flawed_fortress.xml

<?xml version="1.0"?>

<scenario xmlns="http://www.github/cliffe/SecGen/scenario"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xsi:schemaLocation="http://www.github/cliffe/SecGen/scenario">

  <name>Flawed Fortress</name>
  <author>Z. Cliffe Schreuders</author>
  <author>Thomas Shaw</author>
  <description>A three VM full day intermediate CTF, with a range of challenges of various difficulty.
    The three VMs are not related to each other.
    We have used this to host events with university students.
  </description>

  <type>ctf</type>
  <type>attack-ctf</type>
  <type>pwn-ctf</type>
  <difficulty>intermediate</difficulty>

  <CyBOK KA="AC" topic="Symmetric Cryptography">
    <keyword>symmetric encryption and authentication</keyword>
  </CyBOK>
  <CyBOK KA="F" topic="Artifact Analysis">
    <keyword>cryptographic hashing</keyword>
    <keyword>Encoding and alternative data formats</keyword>
  </CyBOK>

  <!-- remote vuln -->
  <CyBOK KA="MAT" topic="Attacks and exploitation">
    <keyword>EXPLOITATION</keyword>
    <keyword>EXPLOITATION FRAMEWORKS</keyword>
  </CyBOK>
  <CyBOK KA="SOIM" topic="PENETRATION TESTING">
    <keyword>PENETRATION TESTING - SOFTWARE TOOLS</keyword>
    <keyword>PENETRATION TESTING - ACTIVE PENETRATION</keyword>
  </CyBOK>

  <!-- escalate to user and to root -->
  <CyBOK KA="AAA" topic="Authorisation">
    <keyword>Elevated privileges</keyword>
  </CyBOK>

  <CyBOK KA="AB" topic="Models">
    <keyword>kill chains</keyword>
  </CyBOK>
  <CyBOK KA="MAT" topic="Malicious Activities by Malware">
    <keyword>cyber kill chain</keyword>
  </CyBOK>

  <!-- a large scenario -->

  <system>
    <system_name>attack_vm</system_name>
    <base distro="Kali" name="MSF"/>


    <input into_datastore="IP_addresses">
      <network_ip system="attack_vm"/>
      <network_ip system="decode_me"/>
      <network_ip system="in_the_wild"/>
      <network_ip system="that_escalated_quickly"/>
    </input>
    
    <utility module_path=".*/parameterised_accounts">
      <input into="accounts">
        <value>{"username":"kali","password":"kali","super_user":"true","strings_to_leak":[],"leaked_filenames":[]}</value>
      </input>
    </utility>

    <utility module_path=".*/iceweasel">
      <input into="accounts">
        <value>{"username":"kali","password":"kali","super_user":"true","strings_to_leak":[],"leaked_filenames":[]}</value>
      </input>
      <input into="autostart">
        <value>false</value>
      </input>
    </utility>

    <utility module_path=".*/kali_top10"/>
    <utility module_path=".*/kali_web"/>

    <network type="private_network"/>
    <input into_datastore="spoiler_admin_pass">
      <generator type="strong_password_generator"/>
    </input>
    <build type="cleanup">
      <input into="root_password">
        <datastore>spoiler_admin_pass</datastore>
      </input>
    </build>
  </system>

  <!--some basic decoding challenges-->
  <system>
    <system_name>decode_me</system_name>
    <base platform="linux" type="server"/>

