTTP -> ...) It might have happened that a number of packets are missing and the audio file is corrupted. In this case: try to grab the audio file from its original URL.
# The audio file contains a password. The criminals have read [http://xkcd.com/936/ a comic] and used a [http://fbcdn.mooo.com/itx8063/resources/passwdgen/ password generator], thus the password contains exactly four english words separated by spaces.
# The [http://fbcdn.mooo.com/itx8063/gallery/ gallery] has 256 images. One of them contains a hidden secret message that can be decrypted using the password found in the previous step. The message has been encrypted and hidden inside the image using Steghide. Find the image - you might need to download all the files (script it if you can!) and extract the hidden message that contains a street address.
# Write a report and send it to ''mait.peekma[=at=]eesti.ee'' by 30 November 2012. The report (PDF) must be written in english and must contain:
## '''Update 13 Nov''': Your full name and student code.
## The SSID name of the access point. The WiFi encryption that was used (WEP, WPA, WPA2, ...) (2 points). '''Update 3 Nov''': Describe how did you identify the encryption method.
## Description how the WiFi password was found and how the file was decrypted (aircrack-ng and airdecap-ng commands and the results) (2 points).
## Description how the audio file was extracted or downloaded (if it was corrupted) and what was the 4 word password (2 points).
## What is steganography? Using your own words, no less than 15, no more than 20 words (2 points).
## Description how the image was found and how the the secret message was extracted (steghide command and the result), what is the hidden message (2 points). '''Update 3 Nov''': What is the name of the image file that contains the secret message?
'''Update 13 Nov''': I expect well formatted and structured reports from master level students.

ITX8063 2012 Homework

2012-11-27T13:12:51Z

2012-11-20T20:43:52Z

Kasak: /* BackTrack5 VM in Lab */

= Access =
* The environment (Lab) used for the practical tasks is not running in classroom but in another private network accessible over the VPN.
* [[Pilt:ITX8063.Lab.jpg|500px| Lab Network]]
* Every student has a private [http://www.backtrack-linux.org| BackTrack] virtual machine which has to be used for accomplishing the tasks.
* The environment (Lab) used for the practical tasks is not running in TUT classroom but in another private network accessible over the VPN.
* There are 2 possible ways to access the BackTrack5 VM in Lab:
** Classrooms IT-213A, IT-213B will be connected with Lab over site-to-site VPN.
** Every student has to setup an OpenVPN connection to access the BackTrack VM running in Lab from his/her own computer.

== Setup OpenVPN on your own machine to access the Lab ==
# Download:
#* [[Meedia:ITX8063_2012.tar.gz.bf.gz | ITX8063_2012.tar.gz.bf.gz]]
# Unzip the configuration (lambda.ee limits filetypes that could be uploaded so we had to zip after encryption...)
#* gunzip ITX8063_2012.tar.gz.bf.gz
# Decrypt the configuration:
#* openssl enc -bf -d -in ITX8063_2012.tar.gz.bf -out ITX8063_2012.tar.gz
#* The password for the key has been provided in classroom and in ivcm11 e-mail list.
# Install OpenVPN to your machine and run the configuration provided. E.g. when using ubuntu:
#* apt-get install openvpn
#* tar zxvf ITX8063_2012.tar.gz
#* cd ITX8063_2012
#* sudo openvpn itx8063.conf
#* The password for the key has been provided in classroom and in ITX8063 e-mail list.
# In case openvpn is running correctly you should have received routes to networks 192.168.133.0/24 and 192.168.136.0/24

== BackTrack5 VM in Lab ==

* Each student is provided a BackTrack machine in lab for accessing and attacking the target systems.
* Each student is allowed to access only the machine with the IP specified below.
* Default username is '''root''' and password is '''toor'''. You would probably like to change it after first login...
* This VM shall be used only for completing the course exercises. All student machines and targets are running on same server - therefore be sure that you do not leave unnecessary processes running.

* NB! '''The IP addresses of the BackTrack machines in the lab are from subnet 192.168.133.0/24. This subnet conflicts with existing network in TTU network. Therefore when accessing the VMs from the TUT computer the IPs will be translated to addresses from 192.168.146.0/24.'''

<pre>

NAME ACCESSING FROM ACCESSING FROM TUT
OWN COMPUTER COMPUTER CLASS
OVER OpenVPN (IT-213A, IT-213B)

