feeling_blu.xml

<?xml version="1.0"?>

<scenario xmlns="http://www.github/cliffe/SecGen/scenario"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          xsi:schemaLocation="http://www.github/cliffe/SecGen/scenario">

  <name>Feeling Blu</name>
  <author>Z. Cliffe Schreuders</author>
  <description>
    A small flat-file blogging platform is running on the web server, and staff login
    credentials have been carelessly left somewhere a directory-discovery tool would find them.
    Log in with what you uncover, then abuse a path-traversal flaw hiding behind the platform's
    image upload feature to plant a web shell and get remote code execution - enough for a
    foothold and the first flag from a user's home directory. A misconfigured sudo rule around
    a common file-pager utility then hands you a root shell and a second flag. Once you're root,
    you'll find a password-protected zip archive sitting there waiting to be cracked - dig up
    what you can about the organisation's staff for the clue you need to reveal one last flag.
  </description>

  <type>ctf</type>
  <type>attack-ctf</type>
  <type>pwn-ctf</type>
  <difficulty>medium</difficulty>

  <!-- bludit -->
  <CyBOK KA="WAM" topic="Fundamental Concepts and Approaches">
    <keyword>authentication</keyword>
    <keyword>passwords and alternatives</keyword>
  </CyBOK>
  <CyBOK KA="AAA" topic="Authentication">
    <keyword>user authentication</keyword>
    <keyword>BRUTEFORCE</keyword>
  </CyBOK>
  <CyBOK KA="WAM" topic="Server-Side Vulnerabilities and Mitigations">
    <keyword>server-side misconfiguration and vulnerable components</keyword>
    <keyword>FILE UPLOAD VULNERABILITY</keyword>
  </CyBOK>
  <CyBOK KA="MAT" topic="Attacks and exploitation">
    <keyword>EXPLOITATION</keyword>
    <keyword>EXPLOITATION FRAMEWORKS</keyword>
  </CyBOK>
  <CyBOK KA="SS" topic="Categories of Vulnerabilities">
    <keyword>CVEs and CWEs</keyword>
  </CyBOK>
  <CyBOK KA="SOIM" topic="PENETRATION TESTING">
    <keyword>PENETRATION TESTING - SOFTWARE TOOLS</keyword>
    <keyword>PENETRATION TESTING - ACTIVE PENETRATION</keyword>
  </CyBOK>

  <!-- escalate to user and to root via sudo -->
  <CyBOK KA="AAA" topic="Authorisation">
    <keyword>access control</keyword>
    <keyword>Elevated privileges</keyword>
    <keyword>Vulnerabilities and attacks on access control misconfigurations</keyword>
  </CyBOK>
  <CyBOK KA="OSV" topic="Primitives for Isolation and Mediation">
    <keyword>Access controls and operating systems</keyword>
    <keyword>Linux security model</keyword>
    <keyword>Attacks against SUDO</keyword>
  </CyBOK>

  <CyBOK KA="AB" topic="Models">
    <keyword>kill chains</keyword>
  </CyBOK>
  <CyBOK KA="MAT" topic="Malicious Activities by Malware">
    <keyword>cyber kill chain</keyword>
  </CyBOK>

  <!-- decrypt zip file -->
  <CyBOK KA="AC" topic="Symmetric Cryptography">
    <keyword>symmetric encryption and authentication</keyword>
  </CyBOK>
  <CyBOK KA="AAA" topic="Authentication">
    <keyword>BRUTEFORCE</keyword>
  </CyBOK>


  <system>
    <system_name>attack_vm</system_name>
    <base distro="Kali" name="MSF"/>


    <input into_datastore="IP_addresses">
      <!-- 0 attack_vm -->
      <network_ip system="attack_vm"/>
      <!-- 1 hackme_server -->
      <network_ip system="web_server"/>
    </input>

    <utility module_path=".*/parameterised_accounts">
      <input into="accounts">
        <value>{"username":"kali","password":"kali","super_user":"true","strings_to_leak":[],"leaked_filenames":[]}</value>
      </input>
    </utility>

    <utility module_path=".*/iceweasel">
      <input into="accounts">
        <value>{"username":"kali","password":"kali","super_user":"true","strings_to_leak":[],"leaked_filenames":[]}</value>
      </input>
      <input into="autostart">
        <value>true</value>
      </input>
      <input into="start_page">
        <datastore access="1">IP_addresses</datastore>
      </input>
    </utility>

    <utility module_path=".*/kali_top10"/>
    <utility module_path=".*/kali_web"/>

    <network type="private_network"/>
    <input into_datastore="spoiler_admin_pass">
      <generator type="strong_password_generator"/>
    </input>
    <build type="cleanup">
      <input into="root_password">
        <datastore>spoiler_admin_pass</datastore>
      </input>
    </build>
  </system>

  <system>
    <system_name>web_server</system_name>
    <base distro="Debian 12" type="desktop" name="KDE"/>

    <input into_datastore="organisation">
      <encoder type="line_selector">
        <input into="file_path">
          <value>lib/resources/structured_content/organisations/json_organisations</value>
        </input>
      </encoder>
    </input>

    <!-- bludit requires a password >= 6 characters long -->
    <input into_datastore="password">
        <generator type="random_sanitised_word">
        <input into="wordlist">
          <value>wordlist</value>
        </input>
        <input into="min_length">
          <value>6</value>
        </input>
      </generator>
    </input>


    <!--Create the user-->
    <utility module_path=".*/parameterised_accounts">
      <input into="accounts">
        <generator type="account">
          <input into="username">
            <datastore access_json="['manager']['username']">organisation</datastore>
          </input>
          <input into="password">
            <datastore>password</datastore>
          </input>
          <input into="super_user">
            <value>false</value>
          </input>
          <input into="leaked_filenames">
            <value>flag</value>
          </input>
          <input into="strings_to_leak">
            <generator type="flag_generator"/>
          </input>
        </generator>
      </input>
    </utility>

    <vulnerability module_path=".*/bludit_upload_images_exec">
      <input into="strings_to_leak">
        <generator type="flag_generator"/>
      </input>
      <input into="organisation">
        <datastore>organisation</datastore>
      </input>
      <input into="known_username">
        <datastore access_json="['manager']['username']">organisation</datastore>
      </input>
      <input into="known_password">
        <datastore>password</datastore>
      </input>
      <input into="strings_to_pre_leak">
        <value>Creds:</value>
        <datastore access_json="['manager']['username']">organisation</datastore>
        <datastore>password</datastore>
        <generator type="flag_generator"/>
      </input>
    </vulnerability>

    <vulnerability module_path=".*/sudo_root_less">
      <input into="strings_to_leak">
        <generator type="flag_generator"/>
      </input>
      <input into="strings_to_pre_leak">
        <generator type="flag_generator"/>
      </input>
    </vulnerability>

    <vulnerability type="zip_file">
      <input into="base64_file">
        <generator type="zip_file_generator">
          <input into="password">
            <datastore access_json="['manager']['name']">organisation</datastore>
          </input>
          <input into="strings_to_leak">
            <generator type="flag_generator"/>
            <value>
              Congratulations you have cracked our protected zip file. Here is a flag for your troubles.
            </value>
          </input>
        </generator>
      </input>
      <input into="leaked_filename">
        <value>whatsmyname.zip</value>
      </input>
      <input into="storage_directory">
        <value>/root</value>
      </input>
    </vulnerability>


    <network type="private_network"/>
    <build type="cleanup">
      <input into="root_password">
        <datastore>spoiler_admin_pass</datastore>
      </input>
    </build>
  </system>

</scenario>