An inject is a business or technical request issued during a competition. Read the requested outcome and deliverable before choosing tools. Some injects ask for scripts; others ask for configuration changes, diagrams or written explanations. A working script alone may not satisfy a competition request.
These are simplified exercises inspired by the CYSCUVU collection of 2025 RMCCDC injects. They are practice activities, not official 2026 injects or official solutions. We do not require written report submissions. Keep your working scripts and show the results to your group. During a real competition, follow the actual inject's delivery format and deadline.
See Overview for group assignments. The starter checks below are read-only and do not require stopping services, filling disks or changing firewalls. Practice D changes a Windows DNS record. Use only your assigned VM.
Inspired by NETW22T: Defining Ports. The original asks for a completed network-flow table in a business memo. Our version is a group discussion using the actual lab services; no memo is required.
Linux: inspect listeners and locate SSH on TCP 22 and Nginx on TCP 80.
sudo ss -lntup
Official command documentation: sudo · ss
Windows: inspect TCP and UDP listeners. Locate HTTP on TCP 80 and DNS on TCP/UDP 53.
Get-NetTCPConnection -State Listen | Sort-Object LocalPort Get-NetUDPEndpoint | Sort-Object LocalPort
Official command documentation: Get-NetTCPConnection · Get-NetUDPEndpoint · Sort-Object · PowerShell syntax
For an HTTP request, explain which machine is the client, which is the server, and why the request destination is port 80. Distinguish a listening server port from a client source port. Repeat for DNS. Discuss the answer with your group rather than changing firewall rules.
Inspired by SVRA09T: Develop a Script to Monitor File System Space. The original requests Linux and Windows scripts, validation evidence, scheduling evidence and a memo. Its threshold wording is ambiguous about used versus available space; in competition ask for clarification. For this classroom task, we define the threshold as used space at or above 75%. Scheduling and external alert delivery are extensions, not required here.
Goal: save a script that prints the used percentage and either OK or ALERT. Each group writes only its assigned OS version. The scripts below are starting points: read each line and explain it before running.
In Ubuntu, open Text Editor and save the following as disk-check.sh in your home folder. Run it with
bash ~/disk-check.sh.
#!/usr/bin/env bash
set -eu
threshold="${1:-75}"
if ! [[ "$threshold" =~ ^[0-9]+$ ]] || (( threshold > 100 )); then
echo "Threshold must be an integer from 0 to 100" >&2
exit 2
fi
used=$(df -P / | awk 'NR==2 {gsub(/%/, "", $5); print $5}')
echo "Root filesystem used: ${used}%"
if (( used >= threshold )); then
echo "ALERT: usage meets or exceeds ${threshold}%"
else
echo "OK: usage is below ${threshold}%"
fi
Official command documentation: df · awk · echo · set · exit · Bash syntax
Open PowerShell ISE in Windows, create a new script, paste the following, and save it as disk-check.ps1
in Documents. Press F5 to run. The lab is prepared to run local classroom scripts. If execution is blocked, inspect
Get-ExecutionPolicy -List and record the policy conflict; do not bypass an enforced policy.
param(
[ValidateRange(0,100)]
[int]$Threshold = 75
)
$disk = Get-CimInstance Win32_LogicalDisk -Filter "DeviceID='C:'"
if (-not $disk -or $disk.Size -le 0) {
throw 'Cannot read the C: drive capacity'
}
$used = 100 * ($disk.Size - $disk.FreeSpace) / $disk.Size
Write-Output ('C: used: {0:N1}%' -f $used)
if ($used -ge $Threshold) {
Write-Output "ALERT: usage meets or exceeds $Threshold%"
} else {
Write-Output "OK: usage is below $Threshold%"
}
Official command documentation: Get-CimInstance · Write-Output
Compare its reading with df -P /. Use bash ~/disk-check.sh 0 to exercise the ALERT branch
without filling the disk. Then run the normal command again. The percentage follows df's available-capacity
convention.
Compare with Get-Volume -DriveLetter C | Select-Object Size,SizeRemaining. In the ISE console, run
& "$HOME\Documents\disk-check.ps1" -Threshold 0 to exercise ALERT without filling the disk. Run again
without the parameter for the normal 75% threshold.
Demonstrate a normal run and the forced ALERT test. Explain which disk is checked, how the percentage is calculated, what the threshold means, and why this prints a message but does not yet send an email or run on a schedule. You have completed the simplified activity when your reading matches the built-in command and you can explain the conditional. Keep the script; no report upload is required.
Inspired by WINS05A: Discover Network Processes. The original requests a memo with commands, a process/port table and an assessment. Our version is a guided demonstration; the Linux equivalent below is a classroom adaptation.
Continue from the listener inventory in Practice A; reuse those results instead of repeating the port-identification task. Now identify the process that owns a listener.
:80. Read the users: field: it shows the process name,
pid= value and file descriptor. If you need current output for just this listener, run:
sudo ss -lntp 'sport = :80'
1234 below with the actual PID, then run:
ps -p 1234 -o pid,user,comm=NAME,args=ARGS
PID is the process ID, USER is the account running it, NAME is the
process name and ARGS shows the command line and its arguments. If only the header appears,
refresh the listener output and use a current PID.Official command documentation: ps
Use the listener’s OwningProcess value from Practice A.
In elevated PowerShell, replace 1234 with that PID:
Get-Process -Id 1234 | Select-Object Id,ProcessName,Path
Official command documentation: Select-Object · Get-Process
Match one listener to a known service from Overview. A familiar port does not prove a process is safe, and an unfamiliar process is not automatically malware. Windows HTTP may appear under PID 4/System because of HTTP.sys. Do not kill unfamiliar processes. Explain what you know and what you would need to investigate further.
Show the listener and its matching process to your group. Explain why it is expected or what additional evidence you would inspect. Do not stop or kill the process.
Request: create intranet.training.test pointing to 172.29.242.40. Existing www.training.test, both web pages and SSH must remain available. Demonstrate the change after verifying it.
Windows group only: run in elevated PowerShell inside your assigned Windows VM. Check whether the requested record already exists before changing DNS:
Resolve-DnsName intranet.training.test -Server 172.29.242.40 -DnsOnly -NoHostsFile
If the name is absent, continue to Step 2. If it already resolves to 172.29.242.40, verify the existing
result instead of creating a duplicate. Do not replace an existing record that points elsewhere.
Run this command only when the record was absent in Step 1:
Add-DnsServerResourceRecordA -ZoneName training.test -Name intranet -IPv4Address 172.29.242.40
Official command documentation: Add-DnsServerResourceRecordA
Resolve-DnsName intranet.training.test -Server 172.29.242.40 -DnsOnly -NoHostsFile Resolve-DnsName intranet.training.test -Server 172.29.242.40 -DnsOnly -NoHostsFile -TcpOnly Invoke-WebRequest http://172.29.242.40/index.html -UseBasicParsing
Official command documentation: Resolve-DnsName · Invoke-WebRequest
Practice check: demonstrate the result, explain your actions to your group, and retain your working files. No written report submission is required.
Show the exact command, the output or error, and what result you expected. Ask one specific question at a time. Your group can compare with the service inventory and built-in commands; an uncertain result is a reason to investigate, not to invent an answer.