CIS4407 - 2008 Summer
Security Group Assignment
Journals Due Thursday, August 4th, at the beginning of class.


Assignment: Security

As of distribution of this assignment on July 25, 2012 (Wednesday), each team will defend its own machines and seek to compromise the machines of the other system administration groups.

Attacks may continue until 8:00am, August 10th, 2012 (Friday, the final day of classes for the semester). Journals however will be due at 11:00am on August 8th. NO LATE JOURNALS WILL BE ACCEPTED.

Your grade in this exercise will reflect your success in securing your machine against the widest possible variety of attacks (with the exceptions noted below) AND your success in gaining access to the machines of other groups. The methods to employ, within the rules delineated below, are yours to research and choose.

In this exercise on machines that you successfully compromise, you are to open a "backdoor" shell requiring no authentication on a port of your choice that is greater than 35000. The test of a successfully compromised machine will be the ability to use either nc IPNUMBER PORT or telnet IPNUMBER PORT to get access to a bash shell on the machine. Alternatively, you may start a "reverse backdoor" going to port 49999 on machine; this reverse backdoor must try to connect at least once every five minutes, and provide a shell prompt to any ordinary "nc" in listening mode (i.e., this should be in the clear, and not using SSL.)


PURPOSE OF EXERCISE. Be sure that you understand that the purpose of this exercise is NOT to foster a "hacker" mentality or to arbitrarily teach the methods used by hackers. Knowledge of the techniques used by attackers must be understood to properly secure a network, which is one of the more critical jobs of the modern system administrator. Use what you learn in a responsible manner.

SCOPE OF USE. In this exercise, strictly limit all attacks and attempts to gain information to the other sysadmin machines (machines numbered and greater) in room 016. Any use of such techniques or ANY such use on ANY other Computer Science machines or those of any other system is strictly prohibited. Be careful and stay within our sandbox. Do not attack any of the YSP machines.

NO ACTUAL DAMAGE. The goal of this exercise is to gain access; not to damage ANY portion of the target computer, including its filesystems or to cause ANY mischief whatsoever. DO NO DAMAGE. Just start up a backdoor shell.

NO PHYSICAL INTRUSION. For the purposes of this exercise, it will be assumed that each machine is physically secure. Therefore, no attempt may be made to gain physical access to the components of a given computer or to access said computer from the console. Attempting to boot said computer from a floppy disk, cdrom, USB drives, or other physical media attached to the subject computer is specifically prohibited. All access must be made over the network.

ACTS UPON INTRUSION. Upon starting a backdoor, immediately communicate the ipnumber and port to your instructor. You may NOT attempt the same attack until you have been notified that it's okay to do so, but once you have been notified, you may choose to make the same attack again to determine if the target team has made successful modifications.

USER ACCOUNTS. All regular system accounts must exist and remain normally usable on all three machines. All of the accounts that you created for the previous assignment must remain operable for the duration of this exercise, and this will be tested on a random basis.

NORMAL SERVICES. Both your CentOS instance and your Debian machine must continue to provide normal user services to local users (i.e., those people with a local account on the machine itself.) All services configured in earlier assignments must remain running and available. This will be checked on a random basis. Don't turn on the machines for any reason. Your machines must also respond to ping.

PACKET SNIFFERS. Packet sniffing is allowed, but only within the confines of your local network. You should naturally not use any passwords for your machines that you use outside of the sandboxes, as they may become compromised.

ARP POISONING: ARP poisoning is not allowed. It has historically been the most successful technique for compromising machines, but we are sharing the classroom this semester and ARP cache poisoning can be highly disruptive.

DENIAL OF SERVICE. Denial of service attacks are not allowed, again because we are sharing the lab.


  1. Can I turn off iptables for my backdoor? Yes, you can turn off iptable blocking of up to four ports on a compromised host to allow incoming connections to your backdoor. However, this should not be a permanent change; use iptables -I to insert your temporary rules.
  2. Can I use port knocking to obscure my backdoor? Yes, you may, but the port knocking needs to be incorporated in your backdoor program. Do not install a separate daemon like knockd to do your portknocking, and don't reconfigure any existing knockd on the compromised machine.
  3. Can I use a kernel module rather than a userland process for the backdoor? Yes, you may, but you should insert the module by hand (for instance, with insmod), and it should not be automatically re-installed at reboot. This kernel module should be thoroughly tested before you install it on the target — and "thorough" means "tested on the same kernel as the target".
  4. Can I use a rootkit for the backdoor? Generally, no. However, as stated in 3, you can use a one-shot kernel module insertion. But you are not to change the target machine's kernel, shared libraries, or system binaries in any permanent fashion.

There will be one point added to your final numeric grade for this course for each backdoor successfully opened. I will accept a maximum of three (3) such points.

For each time that one of your machines is compromised, one point will be deducted from the grade for this exercise up to three times.

I reserve the right to deny these additional points if I have any inkling that you installed the backdoor by other means (such as by collusion with other teams or by physical compromise).

A journal is due for this assignment. Make sure that you document in your journal all of the steps that you went through, following the guidelines on the class home page. Please share the workload so that all team members get experience with all aspects of the work. Do not forget to assign your work percentages to yourself and your other teammates in your journal. Please turn in a printed copy of this assignment at the beginning of class on Wednesday, August 8th.