Closing the unneeded ports
The Magazzino Verdi server 'has always worked like this'. The more services listen, the more doors someone can knock on. Find out what is open on this machine, compare it with the inventory of authorised services and go and hear what the service that should not be there has to say.
Lab 5 of 6 in the Blue Team / Defense path. If you get stuck you have 3 hints, from the vaguest to the most precise: they cost 0, 40 and 100 XP.
What you learn
Objectives complete themselves while you work in the terminal; each one is worth experience points:
- Scan the open ports with nmap (80 XP)
- Read the inventory of authorised services (80 XP)
- Find where the cleartext service is configured (grep -r) (100 XP)
- Read the banner of the forgotten service (nc) (140 XP)
Topics: defense, hardening, nmap, superficie.
Commands you will use
The terminal is simulated and understands about forty Linux commands. In this lab you will mostly need these:
cat: prints the contents of a file: the most direct way to read configurations, notes and logs.nmap: discovers the live hosts of a network and the open ports of a machine, with services and versions. Defenders use it to compare the real network with the inventory.grep: finds the lines that contain a word, even across whole folders with -r. It is the main tool for analysing text and logs.nc: netcat opens a raw connection to a port and shows what the service answers, including its greeting message (banner).
The simulated environment
You work in a simulated Linux shell, in the home folder of the user runner: invented files and folders, no network target.
Besides the home folder there is a complete simulated system, with configuration files, logs, users and permissions to examine.
Local services also run on the machine:
- FTP: the old file transfer protocol that sends credentials and data in clear text; today it is replaced by SFTP.
- SSH: encrypted remote command-line access; it is protected with keys instead of passwords and without direct root login.
- Web (HTTP): a web server with pages, APIs or admin panels: the most exposed part of almost every organisation.
- Telnet: remote access without encryption: passwords and commands travel in clear text and anyone on the network can read them.
- Database: a database (MySQL, MariaDB or PostgreSQL), which should answer only the services that use it and never the whole network.
The defensive lesson
Once the lab is solved, the write-up explains what went wrong and how to protect yourself:
Every listening service is attack surface: it must be justified or switched off. An inventory of authorised services (and a periodic nmap to compare it with reality) brings the oversights to light: an old telnet on an unusual port, an FTP superseded by SFTP, a database open to the whole network instead of 127.0.0.1. Telnet and FTP send passwords in cleartext: anyone on the network can read them. Defense: switch off what is not needed, make internal services listen on localhost only, filter ports with a firewall and remove the banners that say too much.
Before and after this lab
To unlock it you must have solved:
- Service banners (Recon & Scanning, easy)
- Hardening SSH (Blue Team / Defense, medium)
After this lab you can move on to:
- Responding to an incident (Blue Team / Defense, hard)
The Blue Team / Defense path
Blue Team / Defense is the path of those who protect. You read access logs, count failed attempts to find out who is forcing a login, rebuild the timeline of an incident, compare an SSH configuration with the recommended one, shut down unnecessary services and handle incident response in four steps: detect, contain, clean up, document. The commands are the same as in the other paths, but used through the eyes of someone who must understand what happened and stop it from happening again.