Cyber Patriot 18 CP-18 Introductory Round Mint 21 Answer Key

Summary

• Total Checks: 90
• Positive Checks: 18
• Penalties: 71
• Maximum Possible Points: 100

Forensics Questions

Question 1

File Path: /home/benjamin/Desktop/Forensics Question 1.txt

Content:

There are prohibited MP3 files somewhere on this computer that are not work
related.
What is the absolute path of the directory containing the prohibited MP3 files?
( EXAMPLE: /home/benjamin/Downloads )
ANSWER: <Type Answer Here>

Category: Application security (F) (APP)

✅ SSH root login has been disabled +6

Specific Conditions:

• /etc/ssh/sshd_config has Exists equal to true
• Data of /etc/ssh/sshd_config does not match pattern (?i)^\s*^PermitRootLogin\s+"?yes"?\s*(?:#|$)

• OR

• Output of /usr/sbin/sshd-T exists
• Output of /usr/sbin/sshd-T matches pattern permituserenvironment\s
• Output of /usr/sbin/sshd-T does not match pattern permitrootlogin\syes

• OR

• Output of /usr/sbin/sshd-T exists
• Output of /usr/sbin/sshd-T matches pattern permituserenvironment\s
• Output of /usr/sbin/sshd-T does not match pattern permitrootlogin\syes

• OR

• Output of /usr/sbin/sshd-T exists
• Output of /usr/sbin/sshd-T matches pattern permituserenvironment\s
• Output of /usr/sbin/sshd-T does not match pattern permitrootlogin\syes

ID: SSH_RTL

Category: Application update (F) (AUP)

✅ Chromium has been updated +5

Specific Conditions:

• /usr/lib/chromium/chromium has Exists equal to true
• /usr/lib/chromium/chromium has Signature equal to 0:7f454c4602
• /usr/lib/chromium/chromium has BuildID not equal to 6e1c92650f83897b300dc129c4069914dbccf83a

ID: CHRM

✅ OpenSSH has been updated +5

Specific Conditions:

• /usr/sbin/sshd has Exists equal to true
• /usr/sbin/sshd has Signature equal to 0:7f454c4602
• /usr/sbin/sshd has BuildID not equal to 5f04213715703ddedf58f6f69587dbcc25ec9f4e

ID: OSSH

Category: Defensive countermeasure (F) (DEF)

✅ Uncomplicated Firewall (UFW) protection has been enabled +6

Specific Conditions:

• Output of nft-n list ruleset exists
• Output of nft-n list ruleset matches pattern ^\s*chain\s+INPUT
• Output of nft-n list ruleset matches pattern ^\s*chain\s+OUTPUT
• Output of nft-n list ruleset exists
• Output of nft-n list ruleset matches pattern ^\s*chain\s+INPUT
• Output of nft-n list ruleset matches pattern ^\s*chain\s+OUTPUT
• Output of nft-n list ruleset exists
• Output of nft-n list ruleset matches pattern ^\s*chain\s+INPUT
• Output of nft-n list ruleset matches pattern ^\s*chain\s+OUTPUT

• OR

• /etc/ufw/ufw.conf has Exists equal to true
• Data of /etc/ufw/ufw.conf matches pattern (?i)^\s*ENABLED="?yes"?

ID: FWALL

Category: Prohibited file (F) (FIL)

✅ Prohibited MP3 files are removed +5

Specific Conditions:

• /home/benjamin/Music/01-01- Ocean Motion.mp3 has Exists equal to false

• OR

• /home/benjamin/Music/01-04- Tinker Bells Dream.mp3 has Exists equal to false

• OR

• /home/benjamin/Music/01-07- Last Thoughts.mp3 has Exists equal to false

• OR

• /home/benjamin/ has Exists equal to true

ID: MP3

Category: Forensic Question (F) (FOR)

✅ Forensics Question 1 correct +8

Specific Conditions:

• Data of /home/benjamin/Desktop/Forensics Question 1.txt matches pattern (?i)^\s*[A-Z]{6}:\s*/home/benjamin/Music/?(?:\s|$)

ID: Q1

Category: Operating system update (F) (OUP)

