Skip to content

Working with Competition Images

Every competition image is a virtual machine (VM): a complete operating system running inside VMware on your computer. This page covers getting one running and the first ten minutes after it boots.

Before the round

Enable virtualization in the BIOS

VMware needs the CPU's virtualization extensions turned on. If an image refuses to start with an error about VT-x or AMD-V, this is why.

Reboot, enter the BIOS/UEFI setup (usually Del, F2, or F10 during startup), and look under Advanced or CPU settings for one of: Intel Virtualization Technology, VT-x, AMD-V, SVM Mode. Enable it, save, and reboot. Do this on every team machine before the first practice round, not the morning of Round 1.

Verify the checksum

A checksum is a fingerprint calculated from a file's contents. CyberPatriot publishes one for each image. If your download's checksum doesn't match, the file is corrupt or incomplete and the image may not score. Check it before you extract.

Get-FileHash .\image.zip -Algorithm SHA256

sha256sum image.zip

Compare to the published value character by character.

Extract

The StartEx email has the extraction password. Extract to a folder on a local drive with plenty of space, not a network share or USB stick.

VMware files

An image is a folder of files. Don't rename, move, or edit any of them.

Extension What it is
.vmx The configuration file. This is the one you open.
.vmdk The virtual hard disk
.nvram The VM's BIOS settings

Opening the image

  1. Open VMware Workstation.
  2. Click Open a Virtual Machine.
  3. Browse to the extracted folder and select the .vmx file.
  4. Click Play virtual machine.
  5. When asked whether you moved or copied it, choose I copied it.
  6. Click OK on the Removable Devices message.
  7. Log in with the account in the StartEx email if it doesn't log in automatically.

The first ten minutes

Do these in order before you change anything else.

1. Enter your team ID. The scoring engine won't report until you do.

2. Open the Scoring Report shortcut on the desktop. Confirm it shows connected. If it doesn't, fix that before anything else; work done while disconnected may not count.

3. Read the README on the desktop, twice. It tells you:

  • The scenario: what the company does and what this machine is for
  • Authorized users, and which of them are administrators
  • Required services and software (the things you must not remove)
  • Any hints

Write the authorized user list and the required services down. You'll check every account and service against them.

4. Answer the forensics questions. They're files on the desktop. Do them before hardening, because hardening changes the evidence. A forensics question might ask for a file's hash, a user's last login, or what program is listening on a port, and deleting the user or stopping the service first makes the answer harder to get.

5. Take a snapshot (VM menu → Snapshot → Take Snapshot) so you can roll back if a change breaks the image. Check the current rules book on snapshot use.

6. Start the slow things. Kick off Windows Update or apt upgrade and a full antivirus scan in the background, then work through accounts and services while they run.

Rules that cost points

  • Never touch anything in the CyberPatriot folder. That's the scoring engine.
  • Don't remove users, software, or services the README says the company needs.
  • Don't upgrade the OS to a new release. Patch it, don't replace it.
  • Don't connect the image to anything it doesn't need. No tools from outside the image unless the rules allow it.
  • Server time is official. Four hours from when you start, not from when you get going.

Next

Windows or Linux, depending on the image.