    <!-- comment describes using pseudo code (C#-like methods with named optional arguments) -->
    <!-- vulnerability_nfs_share_leak(strings_to_leak: encoder_flag_generator() CONCAT encoder_ascii_reversible(strings_to_encode: encoder_flag_generator()) CONCAT ...) -->
    <vulnerability name="NFS Share Leak">
      <input into="strings_to_leak" unique_module_list="unique_encoders">
        <generator type="flag_generator" />
        <encoder type="ascii_reversible">
          <input into="strings_to_encode">
            <generator type="flag_generator" />
          </input>
        </encoder>
        <encoder type="alpha_reversible">
          <input into="strings_to_encode">
            <generator type="flag_generator" />
          </input>
        </encoder>
        <encoder type="ascii_reversible">
          <input into="strings_to_encode">
            <generator type="flag_generator" />
          </input>
        </encoder>
        <encoder type="ascii_reversible">
          <input into="strings_to_encode">
            <generator type="flag_generator" />
          </input>
        </encoder>
        <encoder type="ascii_reversible">
          <input into="strings_to_encode">
            <generator type="flag_generator" />
          </input>
        </encoder>
        <encoder type="ascii_reversible">
          <input into="strings_to_encode">
            <encoder type="ascii_reversible">
              <input into="strings_to_encode">
                <generator type="flag_generator" />
              </input>
            </encoder>
          </input>
        </encoder>
        <encoder type="alpha_reversible">
          <input into="strings_to_encode">
            <generator type="flag_generator" />
          </input>
        </encoder>
      </input>
    </vulnerability>

    <network type="private_network"/>
    <build type="cleanup">
      <input into="root_password">
        <datastore>spoiler_admin_pass</datastore>
      </input>
    </build>
  </system>


  <!--a few vulnerabilities that are in the wild, with some flags that need decoding, some red herring services to keep things interesting-->
  <system>
    <system_name>in_the_wild</system_name>
    <base platform="linux" type="server"/>

    <vulnerability read_fact="strings_to_leak" access="remote" privilege="user_rwx">
      <input into="strings_to_leak">
        <generator type="flag_generator" />
        <encoder type="ascii_reversible">
          <input into="strings_to_encode">
            <generator type="flag_generator" />
          </input>
        </encoder>
      </input>
    </vulnerability>

    <!--double encoded-->
    <vulnerability read_fact="strings_to_leak" access="remote" privilege="user_rwx">
      <input into="strings_to_leak">
        <generator type="flag_generator" />
        <encoder type="ascii_reversible">
          <input into="strings_to_encode">
            <encoder type="ascii_reversible">
              <input into="strings_to_encode">
                <generator type="flag_generator" />
              </input>
            </encoder>
          </input>
        </encoder>
      </input>
    </vulnerability>

    <!-- vulnerability which can leak images, leak 2 image challenges and a random red-herring image -->
    <vulnerability read_fact="images_to_leak">
      <input into="images_to_leak">
        <generator read_fact="strings_to_leak" type="image_generator" >
          <input into="strings_to_leak">
            <generator type="flag_generator" />
          </input>
        </generator>
        <generator type="image_generator"/>
        <generator read_fact="strings_to_leak" type="image_generator" >
          <input into="strings_to_leak">
            <generator type="flag_generator" />
          </input>
        </generator>
      </input>
    </vulnerability>

    <vulnerability read_fact="strings_to_leak">
      <input into="strings_to_leak">
        <generator type="flag_generator"/>
      </input>
    </vulnerability>

    <service/>

    <network type="private_network"/>
    <build type="cleanup">
      <input into="root_password">
        <datastore>spoiler_admin_pass</datastore>
      </input>
    </build>
  </system>

  <!-- an example remote storage system, with a remotely exploitable vulnerability that can then be escalated to root -->
  <system>
    <system_name>that_escalated_quickly</system_name>
    <base platform="linux" type="server"/>

    <vulnerability read_fact="images_to_leak" access="remote" privilege="user_rwx">
      <input into="images_to_leak" >
        <generator read_fact="strings_to_leak" type="image_generator" >
          <input into="strings_to_leak">
            <generator type="flag_generator" />
          </input>
        </generator>
        <generator type="image_generator"/>
      </input>
      <input into="strings_to_leak">
        <generator type="flag_generator" />
        <generator type="ctf_challenge" />
      </input>
    </vulnerability>

    <vulnerability read_fact="strings_to_leak" access="local" privilege="root_rwx">
      <input into="strings_to_leak">
        <generator type="flag_generator" />
      </input>
    </vulnerability>

    <service/>

    <network type="private_network"/>
    <build type="cleanup">
      <input into="root_password">
        <datastore>spoiler_admin_pass</datastore>
      </input>
    </build>
  </system>

</scenario>