✅ The system refreshes the list of updates automatically +5

Specific Conditions:

• Output of /usr/bin/su-l -s /bin/bash -c /usr/bin/dconf dump /com/linuxmint/ benjamin matches pattern refresh-schedule-enabled=true

ID: DAILY_MNT

✅ Install updates from important security updates +5

Specific Conditions:

• /etc/apt/sources.list has Exists equal to true
• Data of /etc/apt/sources.list matches pattern ^\s*deb\s+https?://[^/]+.ubuntu.com/ubuntu/?\s+[^\s]+-security\s+(?:[^\n]+\s+)?main

ID: SEC_UBU

✅ Systemd has been updated +5

Specific Conditions:

• /usr/lib/systemd/systemd has Exists equal to true
• /usr/lib/systemd/systemd has Signature equal to 0:7f454c4602
• /usr/lib/systemd/systemd has BuildID not equal to ef2b0a29855b95866e8343e4af5edbcd2b7fc6c6

ID: SYSD

Category: Penalty (F) (PEN)

➖ WARNING: VirtualBox is unsupported 0

Specific Conditions:

• Data of /proc/bus/input/devices matches pattern VirtualBox

• OR

• Data of /sys/devices/virtual/dmi/id/product_name matches pattern VirtualBox

• OR

• Data of /sys/devices/virtual/dmi/id/bios_version matches pattern VirtualBox

• OR

• Data of /sys/devices/virtual/dmi/id/board_name matches pattern VirtualBox

ID: VBX

❌ OpenSSH service has been stopped, disabled, or removed -5

Specific Conditions:

• Process /sshd (deleted) does not exists

• OR

• OR

• OR

• OR

• Process /sshd does not exists

• OR

• OR

• OR

• OR

• OR

• /usr/sbin/sshd has Exists equal to false

• OR

• OR

• OR

• OR

• OR

• /etc/systemd/system/multi-user.target.wants/ssh.service has Exists equal to false

• OR

• OR

• OR

• OR

• OR

• /usr/lib/systemd/system/ssh.service has Exists equal to false

ID: SRV_SSHD

❌ Chromium has been removed -5

Specific Conditions:

• /usr/lib/chromium/chromium has Exists not equal to true

ID: SFT_CHRM

❌ Removed one or more authorized administrators -5

Specific Conditions:

• Data of /etc/group does not match pattern (?i)^(?:sudo|wheel):[^\n]*[:,]benjamin(?:,|$)

• OR

• OR

• OR

• benjamin has Exists equal to false

• OR

• OR

• jpearson has Exists equal to false

• OR

• OR

• hspecter has Exists equal to false

• OR

• OR

• llitt has Exists equal to false

ID: USRA

❌ Removed one or more authorized users -5

Specific Conditions:

• dscott has Exists equal to false

• OR

• nnesbitt has Exists equal to false

• OR

• pporter has Exists equal to false

• OR

• kbennett has Exists equal to false

• OR

• mross has Exists equal to false

• OR

• rzane has Exists equal to false

• OR

• dpaulsen has Exists equal to false

• OR

• shuntley has Exists equal to false

• OR

• jpomaville has Exists equal to false

• OR

• sbandaru has Exists equal to false

• OR

• sthomas has Exists equal to false

ID: USRS

❌ Removed one or more authorized user directories -5

Specific Conditions:

• /home/benjamin has Exists equal to false

• OR

• /home/jpearson has Exists equal to false

• OR

• /home/hspecter has Exists equal to false

• OR

• /home/llitt has Exists equal to false

• OR

• /home/dscott has Exists equal to false

• OR

• /home/nnesbitt has Exists equal to false

• OR

• /home/pporter has Exists equal to false

• OR

• /home/kbennett has Exists equal to false

• OR

• /home/mross has Exists equal to false

• OR

• /home/rzane has Exists equal to false

• OR

• /home/dpaulsen has Exists equal to false

• OR

• /home/shuntley has Exists equal to false

• OR

• /home/jpomaville has Exists equal to false

• OR

• /home/sbandaru has Exists equal to false

• OR

• /home/sthomas has Exists equal to false

ID: USRD

Category: Penalty (F) (SCR)

