【TryHackMe】Red Team Engagements：Walkthrough

# 概要

TryHackMe「Red Team Engagements」のWalkthroughです。

https://tryhackme.com/r/room/redteamengagements

# Task2

## **Q2**.*What CIDR range is permitted to be attacked?*

**A**.**10.0.4.0/22**

## **Q3**.*Is the use of white cards permitted? (Y/N)*

**A**.**Y**

## **Q4**.*Are you permitted to access "*.bethechange.xyz?" (Y/N)*

**A**.**N**

# Task3

右上の`Download Task Files`ボタンをクリックしてpdfファイルをダウンロードします。

![task3 pdf.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/745df2a4-7925-728c-46dd-013a585b8f44.png)

## **Q2**.*How many explicit restriction are specified?*

`Explicit Restriction(明示的な制限)`として下記3つが記載されています。

```
Explicit Restrictions:
• Use of white cards are strictly prohibited
• Any form of DDoS or DoS is prohibited
• Attacks against any system within 192.168.1.0/24 is prohibited
```

**A**.**3**

## **Q3**.*What is the first access type mentioned in the document?*

アクセスタイプとして下記が言及されています。

```
Access Types
• Phishing
• Physical and social engineering
```

**A**.**Phishing**

## **Q4**.*Is the red team permitted to attack 192.168.1.0/24? (Y/N)*

許可されているスコープ外なので`192.168.1.0/24`には攻撃することが出来ません。

```
Authorized Target Space:
• 10.0.4.0/22
• *.bethechange.xyz, *.globalenterprises.thm
```

**A**.**N**

# Task6

## **Q3**.*How long will the engagement last?*

**A**.**a month**

## **Q4**.*How long is the red cell expected to maintain persistence?*

**A**.**3 Weeks**

## **Q5**.*What is the primary tool used within the engagement?*

**A**.**Cobalt Strike**

# Task7

右上の`View Site`をクリックして、資料を開きます。

![Task7 view site.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/aaea6589-c76d-2dd9-899f-2c82ae8dfe17.png)

## **Q2**.*When will the engagement end? (MM/DD/YYYY)*

**Hint**.*Found under "Execution Dates"*

`Execution Dates(実行日)`項目に記載されている最終日が`11/14/2021`までになっています。

```
Post-Exploitation and Persistence: 10/24/2021 - 11/14/2021
```

**A**.**11/14/2021**

## **Q3**.*What is the budget the red team has for AWS cloud cost?*

**Hint**.*Found under "Cloud Requirements"*

`Cloud Requirements`項目に予算が記載されています。

```
Red Cell is requesting a budget of $1000 for AWS cloud costs
```

**A**.**$1000**

## **Q4**.*Are there any miscellaneous requirements for the engagement? (Y/N)*

**Hint**.*Found under "Misc. Requirements"*

`Misc. Requirements(その他の要件)`はありません。

```
No other requirements are currently projected
```

**A**.**N**

# Task8

右上の`View Site`をクリックして資料を開きます。

![Task8 site view.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/a87120da-cdd1-d370-23bc-5bb0bb999258.png)

## **Q2**.*What phishing method will be employed during the initial access phase?*

**Hint**.*Found under "Planned TTPs and Attacks"*

`Planned TTPs and Attacks`にフィッシングの計画が記載されています。

```
1. Due to the discovery of email addresses in the reconnaissance phase, spearphishing via mshta and typosquatted domains will be employed in the initial access phase.
```

**A**.**spearphishing**

## **Q3**.*What site will be utilized for communication between the client and red cell?*

**Hint**.*Found under "Communications Plan"*

`Communications Plan`項目に詳細が記載されています。

```
Throughout the engagement the red cell will utilize vectr.io to communicate internally and with the client
```

**A**.**vectr.io**

## **Q4**.*If there is a system outage, the red cell will continue with the engagement. (T/F)*

**Hint**.*Found under "Halting/Stopping Conditions"*

`Halting/Stopping Conditions`項目にシステムが停止した際の詳細が記載されています。

```
1. In the event of a system outage all engagement operations will cease
```

**A**.**F**

# Task9

右上の`View Site`をクリックして資料を開きます。

![Task9 view site.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/a8b8dd14-9672-1ff8-e718-9d86b9783a2a.png)

## **Q2**.*When will the phishing campaign end? (mm/dd/yyyy)*

**Hint**.*Found under "Engagement Breakdown"*

`Engagement Breakdown`項目に詳細が記載されています。

```
Phishing campaign will last from 10/13/2021-10/23/2021.
```

**A**.**10/23/2021**

## **Q3**.*Are you permitted to attack 10.10.6.78? (Y/N)*

**Hint**.*Found under "Targets"*

`Targets`項目では`10.10.6.29`をターゲットにしていると記載されているのでスコープ外です。

**A**.**N**

## **Q4**.*When a stopping condition is encountered, you should continue working and determine the solution yourself without a team lead. (T/F)*

**Hint**.*Found under "Execution Variants"*

`Execution Variants`項目に詳細が記載されています。

```
In the event of any varying events throughout the engagement, immediately contact a team lead and disuss how to continue.
```

**A**.**F**