Agnes: 192.168.133.1 192.168.146.1
Aleksandr: 192.168.133.2 192.168.146.2
Alexander: 192.168.133.3 192.168.146.3
Andrejs: 192.168.133.4 192.168.146.4
Artjom: 192.168.133.5 192.168.146.5
Christopher:192.168.133.6 192.168.146.6
Davit Ag: 192.168.133.7 192.168.146.7
Davit Az: 192.168.133.8 192.168.146.8
Emre: 192.168.133.9 192.168.146.9
Erki: 192.168.133.10 192.168.146.10
Faris: 192.168.133.11 192.168.146.11
Fred: 192.168.133.12 192.168.146.12
Giorgi: 192.168.133.13 192.168.146.13
Giorgi: 192.168.133.14 192.168.146.14
Irakli: 192.168.133.15 192.168.146.15
Kristjan: 192.168.133.16 192.168.146.16
Levan: 192.168.133.17 192.168.146.17
Liivi: 192.168.133.18 192.168.146.18
Mai: 192.168.133.19 192.168.146.19
Manuel: 192.168.133.20 192.168.146.20
Marek: 192.168.133.21 192.168.146.21
Mina: 192.168.133.22 192.168.146.22
Märten: 192.168.133.23 192.168.146.23
Natalja: 192.168.133.24 192.168.146.24
Oleg: 192.168.133.25 192.168.146.25
Onur: 192.168.133.26 192.168.146.26
Pavel: 192.168.133.27 192.168.146.27
Ragnar: 192.168.133.28 192.168.146.28
Recai: 192.168.133.29 192.168.146.29
Rivo: 192.168.133.30 192.168.146.30
Sanjay: 192.168.133.31 192.168.146.31
Sarbar: 192.168.133.32 192.168.146.32
Sergei: 192.168.133.33 192.168.146.33
Sharath: 192.168.133.34 192.168.146.34
Sten: 192.168.133.35 192.168.146.35
Taavi: 192.168.133.36 192.168.146.36
Tanel: 192.168.133.37 192.168.146.37
Tiit: 192.168.133.38 192.168.146.38
Tiiu-Liisa: 192.168.133.39 192.168.146.39
Urmo: 192.168.133.40 192.168.146.40
Zhuoli: 192.168.133.41 192.168.146.41
Kuuno: 192.168.133.43 192.168.146.43
Dmitri: 192.168.133.44 192.168.146.44

</pre>

== Accessing BackTrack VM ==
* After the VPN has been correctly setup, the students can access BackTrack VMs over SSH or VNC

# Command line access: '''ssh root@192.168.133.X'''
#* Obviously, X denotes the number that has been allocated for specific student.
#* Default password is '''toor'''.
# X11 session redirected over SSH
#* '''ssh -X -C root@192.168.133.X'''
#* Now you can start programs with GUI e.g. firefox &. Note that it could be relatively slow.
# VNC for graphical user interface
#* Log into BackTrack VM over SSH and start vncserver: '''vncserver -geometry 1280x800'''
#* Obviously, the geometry specifies the screen size, adjust it according to your monitor
#* When executing vncserver first time, you will be asked for a password. This password just protects access to the display of your machine. Choose password that you prefer. The password file is /root/.vnc/passwd. If you would like to change the password, just remove that file and start vncserver again.
#* If you need to kill any vncserver instances: '''vncserver -kill :1'''. This kills X desktop number 1.
#* To access the display use vncviewer on your machine ('''not''' on the BackTrack): '''vncviewer 192.168.133.X:1'''. Number 1 expresses the display number.

== Course Management Application ==
* Presentation slides and other materials are available here ('''http!'''): http://cma.ex/files (http://192.168.136.5)
* Mission and task descriptions as well as scoreboard will be displayed over simple web application located here: https://cma.ex (https://192.168.136.5)
* Register a new user account. Username will be displayed on the scoreboard - this can be something anonymous
* First and Last Name will be used to track if you have participated in the lab - these have to be real.
* NB! Hacking the production version of scoreboard is prohibited.
** We will clone the VM for testing purposes to those who are interested in breaking the scoring system.
** If you find any vulnerabilities, report them to the instructor and you'll get bonus.

= Solving the Tasks =
== Task Descriptions ==
* As described previously, the task descriptions will be provided using simple web application '''which is accessible from your BackTrack VM''':
** https://cma.ex/
** https://192.168.136.5
* There is no password recovery functionality. If you forgot your password you have to contact the instructor for a reset.
* Please read the description of the task carefully. When specifying targets (IP addresses, domain names) avoid making typos.

== Hints ==
* When you do not have a good idea where to start or how to proceed, use the hints. There are specific buttons on the web application for that: Hints++ and Hints--
* Usually, the hints cost you points. The application will describe how many points the specific hint cost. After that you have to specifically confirm that you really want to use the hint.
* In terms of final grade for the course it is only important that you have accomplished the task. '''The amount of points you get for a task does not influence the grade'''. However, you should still firstly try to finish the task on your own and take the hints if you really do not know what to do...
* Sometimes the first hint does not cost anything. This will be said in task description. In this case you should always use the first hint to avoid wasting your time.

== Lab Report ==
* '''For every Task under each Mission you have to provide a short description of how did you solve it.''' Basically, you have to take notes and provide it in the end of the course to the instructor.
** Which tools did you use to solve the task?
** Which commands with which options did you executed?
** If the target was a web application, what requests did you send to the target to accomplish the mission?

* Lab Report has to be provided in the end of the course by '''TBD'''.

* The following general principles will be used for evaluating the reports:
** If you have description for all the tasks, you'll get 100% of points.
** If you solve most of the tasks just by using all the hints you will not get 100% of the points. However, if you use hints only for some tasks you will be still assigned 100%.
** Plagiarism will be not accepted. Previous year, few students were stupid enough to copy very original solutions from other students. Please do not take that way.