Dreamhack - palm
해당 문제는 Dreamhack의 palm 문제에 대한 풀이입니다. 이번 문제에서는 개발자 PC가 악성 코드에 감염되어 있으며,로그인 시마다 네트워크를 통해 민감한 로그인 정보가 유출되는 상황을 분석해야 한다.악성 코드가 개발자 PC에 침투하여 로그인 시마다 네트워크로 정보 유출침투 방식: 중앙 서버 → 개발자 PC목표: 악성 코드 분석 및 침투에 사용된 파일 탐색Flag 찾기먼저 현재 실행 중인 프로세스를 확인하여,의심스러운 프로세스가 존재하는지 점검했다.특별히 이상한 프로세스는 발견되지 않음.따라서, 네트워크 연결을 분석하는 방식으로 접근하기로 결정했다. 리눅스 환경에서 netstat과 ss 같은 명령어들이 설치되어 있지 않아대신 /proc/net/tcp와 /proc/net/udp 파일을 직접 분석했다..
Cyberdefenders - Szechuan Sauce Lab
해당 문제는 CyberDefenders의 Szechuan Sauce Lab 문제에 대한 풀이입니다.1. Case Overview: Your bedroom door bursts open, shattering your pleasant dreams. Your mad scientist of a boss begins dragging you out of bed by the ankle. He simultaneously explains between belches that the FBI contacted him. They found his recently-developed Szechuan sauce recipe on the dark web. As you careen past the door frame you are a..
OpenWire Blue Team Lab
해당 문제는 CyberDefenders의 OpenWire문제에 대한 풀이입니다.1. Challenge descriptionDuring your shift as a tier-2 SOC analyst, you receive an escalation from a tier-1 analyst regarding a public-facing server. This server has been flagged for making outbound connections to multiple suspicious IPs. In response, you initiate the standard incident response protocol, which includes isolating the server from the netw..
BlueSky Ransomware Blue Team Lab
해당 문제는 CyberDefenders의 BlueSky Ransomware문제에 대한 풀이입니다.1. Challenge descriptionAs a cybersecurity analyst on SecureTech's Incident Response Team, you're tackling an urgent case involving a high-profile corporation that suspects a sophisticated cyber attack on its network. The corporation, which manages critical data across various industries, has experienced a ransomware attack, leading to the en..
PsExec Hunt Blue Team Lab
해당 문제는 CyberDefenders의 PsExec Hunt문제에 대한 풀이입니다.1. Challenge descriptionOur Intrusion Detection System (IDS) has raised an alert, indicating suspicious lateral movement activity involving the use of PsExec. To effectively respond to this incident, your role as a SOC Analyst is to analyze the captured network traffic stored in a PCAP file.Q1.In order to effectively trace the attacker's activities ..
WebStrike Blue Team Lab
해당 문제는 CyberDefenders의 WebStrike문제에 대한 풀이입니다.1. Challenge descriptionAn anomaly was discovered within our company's intranet as our Development team found an unusual file on one of our web servers. Suspecting potential malicious activity, the network team has prepared a pcap file with critical network traffic for analysis for the security team, and you have been tasked with analyzing the pcap.Q1..