❌ Removed multiple authorized users -3

Specific Conditions:

• dscott has Exists equal to false

• OR

• nnesbitt has Exists equal to false

• OR

• pporter has Exists equal to false

• OR

• kbennett has Exists equal to false

• OR

• mross has Exists equal to false

• OR

• rzane has Exists equal to false

• OR

• dpaulsen has Exists equal to false

• OR

• shuntley has Exists equal to false

• OR

• jpomaville has Exists equal to false

• OR

• sbandaru has Exists equal to false

• OR

• sthomas has Exists equal to false

• OR

• benjamin has Exists equal to false

• OR

• jpearson has Exists equal to false

• OR

• hspecter has Exists equal to false

• OR

• llitt has Exists equal to false

ID: SCRU

❌ Removed multiple authorized user directories -5

Specific Conditions:

• /home/benjamin has Exists equal to false

• OR

• /home/jpearson has Exists equal to false

• OR

• /home/hspecter has Exists equal to false

• OR

• /home/llitt has Exists equal to false

• OR

• /home/dscott has Exists equal to false

• OR

• /home/nnesbitt has Exists equal to false

• OR

• /home/pporter has Exists equal to false

• OR

• /home/kbennett has Exists equal to false

• OR

• /home/mross has Exists equal to false

• OR

• /home/rzane has Exists equal to false

• OR

• /home/dpaulsen has Exists equal to false

• OR

• /home/shuntley has Exists equal to false

• OR

• /home/jpomaville has Exists equal to false

• OR

• /home/sbandaru has Exists equal to false

• OR

• /home/sthomas has Exists equal to false

ID: SCRD

Category: Unwanted software (F) (SFT)

✅ Prohibited software Wireshark removed +6

Specific Conditions:

• /usr/bin/wireshark has Exists equal to false

• OR

• /usr/bin/ has Exists equal to true

ID: WIRE

✅ Prohibited software Zangband removed +6

Specific Conditions:

• /usr/games/zangband has Exists equal to false

• OR

• /usr/ has Exists equal to true

ID: ZANG

❌ Performed an unspecified action on the filesystem -2

Specific Conditions:

• /usr/sbin/ipp-usb has Exists equal to true

• OR

• /usr/sbin has Exists equal to false

ID: RKEF

❌ Performed an unspecified action on the filesystem -2

Specific Conditions:

• /bin/pbmto10x has Exists equal to true

• OR

• /bin has Exists equal to false

ID: OAOQ

❌ Performed an unspecified action on the filesystem -2

Specific Conditions:

• /usr/bin/hp-plugin-ubuntu has Exists equal to true

• OR

• /usr/bin has Exists equal to false

ID: PLVY

❌ Performed an unspecified action on the filesystem -2

Specific Conditions:

• /usr/bin/ps2epsi has Exists equal to true

• OR

• /usr/bin has Exists equal to false

ID: IWYW

❌ Performed an unspecified action on the filesystem -2

Specific Conditions:

• /sbin/e2image has Exists equal to true

• OR

• /sbin has Exists equal to false

ID: MVTF

❌ Performed an unspecified action on the filesystem -2

Specific Conditions:

• /bin/pnmmargin has Exists equal to true

• OR

• /bin has Exists equal to false

ID: RJGK

❌ Performed an unspecified action on the filesystem -2

Specific Conditions:

• /sbin/fsck.fat has Exists equal to true

• OR

• /sbin has Exists equal to false

ID: NJLT

❌ Performed an unspecified action on the filesystem -2

Specific Conditions:

• /etc/rc2.d/S01dbus has Exists equal to true

• OR

• /etc/rc2.d has Exists equal to false

ID: SKHY

❌ Performed an unspecified action on the filesystem -2

Specific Conditions:

• /usr/sbin/mkfs.minix has Exists equal to true

• OR

• /usr/sbin has Exists equal to false

ID: GQJK

❌ Performed an unspecified action on the filesystem -2

Specific Conditions:

• /usr/bin/gst-launch-1.0 has Exists equal to true

• OR

• /usr/bin has Exists equal to false

ID: KRFT

❌ Performed an unspecified action on the filesystem -2

Specific Conditions:

