Lab Resources:

• Download the Virtual Machine Here.
  • You’ll need VMWare Workstation
  • username: student
  • password: student

What is on this virtual machine?

• This virtual machine is designed to give participants experience in identifying and configuring services that run in Docker containers. **If you are CyberPatriot competitor, this is a key skill in the later rounds of competition.
• This machine is running several ‘linked’ Docker containers.
  • Of primary importance
    • We have an nginx container running the web server
    • We have a MariaDB container housing the CTFd database.

Lab objective:

• Recover the admin account using the CLI. The flag can be found in the admin user’s profile.

Step 1: Identify Listening Ports

• Note: You can double-click on images to enlarge them here.

• I prefer to use ss -lntp to identify listening ports

  • In the image below, you’ll see that port 8000 is exposed on the virtual machine along with ports 80 and 22.

  ss -lntp
  

Open the CTFd webpage.

• Open the webpage in any browser using the IP Address of your virtual machine.

• You’ll notice that there are numerous interfaces. (Docker creates lots of virtual interfaces.)

  • For every running container, virtual interfaces are created that are not exposed to the local area network.

  ip addr
  

Open the webpage using the identified IP Address on port 8000.

Docker Reconnaissance:

• The commands we’ll use in this section are foundational when working with Docker
  • They are straightforward to remember, and you’ll use them all the time. Notes on these commands could be handy if you are not familiar with or used to working with Docker.

Start by identifying running Docker containers