Cybertection Blue for Linux

Tool Description: Cybertection Blue v1.1.1 (Cyberpunk Themed)

This application, Cybertection Blue, functions primarily as an interactive educational tool and Capture The Flag (CTF) platform, disguised as a basic cybersecurity defense interface. It is not a production-ready security tool for real-world use.

Core Purpose:

Simulated Blue Team GUI: It presents a graphical interface mimicking some tools an analyst might use, offering basic views of system status, processes, simulated network traffic, and logs.

CTF Challenge Environment: It contains intentionally embedded vulnerabilities, hidden flags (like CBCTF{...}), and clues designed for cybersecurity training exercises or competitions.

Key Features & Appearance (as of May 3, 2025):

• Cyberpunk Aesthetic: The entire interface is styled with a cyberpunk theme:
  • Colors: Very dark blue/black backgrounds with high-contrast, bright cyan, blue, and magenta text and highlights.
  • Font: Uses a monospaced font (like 'Consolas') for a retro-tech/console feel.
  • Text: Titles, labels, and placeholders often use thematic formatting (e.g., // Title //, [ Tab Name ], CMD >).
  • Cursor: Buttons now display a hand/finger cursor (hand2) on hover for better usability indication.
• Dashboard: Displays basic, live system information (OS, Hostname, IP Address, CPU/Memory Load, App PID). Provides themed quick action buttons ("Net Scan", "Proc Check", "Analyze Log"). Includes context like the current location (Stevensville, MD) in the status bar.
• Network Monitor: Shows simulated network traffic data in a themed table. Includes an "IP Rep Scan" button to check selected IPs against a simple internal blacklist. CTF: Contains the "Debug Key" entry field to trigger a simulated memory leak (Flag 2).
• Process Scanner: Lists live local processes with details (PID, Name, User, CPU%, Mem%, Path). Allows process termination ("Terminate"). Highlights newly started processes green since the last refresh. CTF: Features the "Exec Analysis" field and button, which allows direct, vulnerable shell command execution (Flag 3).
• Log Analyzer: Displays content from log files, allowing loading/replacing or appending. Provides text search ("Find >"). Includes a "Scan Alerts" button for a basic check (e.g., multiple failed logins), highlighting relevant lines red. CTF Hint: The default log file contains a hint for the API port.
• Settings: Contains themed placeholders for options. Displays API connection info (endpoint, partial key). Buttons allow testing the API connection ("Test Uplink") and revealing the hidden Dev Console ("< Enable Dev Console >"). CTF: Partial API key is a hint for Flag 5; Dev Console access is a step in the CTF.
• DevConsole (Hidden Tab): Accessible via Settings. Provides a command-line interface (CMD >). CTF: Executes entered commands directly via the shell, representing a command injection vulnerability (Flag 1).
• Background Vulnerable API: A simple TCP server runs automatically on port 31337. CTF: This service must be interacted with directly (e.g., using netcat or scripting) to retrieve Flag 4 (requires a password) and Flag 5 (via a specific command).
• Minor Robustness: Includes improved checks to prevent some crashes if GUI elements are destroyed unexpectedly during background operations.

In summary, Cybertection Blue v1.1.1 is a stylized, interactive application designed for learning and CTF challenges. It simulates basic security monitoring functions while containing deliberate security flaws for users to find and exploit in a controlled environment.

 

Exploring the Interface (Blue Team Simulation)

Navigate the interface using the tabs at the top. Most buttons display a hand cursor on hover.

• [ Dashboard ] Tab:

  • System Status: View real-time (read-only) information about the machine running the tool (OS, Hostname, IP, CPU/Memory usage, App PID). Refreshes periodically.
  • Quick Actions: Buttons ("Net Scan", "Proc Check", "Analyze Log") provide shortcuts to initiate actions on other tabs.

• [ Net Monitor ] Tab:

  • Simulated Traffic: Use "Capture ON" / "Capture OFF" to start/stop the simulation of network traffic. The table displays fabricated data streams. "Clear" removes entries from the view.
  • IP Reputation: Select one or more rows in the table and click "IP Rep Scan" to check the source/destination IPs against a very basic, internal blacklist. Alerts if a match is found.

