This is a guide to securing a machine based on my experience in CCDC competitions.
1. Backup
This matters because if Red Team gets in and encrypts or deletes important data, you still have a clean snapshot to recover from.
Linux
Backup web data
sudo tar -czf /root/web_backup.tar.gz /var/www
Backup configs
sudo tar -czf /root/config_backup.tar.gz /etc
Backup databases
mysqldump -u root -p --all-databases > db_backup.sql
Windows
Backup important directories
robocopy C:\inetpub C:\backup /E
2. Change Default Credentials
Change defaults early because once Red Team finds a weak or default credential, they can often move quickly across the environment.
This includes:
- root or administrator passwords
- user passwords
- service account passwords
- database credentials
- SSH keys
Linux
List users:
getent passwd
Change a password:
sudo passwd USERNAME
Windows
List users:
net user
Get-LocalUser
Change a password:
net user USERNAME NEW_PASSWORD
3. Terminate Unnecessary Services
Once the obvious front door is closed, reduce attack surface by shutting down services the machine does not actually need for scoring.
Start by identifying the host’s intended role from the team packet, then compare running services against the expected role baseline:
After that, close ports and disable services that are not required.
4. Inspect Active Services for Vulnerabilities
After unnecessary services are disabled, the remaining exposed services become the primary attack surface. I break service review into four buckets:
- Out of Date Service Versions
- Misconfigurations
- Weak Authentication and Access Control
- Monitoring and Detection Gaps
Start with internet-facing services first, then move inward to internal-only services.
5. Look Through the System for Remaining Vulnerabilities
Once exposed services are reviewed, continue with broader host checks:
- turn on Windows Defender where applicable
- review autostarting applications and scheduled tasks
- look for suspicious files, scripts, and persistence points
- remove software or tools that should not be present