• /bin/xlsclients has Exists equal to true

• OR

• /bin has Exists equal to false

ID: JDUN

❌ Performed an unspecified action on the filesystem -2

Specific Conditions:

• /bin/chcon has Exists equal to true

• OR

• /bin has Exists equal to false

ID: WZEU

❌ Performed an unspecified action on the filesystem -3

Specific Conditions:

• /usr/bin/plocate has Exists equal to true

• OR

• /usr/bin has Exists equal to false

ID: JECK

❌ Performed an unspecified action on the filesystem -3

Specific Conditions:

• /bin/rendercheck has Exists equal to true

• OR

• /bin has Exists equal to false

ID: ZHOO

❌ Performed an unspecified action on the filesystem -3

Specific Conditions:

• /bin/man-recode has Exists equal to true

• OR

• /bin has Exists equal to false

ID: RJKQ

❌ Performed an unspecified action on the filesystem -3

Specific Conditions:

• /bin/gawk has Exists equal to true

• OR

• /bin has Exists equal to false

ID: TAZC

❌ Performed an unspecified action on the filesystem -3

Specific Conditions:

• /usr/bin/mintwelcome has Exists equal to true

• OR

• /usr/bin has Exists equal to false

ID: BVFI

❌ Performed an unspecified action on the filesystem -3

Specific Conditions:

• /bin/cups-calibrate has Exists equal to true

• OR

• /bin has Exists equal to false

ID: WYTU

❌ Performed an unspecified action on the filesystem -3

Specific Conditions:

• /bin/calibrate_ppa has Exists equal to true

• OR

• /bin has Exists equal to false

ID: IWSP

❌ Performed an unspecified action on the filesystem -3

Specific Conditions:

• /usr/bin/pgmhist has Exists equal to true

• OR

• /usr/bin has Exists equal to false

ID: GEEJ

❌ Performed an unspecified action on the filesystem -4

Specific Conditions:

• /usr/bin/lto-dump-11 has Exists equal to true

• OR

• /usr/bin has Exists equal to false

ID: TDSZ

❌ Performed an unspecified action on the filesystem -4

Specific Conditions:

• /bin/printafm has Exists equal to true

• OR

• /bin has Exists equal to false

ID: IWNC

❌ Performed an unspecified action on the filesystem -4

Specific Conditions:

• /bin/unzip has Exists equal to true

• OR

• /bin has Exists equal to false

ID: HBOB

❌ Performed an unspecified action on the filesystem -4

Specific Conditions:

• /usr/sbin/ntfslabel has Exists equal to true

• OR

• /usr/sbin has Exists equal to false

ID: SKKA

❌ Performed an unspecified action on the filesystem -4

Specific Conditions:

• /sbin/ModemManager has Exists equal to true

• OR

• /sbin has Exists equal to false

ID: WHYG

❌ Performed an unspecified action on the filesystem -4

Specific Conditions:

• /bin/atktopbm has Exists equal to true

• OR

• /bin has Exists equal to false

ID: VPTM

❌ Performed an unspecified action on the filesystem -4

Specific Conditions:

• /usr/bin/btrfs-image has Exists equal to true

• OR

• /usr/bin has Exists equal to false

ID: XTDU

❌ Performed an unspecified action on the filesystem -4

Specific Conditions:

• /usr/bin/loweb has Exists equal to true

• OR

• /usr/bin has Exists equal to false

ID: YJAA

❌ Performed an unspecified action on the filesystem -4

Specific Conditions:

• /bin/lintian-annotate-hints has Exists equal to true

• OR

• /bin has Exists equal to false

ID: AIFH

❌ Performed an unspecified action on the filesystem -4

Specific Conditions:

• /bin/msggrep has Exists equal to true

• OR

• /bin has Exists equal to false

ID: KFDW

❌ Performed an unspecified action on the filesystem -4

Specific Conditions:

• /usr/bin/zdump has Exists equal to true

• OR

• /usr/bin has Exists equal to false

ID: SUXZ

❌ Performed an unspecified action on the filesystem -4

Specific Conditions:

