Learn, hack!

URL

http://events.ccc.de/congress/2005/fahrplan/attachments/562-Paper_HostingAHackingChallenge.pdf

File name

562-Paper_HostingAHackingChallenge.pdf

File size

65.1 KB

MD5

e7e283e6c52a73d43a9ae1c6af78adc5

SHA1

96efc8231a57e0a55e774a249db2dade3f30a545

The talk will give a deep view behing the scenes of creating a CTF-hacking challenge. Starting from a short analysis of requirements for such an event, the organizational work to be done, to the main topic: designing the actual contest and choosing the software to be hacked. This years CIPHER event was a larger hacking event for students from international universities. 14 teams gathered from four continents and fourteen countries to hack the other team's server and defend their own. The exercise is about hosting a server that initially runs multiple services, i.e. a webserver, a mail server and customized services. These have typical security vulnerabilities that allow to compromise the server. The goal is to maintain the services up and uncompromised for the duration of the game, scores are also given for exploiting weaknesses and gaining access to other team's servers. The contest was held within a VPN, to authenticate the teams and ensure that the contest will not leak 'surprises' on the remainder of the internet. The services were hosted on VMWare- images, so that the memory layout and starting conditions for each team were controlled and known to all participants. We will give an overview of the services used in the contest, how we build them and demonstrate the tools we used to run the contest. The main goal of the exercise was to teach students how to act in situations of constant pressure and ubiqituous insecurity. The skills to actively participate not only include programming languages but also system administration and knowledge about offensive techniques.