NCAE 2025

At 11:00 AM EST in the Northwest region, the UF NCAE team 2 gathered, and we began the day with laughter and joy. We divided the network into sections, and I was assigned the Ubuntu-based database with Postgres installed. This will be a fun experience for everyone sitting together.

The flags have raised, and the starter pistol fired, signaling the start of the engagement. We logged in to our respective machines and began system hardening, preparing for the incoming attacks from the red team.

Time is already ticking, we log in, 2 minutes already gone. Someone doesn’t have their credentials properly set up, that will take atleast 5 mins for them. we don’t have enought time to stop. I keep going, trying to connect to webservices. The router is down, I can’t update my packages.

Time flies away faster before the grace period ends, I find three user accounts with UID 0.

cat /etc/passwd | grep ":0:"
root
blackteam_r
no_one

“no_one” (get it? no one) should have root except me, we take their access away. sorry no_one. we set their /bin/bash to /dev/null no one is getting access

Time flows through sand, I am running out of time. I try to run IPTables. Bash error

iptables
Command 'iptables' not found

Firewall-d. Nothing UFW. Nothing. All firewalls compromised. I don’t have much time

sudo apt install iptables

Nothing printed, something is wrong. red team is getting closer.

In an act of desperation I use canonicals SNAP package system and get UFW installed. UFW requires IPtables Plan backfired. but what about curl. https://netfilter.org/projects/iptables/downloads.html

curl -O https://netfilter.org/projects/iptables/files/iptables-1.8.11.tar.xz

you can download IPTables from the web.

iptables -A INPUT -p 5432 -j ACCEPT
iptables -A OUTPUT -p 5432 -j ACCEPT
iptables -A INPUT -j DROP
iptables -A OUTPUT -j DROP

(Not all commands used listed)

after running those system commands, attackers already got into my system. I need to ignore them for now, and get our services up. After starting postgres we Nmapped the system and realized something is wrong within, Nmap is returning “filtered”

• Config Files Postgres has Configuration files. something happened to them. we discovered it to have mismatched ports. fixed.

Now its time to stop attackers

Working through the commands we discovered threat actor after threat actor

ss -tualn
ss -tulpn
tcpdump
who -u
ps -ejH

For now my system was safe, There were active threats online, but as systems were running, they become ignored. Web is having trouble, an hour and 30 minutes have passed, and not even the web port is running.

It took 15 minutes to find the error, a misconfiguration in the nginx server, where it was hogging the port, but couldn’t host the site.

Another 15 minutes gone, yet another misconfiguration found in the router, port 80 isn’t forwarded.

Defense is everything, IPTables installed on the webserver. Annoyance is best in the Postgres server for an hour and half we ran

import subprocess
while(True):
    subprocess.pfork("wall 'I love Red Team <3'")

Till the end we continued to defend our system, till the end

We lost all our systems except port 80, and the Router. Even with IPTables, both of my systems enacted were severely compromised, and the system keyboard, changed to german.