• [ Process Scan ] Tab:

  • Process Grid: View a list of live processes currently running on your machine. Click "Refresh List" to update.
  • Highlighting: Processes highlighted green are new since the last refresh.
  • Termination: Select a process and click "Terminate" to attempt to end it (requires appropriate permissions). Use with caution!

• [ Log Analyzer ] Tab:

  • Log Viewing: Displays text content. Starts with cybertection_debug.log. Use "Load/Replace" to open a different log file or "Append Log" to add another file's content to the end of the current view. The "Source:" label tracks the loaded file(s).
  • Search: Enter text in the "Search Pattern" field and click "Find >" (or press Enter) to search the log content. It searches forward from the last position and wraps around.
  • Alert Scan: Click "Scan Alerts" to run a basic, hardcoded check for potential brute-force activity (looks for > 3 "Failed login" lines for the same user). Highlights relevant lines red if the threshold is met.

• [ Settings ] Tab:

  • Parameters: Contains mostly non-functional checkboxes for simulated settings.
  • API Config: Displays the hardcoded API endpoint and a partial, masked API key (related to a CTF flag).
  • API Test: Click "Test Uplink" to send a simple PING to the background API service on port 31337 and see if it responds.
  • Dev Console Access: The "< Enable Dev Console >" button reveals a hidden, advanced tab.

Engaging the CTF Challenges (Red Team Objectives)

Your primary objective is to find five flags in the format CBCTF{...}. Explore the interface thoroughly, looking for weaknesses, hidden inputs, hints, and unintended functionality.

• Flag 1 (Dev Console):

  • Access the hidden < Dev Console > tab via the button in Settings.
  • This console allows direct command execution. Consider the security implications of running commands directly through the application, especially via shell=True. Exploit this for the flag.

• Flag 2 (Net Monitor):

  • Examine the "Debug Auth" section in the Network Monitor tab.
  • What happens if you enter specific keys into the "// Debug Key..." field? Look for unusual application behavior or direct flag reveals upon entering the correct trigger key (MEM_LEAK_TRIGGER_KEY defined in the source).

• Flag 3 (Process Scan):

  • The "Exec Analysis" field and button are designed for running commands.
  • Analyze how the application handles the input provided here. Can you execute arbitrary system commands? Exploit this command injection vulnerability. The flag is shown in a messagebox upon successful (vulnerable) execution.

• Flag 4 (Background API - Password):

  • The default log file (cybertection_debug.log loaded initially) contains a hint about the API port (31337).
  • You need to connect to this port externally (using tools like netcat, telnet, or a simple Python script).
  • Once connected, use the HELP command. Find the command to get Flag 4. It requires the hidden_backdoor_password found within the source code.

• Flag 5 (Background API / Settings):

  • The Settings tab shows a partial API key.
  • Connect to the background API service (port 31337) externally.
  • Use the HELP command to find a way to retrieve configuration details (like GET_CONFIG). This command will reveal the full API key, which is Flag 5.

Conclusion: Mission Debrief

Cybertection Blue is a training ground. Use the simulated blue team tools to understand the interface, then switch your mindset to find the embedded flags. Pay attention to hints, error messages, source code (if available), and network services. Good luck, Operator. Interface termination sequence available via window close button.

Lisense Agreement

By downloading, installing, or using the Cybertection Blue, you agree to abide by the terms of this license agreement.

• Grant of License: Cybertection grants you a non-exclusive, non-transferable license to use this software for personal or professional use, in accordance with the terms and conditions outlined herein.
• Prohibited Actions: You may not:
  • Modify, reverse-engineer, decompile, or disassemble the software.
  • Distribute, sublicense, or sell the software to third parties without explicit permission.
• Ownership Rights: All intellectual property rights and ownership of the Cybertection Blue remain solely with Cybertection. This license does not convey any ownership rights.
• Liability Disclaimer: Cybertection is not responsible for any damages resulting from the use or inability to use the software. Users are advised to operate the software at their own risk.
• Termination: This license agreement is effective until terminated. Cybertection reserves the right to terminate your access if you violate any terms.
• Updates & Support: Access to updates and support may be provided at Cybertection's discretion. No guarantees are made regarding the frequency or availability of updates.
• For any questions or to request additional permissions, contact Cybertection support at cybertection@cybertection.net