2018 Jiangsu Vocational College skills competition vocational group "information security management and evaluation" competition assignment

2018 Jiangsu Vocational College skills competition vocational group

“ Information security management and evaluation ” Event assignment

• Event time

9:00-13:30, total 4 One and a half hours , Including game questions 、 Winding time .

• Event information

Competition stage	Mission phase	Competition mission	Competition time	The score is
The first stage Platform construction and safety equipment configuration protection	Mission 1	Network platform construction	9:00-12:00	160
	Mission 2	Network security equipment configuration and protection		240
The second stage System security attack and defense and operation and maintenance security control	Mission 1	The file contains vulnerability attack and defense		100
	Mission 2	Web Penetration test		100
	Mission 3	ARP Protocol security attack and defense		100
	Mission 4	CTF		100
Midfield roll up			12:00-12:30
The third stage Group confrontation	System reinforcement		12:30-13:30	200
	System attack and defense

• Event content

This competition , All contestants need to complete the task in two stages , First of all 、 The second stage requires submission of tasks “ Answer template ” It needs to be stored in the... Specially provided by the referee team U Plate .

Players first need to be in U Create a file named... Under the root directory of the disk “xx Workstation ” Folder （xx Replace with specific station number ）, First in the competition 、 The two-stage completion task answer template document is placed in the folder .

for example ：08 Workstation , You need to in U Create a file in the root directory “08 Workstation ” Folder , And in “08 Workstation ” The document file of the first stage answer template is directly placed under the folder .

In particular ： Only those in the root directory are allowed “08 Workstation ” The primary station information is reflected in the folder , It is not allowed to reflect the station information again in other folder names or file names , Otherwise, it will be treated as cheating .

• Event environment settings

The event environment setting contains the basic information of three competition stages ： Network topology 、IP Address planning table 、 Device initialization information .

1. 1. Network topology

 

PC Environmental statement ：

PC-1（ Virtual machines in physical machines must be used ）：

Physical machine operating system ：Windows7 64 The flagship version

VMware Workstation 12 Pro

Virtual machine operating system ：Kali Linux（Debian7 64Bit）

Virtual machine installation service / Tools ：Metasploit Framework

The relationship between virtual machine network card and physical machine network card ：Bridge（ The bridge ）

PC-2（ Virtual machines in physical machines must be used ）：

Physical machine operating system ：Windows7 64 The flagship version

VMware Workstation 12 Pro

Virtual machine operating system ：Kali Linux（Debian7 64Bit）

Virtual machine installation service / Tools ：Metasploit Framework

The relationship between virtual machine network card and physical machine network card ：Bridge（ The bridge ）

PC-3（ Virtual machines in physical machines must be used ）：

Physical machine operating system ：Windows7 64 The flagship version

VMware Workstation 12 Pro

Virtual machine operating system ：Kali Linux（Debian7 64Bit）

Virtual machine installation service / Tools ：Metasploit Framework

The relationship between virtual machine network card and physical machine network card ：Bridge（ The bridge ）

1. 1. IP Address planning table

Equipment name	Interface	IP Address	interconnection	You can use IP Number
A firewall DCFW	Eth1	200.1.1.1/24	And PC-2 Connected to a	-
	Address pool	172.16.10.1	SSL VPN Address pool	10, Gateway is 254
	Eth2	192.168.2.2/24	And DCRS Connected to a	-
Wireless Switch DCWS	Eth16	192.168.66.253/24	And DCRS Connected to a	-
	Eth15	-	AP	-
WEB Application firewall WAF	Eth2	-	And DCRS Connected to a	-
	Eth3	-	And DCST Connected to a	-
Three layer switch DCRS	Vlan1 Eth1	192.168.11.254/24	And DCBI Connected to a	-
	Vlan2 Eth2	192.168.2.1/24	And DCFW Connected to a	-
	Vlan 10 Eth3	192.168.1.254/24	And WAF Connected to a	-
	Vlan 20 Eth4	192.168.20.254/24	And PC-1 Connected to the user area	-
	Vlan 30 Eth5	192.168.30.254/24	And PC-3 Connected to the user area	-
	Vlan 66 Eth6	192.168.66.254/24	DCWS	-
Network log system DCBI	Eth1	192.168.11.253/24	And DCRS Connected to a	-
Fortress server DCST	Eth1	192.168.1.100/24	And WAF Connected to a	-
PC-1	nothing	192.168.20.1/24	And DCRS Connected to a	-
PC-2	nothing	200.1.1.2/24	And DCFW Connected to a	-
PC-3	nothing	192.168.30.1/24	And DCRS Connected to a	-
Server scenario -1	nothing	See the problem section of system security attack and defense reinforcement
Server scenario -2	nothing	See the problem section of system security attack and defense reinforcement
Server scenario -3	nothing	See the problem section of system security attack and defense reinforcement
remarks	1. Game questions are available IP The address and network connection interface are shown in “IP Address planning table ”;

