Training overview

Before-class lab setup

Complete this environment setup before students arrive. During training, students perform scenario changes and attacks as the attacker, then investigate, contain and recover as the defender. The exercise sequence requires no instructor actions or file releases.

Shared environment

• Provide Ubuntu at 172.29.242.30 with Nginx, SSH, remote desktop and active UFW.
• Provide Windows at 172.29.242.40 with IIS, DNS, remote desktop and enabled Windows Firewall profiles.
• Verify the assigned trainee accounts’ sudo or elevated PowerShell access and both operational webpages.
• Confirm campus HTTP and remote desktop routes. Distribute verified connection certificate details before class.
• Enable the authentication and web logging used in the tasks, including IIS W3C date, time, c-ip, cs-method, cs-uri-stem, cs-uri-query and sc-status fields. Ensure classroom PowerShell scripts can run under the lab’s policy.
• Distribute the complete HTML pack or published site, including the CSV files and dummy business data. Preserve relative paths.

Students create their own recovery copies, checksums, exercise accounts, dummy exposed files and evidence folders as directed by the HTML tasks. Attack actions and cleanup are included in their steps.

Separate dummy-data receiver

The outbound-transfer exercise needs a receiver outside both victim VMs. On the lab host, run this command from the repository before class:

python3 lab-tools/dummy-data-receiver.py

The receiver binds to 172.29.242.1:18081. Keep it running throughout the exercise. It accepts only the exact supplied dummy payload from the assigned VM IP addresses.

• Ubuntu uploads to /upload/linux; Windows uploads to /upload/windows.
• Students check /health and inspect /receipts/linux or /receipts/windows.
• The receiver records each upload immediately and delays acknowledgement for 120 seconds so the sender’s connection remains visible. No background sender or startup entry is installed in either VM.

Verify receiver health from both VMs before class. Keep this port on the isolated lab network.

Receipts and lifecycle

Receipt pages show recent transfers since receiver startup. Receipts also persist in the host account’s ~/.local/state/ccdc-task15/receipts.jsonl. Students identify their transfer by time, source IP and checksum.

Ctrl+C stops a foreground receiver. Restart it before class after a host restart. If the lab host already runs the receiver as a user service, inspect that instance instead of starting a second one:

systemctl --user status ccdc-task15-receiver.service

After class, stop that service with:

systemctl --user stop ccdc-task15-receiver.service

This transient service does not start automatically after a host restart.

Optional local receiver check

For a local test without the VMs, use loopback mode and immediate acknowledgement:

python3 lab-tools/dummy-data-receiver.py --bind 127.0.0.1 --hold-seconds 0

Classroom tasks use the default lab binding and observation delay. All student instructions are in the HTML training pages; students do not need the repository README or this setup page during their exercises.