CTF competitions/challenges that are Windows based?

Question

I've been messing about in CTF's for a while and I also do pen-testing professionally, what i've noticed is a distinct lack of CTF competitions using windows environments.

This is in stark contrast to the majority of environments I test professionally (that's not to say there isn't *nix used heavily in the environments), just that its (IMHO) way more beneficial to go after the AD infrastructure and the clients rather than exploit a single unix box at a time.

While there's plenty of RE/Binary challenges out there for Windows environments, i'm yet to see a good CTF run which uses Windows networks rather than *nix variants. I might be totally wrong or just playing with lame challenges but I suspect that licensing issues plays a large part.

I feel this is important as when grads and other people keen on getting into info-sec start I often recommend playing with CTF's and doing other challenges/virtual environments. What i haven't been able to recommend is a resource that helps with exploiting Windows environments. Plenty exist for Web-apps for example pen-tester labs has pre-configured ready to go VM's for web-app testing which I find great. I think it'd be awesome if something like that existed for specific attack scenarios on Windows as well.

What I'm asking for is the following:

• Are there any CTF competitions that run that include Simulated Windows networks as part of the challenges (not just the usual RE binary challenges)?

• Are there any downloadable Windows VM's which come pre-configured (Say AD server and 2x client PC's joined to a domain for example but preferably with different configurations say for example kerberos)?

• Aside from licensing issues, is there any technical reason why running Windows CTF's isn't practical? I can imagine running a Windows machine as a Virtual one is simple enough to snapshot and restore if someone playing is a jerk and decides to try and trash the machine.

Answer 1

As a member of the active CTF team, which organized some competitions, I think I could say a few words how does it look from the inside.

First of all the licensing problem is in fact the main problem. But following your questions:

Are there any CTF competitions that run that include Simulated Windows networks as part of the challenges (not just the usual RE binary challenges)?

I don't know exactly what do you mean by "Simulated Windows networks" but I guess you mean some kind of the vpn networks or other kind of virtualized networks in where you would need to find some vulnerable hosts and exploit them. The idea is good and I think the main limitation in here are the paid licenses of Windows products. In fact it quite hard to find any sponsor for the competitions (we often cooperate only with the organizers of the conferences where the CTF take place) and gain the money for this kind of request. Having in mind that we'd need to invest not only our time but also private money for the challenges, the choice between free Linux systems and their paid Windows counterparts is not very hard. What's more I've never heard about "two-days" Windows licenses and they would be the best solution in case of CTF games. The single license shared between different competitions is not the perfect solution too. Because of the aim of such competitions and nature of the players we need to consider the situation that our license key will be stolen. To prevent such a situation we would need to use some MAC, write the policy and hardend the system itself to don't let the players hack us too much. In my personal opinion it is much easier to do it on Linux than on the Windows systems. Summing up, because of reasons I've mentioned it's not profitable to setup such environments, even if it would be cool from contestant perspective to play on it.

Are there any downloadable Windows VM's which come pre-configured (Say AD server and 2x client PC's joined to a domain for example but preferably with different configurations say for example kerberos)?

No, because of licensing reasons. I don't know if it could be ever possible. We could store the configuration itself that need to be applied or create the software that places the bug - but it's pointless in case of CTF competitions. It would be much easier to hack if you known where to look for a bug. What's more you'd require from user to have the exact copy of the system on his machine which is not preferable. The competitions should test mainly the skills - not the possessed resources (software & hardware).

Aside from licensing issues, is there any technical reason why running Windows CTF's isn't practical? I can imagine running a Windows machine as a Virtual one is simple enough to snapshot and restore if someone playing is a jerk and decides to try and trash the machine.

Merging first and second answer... In case of online challenges - technically we'd need to assure the security of the host which for me looks harder than in case of open systems. For heavy-load challenges we would need multiple licences for all of the machines running behind load balancer. In case of offline challenges - we would require from user to posses exactly the same system or software which is not good - we would prioritize resources over the skills of the player.

Answer 2

The best environment I've found so far for Windows exploitation would have to be the OSCP labs (and you get a qualification at the end if you pass!). It is a big network with a fair mix of Windows and other OS's although it is dominantly Windows.

As far as I'm aware there are none that exist, people have them though do not make them available due to licensing concerns as you previously mentioned. This applies to both downloads and people / groups that run CTF challenges.