1. 1. Device initialization information

Equipment name	Management address	Default management interface	user name	password
A firewall DCFW	http://192.168.1.1	ETH0	admin	admin
Network log system DCBI	https://192.168.5.254	ETH0	admin	123456
WEB Application firewall WAF	https://192.168.45.1	ETH5	admin	admin123
Three layer switch	Baud rate 115200	Console	-	-
Wireless Switch DCWS	-	Console	-	-
Fortress server DCST	http://192.168.1.100	Eth1	See “DCST Login user table ”
remarks	Default management interface for all devices 、 management IP The address cannot be modified ; If you modify the default management of the corresponding device IP And management port , For questions related to this equipment, press 0 Sub processing .

• Phase I mission statement （400 branch ）

At this stage, you need to submit configuration or screenshot documents ( Answer template ), The naming is shown in the following table ：

Stage	Mission	Serial number	Document name
The first stage	Mission 1	1	Mission 1 ( Answer template )
	Mission 2	3	Mission 2-DCFW( Answer template )
		4	Mission 2-DCBI( Answer template )
		5	Mission 2-WAF( Answer template )
		6	Mission 2-DCRS( Answer template )
		7	Mission 2-DCWS( Answer template )

Mission 1： Network platform construction （160 branch ）

The requirements for platform construction are as follows ：

Question no	Network needs
1	According to the network topology diagram , according to IP Address parameter table , Yes WAF The name of 、 Each interface IP Address configuration .
2	According to the network topology diagram , according to IP Address parameter table , Yes DCRS The name of 、 Each interface IP Address configuration .
3	According to the network topology diagram , according to IP Address parameter table , Yes DCFW The name of 、 Each interface IP Address configuration .
4	According to the network topology diagram , according to IP Address parameter table , stay DCWS Create the corresponding VLAN, And classify the corresponding interface into VLAN, Yes DCWS Management of IP Address configuration .
5	According to the network topology diagram , according to IP Address parameter table , Yes DCBI The name of 、 Each interface IP Address configuration .
6	The internal network adopts static routing to realize the interconnection of the whole network .

Mission 2： Network security equipment configuration and protection （240 branch ）

DCFW:

1. In the head office DCFW Configure according to the meaning of the question Trust,Untruct,VPNhub Area , And configure the release strategy between regions ;
2. Configure the routing , Leading to internet Configure the default route in the specified direction , Use the next hop IP by PC2, Configure static main class summary routes for internal routes ;
3. Configuration dynamics NAT, The correspondence is as follows ：

VLAN20 The user map is 200.1.1.20;

VLAN30 The user map is 200.1.1.30;

1. The head office DCFW To configure SSLVPN, Build users dcn01, password dcn01, Connection required Internet PC2 You can dial in , The service port is 9998,VPN Users can access the wireless address segment ,SSLVPN See address table for address pool ;
2. Intranet wireless users need to pass real name authentication to access the Internet , Adopt export local certification , The account number is the group number , The password for 123.
3. In order to make rational use of export bandwidth resources, it is necessary to limit the Internet bandwidth of internal users , On weekdays 8:00 To 18:00 Wired users upload online / The download bandwidth is 1000K/2000K, The total export bandwidth of the park network is 200M.
4. In response to the net action of the network supervision office , It is required that wired users of the intranet web Control the outgoing content , It is forbidden to send keywords to web pages on the Internet “ reactionary ” And record relevant logs .
5. Find the inside first VLAN20 and VLAN30 A large number of users are connected to the Internet , As a result, it is very slow for intranet users to open external web pages, and sometimes they can't open , It is required to make corresponding settings on the firewall , Control the problem .
6. PC2 It can pass the address orientation of the external network port of the firewall DCST Of 80 port .

