Red Line

Red Line is a mission available on CSEC, as Check out a suspicious server.

## Summary

I ran into a strange looking server - security looks a bit tighter than I can manage so I didn't test it, but someone here might want to check it out.

## Email from Client

Hey,

Dont know if you'll find anything here, but I thought you might want to check it out - I ran into this server with some scannng software - it's got a trace on it so I didn't poke around too much, but someone more experience might want to give it a look.

Let me know if you find anything or if it's super secure or something!

-Anon

## Walkthrough

You're asked to investigate a server, CCC Hacksquad Filedump. The server has an extremely fast trace, making attempts to breach it near impossible.

Because of that, this is considered one of the hardest tasks in the entire game. However, hacking the server is optional.

### Method 1: Do nothing

You can reply to the email instantly after you get it, and the mission will be marked as complete. However, if you'd like to complete it in a more legitimate way, you can attempt to breach the server and reply later (indicating a failure to do so).

#### 1.1 Get traced

Connect to CCC Hacksquad Filedump, and run a port cracker (Web Server Worm, SecureShellCrack or the SQL Memory Corruption Injector). Allow the trace to complete, boot into emergency recovery mode and reset your IP. After you're done, reply to the email.

#### 1.2 Avoid the trace

Connect to CCC Hacksquad Filedump, and run a port cracker (Web Server Worm, SecureShellCrack or the SQL Memory Corruption Injector). This time, disconnect before the trace hits zero, and reply to the email.

### ~~Method 2: Exploit the Emergency Trace Aversion Sequence~~

This method used to exploit a bug that was patched. You can still use it if you have SecurityTracer.

* Connect to CCC Hacksquad Filedump.
* Run a port cracker (Web Server Worm, SecureShellCrack or the SQL Memory Corruption Injector), let the trace complete.
* Once the emergency recovery mode activates, reconnect to CCC Hacksquad Filedump and run a port cracker; let the trace complete.
* Repeat the step above until all ports are unlocked, run SecurityTracer.exe, then run PortHack.
* (Optionally) copy Honey\_x-server.sys from the sys folder, delete the logs and disconnect.
* Hack into your ISP and reset your IP, or reboot your computer.
* Reply to the email and complete the mission.
* Enjoy the theme!

### Method 3: Use SecurityTracer

If you have kept SecurityTracer, by moving/copying it instead of deleting it when Bit asked you to, it can help you bypass the server's fast trace. Only one trace can be active, which means that if you've started another trace, the server's trace will not occur.

1. Connect to CCC Hacksquad Filedump.
2. Run SecurityTracer.exe and then a port cracker of your choice (Web Server Worm, SecureShellCrack or the SQL Memory Corruption Injector).
3. When the trace is nearing completion, type ps and find the process ID for Security Tracer, then kill it (kill PID, replace PID with the process ID).
4. Once the port cracker is done, run SecurityTracer.exe, then run another port cracker of your choice.
5. Repeat the previous two steps until all ports are unlocked, then run SecurityTracer.exe and PortHack.
6. Once you've gained admin, repeat the third step if you do not want to get traced.
7. (Optionally) copy Honey\_x-server.sys from the sys folder, delete the logs and disconnect.
8. Reply to the email and complete the mission.

### Method 4: Password guess

Unless you're a genius, you will either find this password on the Internet or by finding the CCC Hacksquad Filedump's game file. Note that if you attempt to hack the server even once, the password will be permanently reset and you'll be unable to login with these credentials.

1. Guess the password (it is honeypot).
2. (Optionally) copy Honey\_x-server.sys from the sys folder, delete the logs, and disconnect.
3. Reply to the email and complete the mission. You can include the password in your reply, but it will be changed on your disconnect so it is useless.

### Console Commands

#### PortCrackers

* SQL\_MemCorrupt.exe / SQLBufferOverflow.exe
* WebServerWorm.exe
* SSHcrack.exe

#### Exiting / rebooting

* dc (for disconnecting)
* ForkBomb (forcing a crash)
* reboot (with the paramater -i for instant reboot)

## Trivia

The server's original admin password, honeypot, suggests it could be a baiting server for attackers (from Wikipedia: a honeypot is a computer security mechanism set to detect, deflect, or, in some manner, counteract attempts at unauthorized use of information systems). This can explain the extremely fast trace, as an attempt to locate the attacker.

A honeypot reference also exists in the mission Are you kidding me?, where Naix says that you "couldn't hack a \*\*\*\*\*\*\* honeypot".