🚗 WRCCDC 2026 - Otto's Auto Autos - Quick Reference

NETWORK TOPOLOGY

FIRST 30 MINUTES

0-10 min: Secure Access

1. Change ALL admin/root passwords
2. Check for rogue admins (UID 0, Domain Admins)
3. Document changes on shared sheet
4. Verify you can still login after each change

10-20 min: Inventory

1. Run port scans: nmap -sT 192.168.220.0/24
2. List services: ss -tulnp / netstat -ano
3. Check cron/scheduled tasks
4. Check authorized_keys on Linux

20-30 min: Harden

1. Enable firewalls
2. Disable unnecessary services
3. Verify scoring engine sees services UP
4. Team brief - what did everyone find?

WINDOWS COMMANDS

Users

net user                           # list users
net localgroup administrators      # check admins
net user badguy /active:no         # disable
net user admin NewP@ss123!         # change pw

Connections

netstat -ano                       # all connections
netstat -ano | findstr ESTAB       # established
tasklist /v                        # processes
taskkill /PID 1234 /F              # kill process

Persistence

schtasks /query /fo LIST /v        # scheduled tasks
schtasks /delete /tn "Name" /f     # delete task
sc query state= all                # services
sc stop svcname                    # stop service
sc config svcname start= disabled  # disable

Firewall

netsh advfirewall show allprofiles
netsh advfirewall set allprofiles state on
netsh advfirewall firewall add rule name="Block" dir=in action=block protocol=tcp localport=4444

LINUX COMMANDS

Users

cat /etc/passwd | grep bash        # users w/ shell
awk -F: '$3==0 {print}' /etc/passwd # UID 0 (BAD!)
usermod -L baduser                 # lock account
passwd username                    # change pw

Connections

ss -tulnp                          # listening ports
ss -tunp | grep ESTAB              # established
ps auxww                           # all processes
lsof -i :4444                      # proc on port
kill -9 PID                        # kill process

Persistence

crontab -l                         # user cron
cat /etc/crontab                   # system cron
ls /etc/cron.d/                    # cron.d jobs
find /home -name authorized_keys   # SSH keys

Firewall

iptables -L -n -v                  # list rules
iptables -A INPUT -p tcp --dport 4444 -j DROP
iptables-save > /etc/iptables.rules

ROUTER (miata) - CAREFUL!

nftables

nft list ruleset                   # view all
nft list table nat                 # view NAT
nft add rule inet filter input tcp dport 4444 drop

iptables

iptables -L -n -v                  # view rules
iptables -t nat -L -n -v           # view NAT
iptables -A INPUT -p tcp --dport 4444 -j DROP

DO NOT:

• Flush rules without documenting first
• Block scoring engine traffic
• Delete admin user
• Disable syslog or WAN access

HUNT RED TEAM

Look For:

• Backdoor accounts: UID 0, Domain Admins
• Persistence: cron, schtasks, services
• Reverse shells: ports 4444, 5555, 8080
• SSH keys: unauthorized authorized_keys
• Web shells: .php files in /var/www

Incident Response:

1. CALL OUT: "CONTACT on [system]!"
2. IDENTIFY: What PID? What user? What port?
3. KILL: kill -9 PID / taskkill /F
4. BLOCK: Firewall the source IP
5. FIND: How did they get in?

KUBERNETES (pinto)

kubectl get all -A                 # all resources
kubectl get pods -A                # list pods
kubectl get svc -A                 # list services
kubectl get secrets -A             # list secrets
kubectl delete pod NAME -n NS      # delete pod
kubectl scale deploy NAME --replicas=0 -n NS
kubectl logs PODNAME -n NS         # view logs

Red Flags:

• Unknown pods in kube-system
• privileged: true containers
• ServiceAccounts with cluster-admin

COMMUNICATION

Call-Outs:

• "CONTACT!" - Active attacker
• "SERVICE DOWN!" - Scored service failed
• "PASSWORD CHANGED [sys]" - Announce
• "INJECT [#] CLAIMED" - Taking inject
• "NEED BACKUP" - Request help

Inject Rules:

• File: inject04_team13.pdf
• NO AI - 20% detection = 0 points
• Read inject TWICE before starting
• Cite sources