DCBI:

1. At the company headquarters DCBI On the configuration , The equipment is deployed in bypass mode , Add administrator account dcn2018, password dcn2018;
2. Add content rule , For website access, the keywords include “ violence ” Of , Record and email alarm ;
3. DCBI Configure applications and application groups “ The king of the world ”,UDP Protocol port number range 11111-11333, From Monday to Friday 9：00-18：00 monitor LAN Of all users in “ The king of the world ” Access records ;

WAF:

1. To configure WAF In transparent mode , Complete the interface bridging according to the meaning of the question ;
2. Create an audit administrator account , user name ：dcn2018, password ：201810dcn
3. To configure WAF When a malicious scanning website is found , take HTTP Redirect to http://www.dcn.com/alarm.html, Warn the attacker ;
4. New vulnerability scanning task dcn, Every day 9:00 scanning 192.168.1.100:80,SQL Inject , Cross site scripting ;

DCRS:

1. Configure the default route , Enable intranet users to access Internet;
2. Will connect DCFW Two way traffic is mirrored to Netlog To monitor and analyze ;
3. Turn on the anti-jamming device ARP Scanning function , Port received... In unit time ARP More than 50 It's considered an attack ,DOWN Drop this port ;
4. At the company headquarters DCRS Configure port loop detection on （Loopback Detection）, Prevent from vlan20 Single port loop under interface , The detection time interval when there is a loop is configured as 30 second , The detection interval when there is no loop is 10 second ;
5. To control access to the network PC, Need to exchange Eth1/0/10 Mouth open DOT1X authentication , Configure authentication server ,IP The address is 192.168.2.100,radius key yes dcn2018;
6. Switch on remote management , Use SSH The method account number is group number , The password for 123456.
7. VLAN20 Users use dynamic acquisition IP Address ,DHCP The server AC On the configuration .
8. Configure... On the switch , Only allowed in vlan30 Users access the wireless management segment during working hours IP.
9. For interception 、 Prevent illegal MAC Address and IP Address bound ARP Packet configuration is dynamic arp Detection function ,VLAN30 User network interface ARP The threshold is 50.

DCWS：

26.DCWS To configure VLAN110 To manage VLAN, AP Register dynamically to AC,AC management IP by 192.168.110.254; data VLAN by 111 and 222,vlan222 Related to SSID DCN, Issue network segments respectively 192.168.111.0/24,192.168.222.0/24, Gateway is the last available IP,DNS:8.8.8.8, The gateway needs to be excluded , The address is 2 God ;

27. To configure 2.4G Work under frequency band , Use 802.11g agreement ; Turn on AP Power failure escape function ;  

28. Set up SSID GUEST , The encryption mode is wpa-personal, The password is ：11111111,VLAN111;

29.GUEST Flow control for users under the network , The upside 1M, The downside 2M And turn on user isolation .

30. Through configuration, it is avoided that there are many access terminals and a large number of weak terminals , Avoid high-speed clients from being blocked by low-speed clients “ Drag on ”, Let the low-speed client not lose transmission for a long time ;

• Phase II mission statement （400 branch ）

Mission 1： The file contains vulnerability attack and defense （100 branch ）

                

Mission environment description ：

DCST：

Attack aircraft scene ：18fipc

Attack machine scene operating system ：WindowsXP

Attacker scenario installation service / Tools 1：apache2.4+php5.4+mysql Integrated environment （phpstudy）

Attacker scenario installation service / Tools 2：firefox Browser and hackbar plug-in unit

Server scenario ：18fileinclude

Server scenario operating system ：Microsoft Windows Server 2003

Server scenario installation services ：apache2.4+php5.4+mysql Integrated environment

Task content ：

1. use 18fipc visit DCST Medium 18fileinclude（ Press the target login interface five times shift obtain ip）, Verify that it has a local File Inclusion Vulnerability , Make the page contain C Under the packing directory flag.txt file , Also on url And flag Value for screenshot .
2. adopt php Input stream to find and view flag file （ The file name contains special characters ） Content , Also on url And flag Value for screenshot .
3. utilize php Stream reading is hidden in flag.php On the page flag value , Also on flag Value for screenshot .
4. utilize php Encapsulate the protocol to view zip.txt file , Also on url And flag Value for screenshot .
5. Exploit Remote File Inclusion Vulnerability to windows Write the name on the server exp.php The Trojan horse , And right at 18fipc File content created on and when included remotely url A screenshot .

Mission 2：Web Penetration test （100 branch ）

Mission environment description ：

DCST:

Attack aircraft scene ：hackerpc

Attack machine scene operating system ：WindowsXP

Attacker scenario installation service / Tools 1：sqlmap

Attacker scenario installation service / Tools 2：burpsuite

Attacker scenario installation service / Tools 3：firefox Browser and hackbar plug-in unit

Attacker scenario installation service / Tools 4： Chinese kitchen knife

Server scenario ：WEB2018

Server scenario operating system ：Microsoft Windows Server 2003

Server scenario installation services ：apache2.4+php5.4+mysql Integrated environment

Task content ：

1. from hackerpc visit DCST Medium WEB2018 Server's web page （ Access target , Press five times in the login interface shift Target machine is available IP）, Find the injection point and sql Injection attack , Get hidden in the database flag, And take a screenshot of the results .
2. Try to find the background of the website and log in , Get the flag value , And take a screenshot of the results .
3. Look for upload points with loopholes in the background , Write a one sentence Trojan horse and bypass the upload , Use the Trojan horse to check the uploaded directory in one sentence flag file , And take a screenshot of the results .
4. In a word, after the Trojan horse enters the server , Try to find the... Hidden in the administrator user boot folder flag file , And take a screenshot of the results .
5. There is a hidden user on this server , Try to find this hidden user from the registry ,flag The value is the user name of this user ,flag The format is flag{ Hide the user name }, And take a screenshot of the results .