• /usr/sbin/xfs_spaceman has Exists equal to true

• OR

• /usr/sbin has Exists equal to false

ID: VFDY

❌ Performed an unspecified action on the filesystem -4

Specific Conditions:

• /usr/bin/fwupdagent has Exists equal to true

• OR

• /usr/bin has Exists equal to false

ID: JKMS

❌ Performed an unspecified action on the filesystem -5

Specific Conditions:

• /bin/ssh has Exists equal to true

• OR

• /bin has Exists equal to false

ID: DCDJ

❌ Performed an unspecified action on the filesystem -5

Specific Conditions:

• /usr/sbin/xfs_metadump has Exists equal to true

• OR

• /usr/sbin has Exists equal to false

ID: NJEI

❌ Performed an unspecified action on the filesystem -5

Specific Conditions:

• /usr/bin/dirmngr-client has Exists equal to true

• OR

• /usr/bin has Exists equal to false

ID: QFIW

❌ Performed an unspecified action on the filesystem -5

Specific Conditions:

• /usr/bin/dpkg-architecture has Exists equal to true

• OR

• /usr/bin has Exists equal to false

ID: JGNH

❌ Performed an unspecified action on the filesystem -5

Specific Conditions:

• /usr/bin/who has Exists equal to true

• OR

• /usr/bin has Exists equal to false

ID: TWGT

❌ Performed an unspecified action on the filesystem -5

Specific Conditions:

• /bin/foo2zjs has Exists equal to true

• OR

• /bin has Exists equal to false

ID: EHBD

❌ Performed an unspecified action on the filesystem -5

Specific Conditions:

• /bin/m2300w has Exists equal to true

• OR

• /bin has Exists equal to false

ID: XKRK

❌ Performed an unspecified action on the filesystem -5

Specific Conditions:

• /usr/bin/factor has Exists equal to true

• OR

• /usr/bin has Exists equal to false

ID: GJAE

❌ Performed an unspecified action on the filesystem -5

Specific Conditions:

• /bin/pnmnorm has Exists equal to true

• OR

• /bin has Exists equal to false

ID: DVVV

❌ Performed an unspecified action on the filesystem -5

Specific Conditions:

• /bin/cpanel_json_xs has Exists equal to true

• OR

• /bin has Exists equal to false

ID: UVOU

❌ Performed an unspecified action on the filesystem -5

Specific Conditions:

• /bin/ln has Exists equal to true

• OR

• /bin has Exists equal to false

ID: HHUI

❌ Performed an unspecified action on the filesystem -5

Specific Conditions:

• /usr/bin/mintBackup has Exists equal to true

• OR

• /usr/bin has Exists equal to false

ID: IIGX

❌ Performed an unspecified action on the filesystem -5

Specific Conditions:

• /bin/gpg-agent has Exists equal to true

• OR

• /bin has Exists equal to false

ID: VBJJ

❌ Performed an unspecified action on the filesystem -5

Specific Conditions:

• /bin/setkeycodes has Exists equal to true

• OR

• /bin has Exists equal to false

ID: EBFH

❌ Performed an unspecified action on the filesystem -5

Specific Conditions:

• /bin/gdialog has Exists equal to true

• OR

• /bin has Exists equal to false

ID: YZOA

❌ Performed an unspecified action on the filesystem -5

Specific Conditions:

• /sbin/fsck.ext4 has Exists equal to true

• OR

• /sbin has Exists equal to false

ID: BOPZ

❌ Performed an unspecified action on the filesystem -5

Specific Conditions:

• /sbin/ipmaddr has Exists equal to true

• OR

• /sbin has Exists equal to false

ID: TKKZ

❌ Performed an unspecified action on the filesystem -5

Specific Conditions:

• /var/log/ubuntu-system-adjustments-start.log has Exists equal to true

• OR

• /var/log has Exists equal to false

ID: WEET

❌ Performed an unspecified action on the filesystem -5

Specific Conditions:

• /usr/bin/ssh-import-id-lp has Exists equal to true

• OR

• /usr/bin has Exists equal to false

ID: DWAP

❌ Performed an unspecified action on the filesystem -5

Specific Conditions:

