Categories
CTF's My CTF's

PowerGrid CTF

This is my second CTF exercise that I have developed. It is rated as ‘Hard’.

Download Now

Synopsis:

Cyber criminals have taken over the energy grid across Europe. As a member of the security service, you’re tasked with breaking into their server, gaining root access, and preventing them from launching their malware before it’s too late.

We know from previous intelligence that this group sometimes use weak passwords. We recommend you look at this attack vector first – make sure you configure your tools properly. We do not have time to waste.

Unfortunately, the criminals have started a 3 hour clock. Can you get to their server in time before their malware is deployed and they destroy the evidence on their server?

The types of vulnerability/techniques used in this CTF can be seen below (they are intentionally hidden by default):

Show More
  • Brute force
  • Pivoting
  • Network enumeration
  • Remote Code Execution
  • Privilege Escalation
  • GPG Decryption

This exercise is designed to be completed in one sitting. Shutting down the virtual machine will not pause the timer. After the timer has finished, the CTF machine will be shut down and you will be unable to boot it. Please keep a local backup of the CTF prior to starting, in case you wish to attempt a second time.

If you are to succeed, I strongly recommend reading these points:

  • Keep a local backup before starting in case you run out of time
  • You will need a basic understanding of the GPG tool and how it works
  • Configure your tools so they work at the maximum/hardest level possible. Make sure you are looping around the correct thing, if you know what I mean
  • Getting the initial shell is possibly the longest part.
  • There are four flags in total. Each flag file will guide you to the next area

This virtual machine has been tested in VirtualBox only. I cannot guarantee it will work on VMWare, but it should be okay.

You can download the CTF here. I look forward to your feedback.

SHA-256: 8bc79937082748c21de14c5da3772f7fc750d52b68cf27816922186f6e68d6b7
Version NumberDescription of ChangesDate of Change
1.0Initial release20/05/2020
1.1Stability release – changed some network settings to make this work correctly in non-VirtualBox setups26/05/2020
Categories
CTF's My CTF's

CTF Difficulty Levels

The level of difficulty for a capture the flag exercise is certainly subjective, so I have put together a matrix which describes the difficulty level for any CTF I create:

Difficulty TitleDifficulty Description
Very
Easy		Vulnerability types: SQL Injection, Brute Force, Software Exploits where exploit tools are readily available. Usually limited to a few exploits needed to get root access.
EasyVulnerability types: SQL Injection, Brute Force, Hash Cracking, Software Exploits where exploit tools are readily available.
May involve quite a few different exploits to obtain root access.
MediumVulnerability types: SQL Injection, Brute Force, Hash Cracking, XSS vulnerabilities. Software Exploits may not be readily available, or they are hard to get working. May involve experience in the tools available on Linux.
Will very likely have quite a few vulnerabilities which you will need to overcome to get root access.
HardVulnerability types: SQL Injection, Brute Force, Hash Cracking, XSS vulnerabilities, encryption issues, pivoting. Software Exploits may not be readily available, or they are hard to get working. Will likely involve experience in the tools available on Linux.
Will very likely have quite a few vulnerabilities which you will need to overcome to get root access. Exercise may be timed, and various defense mechanisms may be in place to make it harder to get root access.
Very
Hard		I am literally trying my best to prevent you from obtaining root access. You will need to be very experienced, and think outside the box.