Mission 3：ARP Protocol security attack and defense （100 branch ）

                

Mission environment description ：

PC-1：

Physical machine operating system ：Windows7 64 The flagship version

VMware Workstation 12 Pro

Virtual machine operating system ：Kali Linux（Debian7 64Bit）

Virtual machine installation service / Tools ：Metasploit Framework

The relationship between virtual machine network card and physical machine network card ：Bridge（ The bridge ）

PC-3：

Physical machine operating system ：Windows7 64 The flagship version

VMware Workstation 12 Pro

Virtual machine operating system ：Kali Linux（Debian7 64Bit）

Virtual machine installation service / Tools 1：ettercap

Virtual machine installation service / Tools 2：arpspoof

The relationship between virtual machine network card and physical machine network card ：Bridge（ The bridge ）

Multi layer switch ：

Switch operating platform ：DCRS-6200

Task content ：

1. stay PC-1 Physical machines and DCFW、PC-3 After interworking , see PC-1 Of ARP cache , And cache the information kali and DCFW Of ARP Cache some screenshots .（ The document should be marked PC-1、kali virtual machine 、DCFW Of ip And mac）
2. utilize PC-3 Of kali Virtual machine initiation ARP Spoofing Penetration test , send PC-1 Of ARP Cache as ：DCFW->PC-3 Of kali The virtual machine MAC Address , stay PC-1 Check the poisoned... On the physical machine ARP Cache information , And take a screenshot of this information .
3. utilize PC-3 Of kali Virtual machines do ARP Man in the middle penetration test , send kali Able to use wireshark Listen to the PC-1 Physical direction DCFW The user name submitted on the login page of 、 password , And take a screenshot of the penetration test process .
4. stay DCRS Switch configuration Access Management Feature block kali Virtual machine initiation ARP Spoofing Penetration test , And will DCRS Screenshot of the configuration information of the switch .
5. stay DCRS Switch configuration Access Management Under the condition of characteristics , To use again PC-3 Of kali Virtual machines are right PC-1 and DCFW Conduct ARP Spoofing Penetration test , here DCRS Switchboard Access Management Features can prevent PC-3 Of kali Virtual machines are right PC-1 and DCFW Conduct ARP Spoofing Penetration test , Look again PC-1 and DCFW Of ARP Cache information , And take a screenshot of this information .

Mission 4：CTF（100 branch ）

        Mission environment description ：

PC-1：

Physical machine operating system ：Windows7 64 The flagship version

VMware Workstation 12 Pro

Virtual machine operating system ：Kali Linux（Debian7 64Bit）

Virtual machine installation service / Tools ：Metasploit Framework

The relationship between virtual machine network card and physical machine network card ：Bridge（ The bridge ）

DCST:

Attack aircraft scene ：WinXP

Attack machine scene operating system ：WindowsXP

Attack aircraft scene ：BT5

Attack machine scene operating system ：BackTrack5

Server scenario ：CentOS

Server scenario operating system ：CentOS5.5

Server scenario installation services ：apache+php+mysql Integrated environment

Multi layer switch ：

Switch operating platform ：DCRS-6200

Task content ：

        stay DCST Upper BT5、WinXP、CentOS After interworking , stay WinXP and BT5 Medium visit CentOS Server's web page , Find the topic and get flag.

1. Topic 1 visit the server website 1.html, What is this , Just these symbols , I don't understand , Can you help Xiao Ming . Please find out flag,flag The format is flag{ Hide the user name }, And take a screenshot of the results .

1. Topic 2 visit the server website 2.html, Xiao Ming has a document , I don't know what it is , Can you help Xiao Ming . Please find out flag,flag The format is flag{ Hide the user name }, And take screenshots of key steps and results .

1. Topic 3 visit the server website 3.html, Xiao Ming received a picture , There is only one sentence about the picture “The secret is in this picture”, Can you help Xiao Ming . Please find out flag,flag The format is flag{ Hide the user name }, And take screenshots of key steps and results .