• /usr/bin/ppmtoacad has Exists equal to true

• OR

• /usr/bin has Exists equal to false

ID: AGUD

❌ Performed an unspecified action on the filesystem -5

Specific Conditions:

• /usr/bin/glxdemo.x86_64-linux-gnu has Exists equal to true

• OR

• /usr/bin has Exists equal to false

ID: MPEM

❌ Performed an unspecified action on the filesystem -6

Specific Conditions:

• /usr/bin/fc-cat has Exists equal to true

• OR

• /usr/bin has Exists equal to false

ID: MUAG

❌ Performed an unspecified action on the filesystem -6

Specific Conditions:

• /bin/xzcat has Exists equal to true

• OR

• /bin has Exists equal to false

ID: MHTM

❌ Performed an unspecified action on the filesystem -6

Specific Conditions:

• /usr/bin/xzdiff has Exists equal to true

• OR

• /usr/bin has Exists equal to false

ID: NBYU

❌ Performed an unspecified action on the filesystem -6

Specific Conditions:

• /usr/bin/pamcut has Exists equal to true

• OR

• /usr/bin has Exists equal to false

ID: EKBF

❌ Performed an unspecified action on the filesystem -6

Specific Conditions:

• /usr/sbin/arpd has Exists equal to true

• OR

• /usr/sbin has Exists equal to false

ID: PRGL

❌ Performed an unspecified action on the filesystem -6

Specific Conditions:

• /sbin/lpc has Exists equal to true

• OR

• /sbin has Exists equal to false

ID: FXHE

❌ Performed an unspecified action on the filesystem -6

Specific Conditions:

• /usr/bin/instmodsh has Exists equal to true

• OR

• /usr/bin has Exists equal to false

ID: OZTL

❌ Performed an unspecified action on the filesystem -6

Specific Conditions:

• /usr/bin/setfacl has Exists equal to true

• OR

• /usr/bin has Exists equal to false

ID: QXGU

❌ Performed an unspecified action on the filesystem -6

Specific Conditions:

• /usr/bin/mate-search-tool has Exists equal to true

• OR

• /usr/bin has Exists equal to false

ID: TFLM

❌ Performed an unspecified action on the filesystem -6

Specific Conditions:

• /usr/bin/select-default-iwrap has Exists equal to true

• OR

• /usr/bin has Exists equal to false

ID: PPQC

Category: Service auditing (F) (SRV)

✅ FTP service has been disabled or removed +6

Specific Conditions:

• Process /vsftpd does not exists
• Process /vsftpd does not exists
• Process /vsftpd does not exists

• OR

• /usr/sbin/vsftpd has Exists equal to false

• OR

• OR

• OR

• OR

• /lib/systemd/system/vsftpd.service has Exists equal to false

• OR

• OR

• OR

• OR

• /etc/systemd/system/multi-user.target.wants/vsftpd.service has Exists equal to false

ID: VSFTPD

Category: User auditing (F) (USR)

✅ Created new administrator account for edarby +6

Specific Conditions:

• edarby has Exists equal to true

• OR

• /etc/group has Exists equal to true
• Data of /etc/group matches pattern sudo:
• Data of /etc/group matches pattern (?i)^sudo:([^\n]*,)?edarby

ID: EDAR

✅ User edarby must change password at next login +6

Specific Conditions:

• edarby has Exists equal to true

• OR

• /etc/shadow has Exists equal to true
• Data of /etc/shadow matches pattern (?i)^edarby:[^\n:]+:0:

ID: EDAR_PW

✅ Removed unauthorized user tgianopolous +5

Specific Conditions:

• tgianopolous has Exists equal to false

ID: TGIA

✅ Removed unauthorized user jquelling +5

Specific Conditions:

• jquelling has Exists equal to false

ID: JQUE

✅ User dscott is not an administrator +5

Specific Conditions:

• dscott has Exists equal to true

• OR

• /etc/group has Exists equal to true
• Data of /etc/group matches pattern sudo:
• Data of /etc/group does not match pattern (?i)^sudo:[^\n]*[:,]dscott

ID: DSCO

✅ Changed insecure password for user llitt +5

Specific Conditions:

• llitt has Exists equal to true
• llitt has Password not equal to ugotlittup

ID: LLIT