This hands-on cybersecurity course teaches you to investigate attacks, protect essential services, and recover Linux and Windows systems. Working in your assigned group, you will first connect to your VM, then explore two scenarios: an attacker who already has system access and an attacker attempting to gain access or disrupt services. Begin with Getting Started for connection instructions and detailed module guidance.
Use the connection addresses from your own computer. Use the lab IP addresses for commands and service checks inside the VMs.
Ubuntu 24.04 with GNOME desktop.
| Service | Protocol / port | Purpose |
|---|---|---|
| Nginx | HTTP / TCP 80 | Linux storefront: http://172.29.242.30/index.html |
| OpenSSH | SSH and SFTP / TCP 22 | Shell access and file transfer within the lab |
| xrdp | RDP / TCP 3389 in the VM | Ubuntu remote desktop, reached through connection port 13389 |
Expected storefront text: CCDC Linux storefront: operational. The Linux exercises use systemctl,
journalctl, UFW and command-line service checks.
Windows Server 2022 with Desktop Experience.
| Service | Protocol / port | Purpose |
|---|---|---|
| IIS (W3SVC) | HTTP / TCP 80 | Windows intranet: http://172.29.242.40/index.html |
| DNS Server (DNS) | DNS / UDP and TCP 53 | Provides the training.test zone |
| Remote Desktop Services | RDP / TCP 3389 in the VM | Windows desktop, reached through connection port 23389 |
Expected intranet text: CCDC Windows intranet: operational. Windows exercises use elevated PowerShell,
Windows Firewall and Event Log.
| Name | Address |
|---|---|
| www.training.test; linux.training.test | 172.29.242.30 |
| windows.training.test | 172.29.242.40 |
Query 172.29.242.40 for these names. Business inject asks you to create intranet.training.test. A name lookup and a web request test different services.
Begin with Getting Started for VM access, login credentials, preparation and detailed module guidance. Then follow the tasks for your assigned Linux or Windows group.
Two groups work in parallel, with four students assigned to each VM. Both groups follow Module 0 and the same two main attack modules using their platform’s tasks.
| Group | Assigned VM and services |
|---|---|
| Linux group | Ubuntu (ccdc-linux): Nginx HTTP and SSH. Work only in the assigned Ubuntu VM. |
| Windows group | Windows Server (CCDC-WINDOWS): IIS HTTP and DNS. Work only in the assigned Windows VM. |
Each group assigns attackers to perform the attack and defenders to investigate and recover. After recovery, reverse roles. The groups may then exchange Linux and Windows platforms if they wish. See the exercise workflow.
Linux uses direct-IP HTTP checks during Windows DNS outages. Windows queries its own DNS server; a DNS answer containing the Linux address does not require the Linux web service to be running.
Use the connection instructions for your computer, sign in with your group’s assigned credentials, and open your VM desktop.
Module 0 — Connect to your VM →
Investigate an attacker with valid credentials or an existing foothold. Identify changes, contain unauthorized access, recover affected services, investigate suspicious outbound data transfers and verify normal operation.
Module 1 details and platform tasks →
Investigate attempts to gain access or disrupt services, including discovery, authentication attempts, web inputs, suspicious traffic and denial of service.