Getting Started

These exercises cover two starting scenarios. In the first, the attacker already has access to the system through valid credentials or an existing foothold. In the second, the attacker starts without system access and tries to gain entry or disrupt services. We organize the modules by the attacker’s access at the start of the exercise.

Module 0 — Connect to your assigned VM provides your group’s credentials and connection instructions so you can open your assigned VM desktop. Module 1 — Attacker already has system access focuses on investigating changes, containing unauthorized activity and recovering services. Module 2 — Attacker starts without system access focuses on detecting attempts, reducing exposure and maintaining availability. Use the exercise workflow below, then choose your group’s Linux or Windows tasks.

Exercise workflow

The instructor provides the configured VMs, accounts and required exercise materials before training begins. Students perform the baseline checks, attack, investigation, recovery and validation themselves, then switch roles. Student attackers perform the scenario changes and attacks; student defenders investigate and recover. No instructor actions or file releases are required during the session.

Assign teams: divide each group into a red team for attack and a blue team for defense.
Attack: the red team performs the assigned attack on its group’s VM.
Investigate and recover: the blue team identifies what happened, examines and preserves evidence, contains the attack, and restores the affected services. Verify that normal service and legitimate access work again.
Reverse roles: after recovery, the red team becomes the blue team and the blue team becomes the red team. Repeat the exercise so everyone practices both attack and defense.
Optional platform swap: after both rounds, the Linux and Windows groups may exchange platforms. Use the new platform’s assigned credentials and tasks, and repeat the red-team/blue-team rounds.

In the concrete exercise instructions, attacker refers to the red team and defender refers to the blue team.

Finish recovery and restore the exercise starting conditions before reversing roles or swapping platforms.

Module 0 — Connect to your assigned VM

Find your assigned group’s login below, then follow the instructions for the computer you are using: macOS, Windows, or Linux.

Use the credentials for your assigned lab group and student number. Choose your computer’s operating system separately in the connection instructions below.

Linux group

Use only your assigned numbered account and its matching password.

VM	Address
ccdc-linux	`128.198.74.133:13389`

Linux username	Password
trainee01	TrainLab!2601
trainee02	TrainLab!2602
trainee03	TrainLab!2603
trainee04	TrainLab!2604

Login note: Select Xorg if prompted, then enter your assigned Linux credentials.

Windows group

Use only your assigned numbered account and its matching password.

VM	Address
ccdc-windows	`128.198.74.133:23389`

Windows username	Password
CCDC-WINDOWS\trainee01	TrainLab!2601
CCDC-WINDOWS\trainee02	TrainLab!2602
CCDC-WINDOWS\trainee03	TrainLab!2603
CCDC-WINDOWS\trainee04	TrainLab!2604

Login note: Sign in with your assigned CCDC-WINDOWS account to open the Windows Server desktop.

Connect from macOS

Open Microsoft Windows App on your Mac (available from the Mac App Store), then select + → Add PC.
Enter your assigned VM’s connection address from the Linux group table or Windows group table in PC name. Set Gateway to No gateway, or leave it unset.
Save the connection and open it to sign in. Enter your assigned group username and password. Follow the remote-login note in your group’s table.

Connect from Windows

On your Windows computer, press Windows+R, type mstsc, and press Enter.
Enter your assigned VM’s connection address from the Linux group table or Windows group table in Computer. Set Gateway to No gateway, or leave it unset.
Select Connect. Choose More choices → Use a different account if needed. Enter your assigned group username and password. Follow the remote-login note in your group’s table.

Connect from Linux

On your Linux computer, open Remmina and create a connection using the RDP protocol.
Enter your assigned VM’s connection address from the Linux group table or Windows group table in Server. Set Gateway to No gateway, or leave it unset.
Save the connection and connect. Enter your assigned group username and password. Follow the remote-login note in your group’s table.

If a certificate warning appears, compare the certificate with the verified connection details supplied before class. Do not accept a mismatch. For connection errors, recheck the assigned address, account and client settings before starting the exercises.

Module 1 — Attacker already has system access

Possible attacker action	Evidence to look for	Defense to consider	Tasks
1.1 — Service tampering and recovery	Service state, outage timestamps, service logs and failed requests	Identify the cause and restore normal operation while keeping other services available	Linux task Windows task
1.2 — Web-content tampering and evidence	Unexpected page content, file modification times and hashes; a successful HTTP response alone does not establish content integrity	Preserve evidence of unauthorized changes and restore the trusted page	Linux task Windows task
1.3 — Firewall tampering versus service failure	Firewall rules, listening ports, service state and differences between local and remote access	Distinguish a firewall-related outage from a stopped service and restore required access	Linux task Windows task
1.4 — Compromised account and excessive privilege	Unexpected account privileges, group memberships and authentication records	Contain unauthorized access and remove excessive privileges while preserving legitimate users and services	Linux task Windows task
1.5 — Suspicious outbound traffic and data exfiltration	Outbound destination, sender PID and command line, independent receiver receipt and dummy-file checksum	Preserve evidence, stop the sender, restrict the specific outbound destination and verify normal service	Linux task Windows task

Module 2 — Attacker starts without system access

Possible attacker action	Evidence to look for	Defense to consider	Tasks
2.1 - Identify reachable services and software	Connections, web requests and firewall records where logging is enabled; some discovery leaves little application evidence	Remove unnecessary services; restrict administrative access; keep software updated	Linux task Windows task
2.2 - Authentication attempts	Failures grouped by time, account and source; unexpected successes; authentication logs	Unique passwords, supported MFA, SSH keys, throttling and carefully chosen lockout policies	Linux task Windows task
2.3 - Find an exposed backup or configuration file	Web request path, response status, source and time	Keep secrets and backups outside the web root; review publication permissions	Linux task Windows task
2.3 - Malicious web inputs and application exploitation	Application errors, unusual processes, account changes and endpoint evidence; login failures may be absent	Patch applications, reduce privileges and teach phishing recognition	Linux task Windows task These tasks cover web probing and exposed files. Application exploitation requires a separate prepared lab.
2.4 - Suspicious network traffic	Endpoints, ports, timing and request/response patterns in supplied captures or logs	Investigate unexpected connections and preserve legitimate traffic	Linux task Windows task
2.5 - Denial of service and resource exhaustion	Request volume, latency, errors and resource usage in the supplied timeline	Consider request limits, timeouts and upstream filtering	Linux task Windows task