hackme_crackme.xml

<?xml version="1.0"?>

<scenario xmlns="http://www.github/cliffe/SecGen/scenario"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.github/cliffe/SecGen/scenario">

  <name>Hackme and Crack Me</name>
  <author>Z. Cliffe Schreuders</author>
  <description>Hack then crack, then use those creds to ssh to second_server for flags.
  </description>

  <type>ctf</type>
  <type>attack-ctf</type>
  <type>pwn-ctf</type>
  <difficulty>easy</difficulty>

  <CyBOK KA="MAT" topic="Attacks and exploitation">
    <keyword>EXPLOITATION</keyword>
    <keyword>EXPLOITATION FRAMEWORKS</keyword>
  </CyBOK>
  <CyBOK KA="SS" topic="Categories of Vulnerabilities">
    <keyword>CVEs and CWEs</keyword>
  </CyBOK>
  <CyBOK KA="SOIM" topic="PENETRATION TESTING">
    <keyword>PENETRATION TESTING - SOFTWARE TOOLS</keyword>
    <keyword>PENETRATION TESTING - ACTIVE PENETRATION</keyword>
  </CyBOK>
  <CyBOK KA="AAA" topic="Authentication">
    <keyword>BRUTEFORCE</keyword>
  </CyBOK>
  <CyBOK KA="AAA" topic="Authorisation">
    <keyword>Vulnerabilities and attacks on access control misconfigurations</keyword>
  </CyBOK>
  <CyBOK KA="AB" topic="Models">
    <keyword>kill chains</keyword>
  </CyBOK>
  <CyBOK KA="MAT" topic="Malicious Activities by Malware">
    <keyword>cyber kill chain</keyword>
  </CyBOK>

  <system>
    <system_name>hack_and_crack_me_server</system_name>
    <base distro="Debian 9" type="desktop" name="KDE"/>

    <input into_datastore="IP_addresses">
      <!-- 0 desktop -->
      <value>172.16.0.2</value>
      <!-- 1 server -->
      <value>172.16.0.3</value>
      <!-- 3 kali_cracker -->
      <value>172.16.0.4</value>
    </input>

    <!-- generate some usernames to use -->
    <input into_datastore="usernames">
      <!-- main user -->
      <generator type="random_sanitised_word">
        <input into="wordlist">
          <value>mythical_creatures</value>
        </input>
      </generator>
      <!-- 4 other users -->
      <generator type="random_sanitised_word">
        <input into="wordlist">
          <value>mythical_creatures</value>
        </input>
      </generator>
      <generator type="random_sanitised_word">
        <input into="wordlist">
          <value>mythical_creatures</value>
        </input>
      </generator>
      <generator type="random_sanitised_word">
        <input into="wordlist">
          <value>mythical_creatures</value>
        </input>
      </generator>
      <generator type="random_sanitised_word">
        <input into="wordlist">
          <value>mythical_creatures</value>
        </input>
      </generator>
    </input>

    <!-- generate some passwords to be cracked -->
    <input into_datastore="weak_passwords">
      <generator type="custom_list_password">
        <input into="list_name">
          <value>jtrpassword.lst</value>
        </input>
      </generator>
      <generator type="custom_list_password">
        <input into="list_name">
          <value>jtrpassword.lst</value>
        </input>
      </generator>
      <generator type="custom_list_password">
        <input into="list_name">
          <value>jtrpassword.lst</value>
        </input>
      </generator>
      <generator type="medium_password_generator"/>
    </input>

    <!-- accounts on the desktop, with the main user as a sudoer, with no flags -->
    <input into_datastore="user_accounts_desktop">
      <!-- main user, sudoer -->
      <generator type="account">
        <input into="username">
          <datastore access="0">usernames</datastore>
        </input>
        <input into="password">
          <value>password</value>
        </input>
        <input into="super_user">
          <value>false</value>
        </input>
      </generator>
      <!-- other users, with weak passwords, no flags -->
      <generator type="account">
        <input into="username">
          <datastore access="next">usernames</datastore>
        </input>
        <input into="password">
          <datastore access="0">weak_passwords</datastore>
        </input>
      </generator>
      <generator type="account">
        <input into="username">
          <datastore access="next">usernames</datastore>
        </input>
        <input into="password">
          <datastore access="next">weak_passwords</datastore>
        </input>
      </generator>
      <generator type="account">
        <input into="username">
          <datastore access="next">usernames</datastore>
        </input>
        <input into="password">
          <datastore access="next">weak_passwords</datastore>
        </input>
      </generator>
      <generator type="account">
        <input into="username">
          <datastore access="next">usernames</datastore>
        </input>
        <input into="password">
          <datastore access="next">weak_passwords</datastore>
        </input>
      </generator>
    </input>


    <input into_datastore="desktop_root_password">
      <generator type="strong_password_generator"/>
    </input>

    <!--Create the users-->
    <utility module_path=".*/parameterised_accounts">
      <input into="accounts">
        <datastore>user_accounts_desktop</datastore>
      </input>
    </utility>

    <utility module_path=".*/handy_cli_tools"/>
    <utility module_path=".*/hash_tools"/>

    <!-- vulnerable server -->
    <vulnerability module_path=".*/distcc_exec">
      <input into="strings_to_leak">
        <generator type="flag_generator" />
      </input>
      <input into="leaked_filenames">
        <value>flag</value>
      </input>
    </vulnerability>

    <vulnerability module_path=".*/readable_shadow"/>


    <vulnerability module_path=".*/ssh_root_login">
      <input into="root_password">
        <datastore>desktop_root_password</datastore>
      </input>
    </vulnerability>

    <network type="private_network">
      <input into="IP_address">
        <datastore access="0">IP_addresses</datastore>
      </input>
    </network>
    <input into_datastore="spoiler_admin_pass">
      <generator type="strong_password_generator"/>
    </input>
    <build type="cleanup">
      <input into="root_password">
        <datastore>spoiler_admin_pass</datastore>
      </input>
    </build>
  </system>

  <system>
    <system_name>second_server</system_name>
    <base distro="Debian 9" type="server"/>

    <!-- user accounts on the server, with matching usernames and passwords, but with flags to find -->
    <input into_datastore="user_accounts_server">
      <!-- main user, NOT sudoer -->
      <generator type="account">
        <input into="username">
          <datastore access="0">usernames</datastore>
        </input>
        <input into="password">
          <value>password</value>
        </input>
        <input into="super_user">
          <value>false</value>
        </input>
        <input into="leaked_filenames">
          <value>hint</value>
          <value>flag</value>
        </input>
        <input into="strings_to_leak">
          <value>hint: some users choose passwords that are something common followed by a two digit number.</value>
          <generator type="flag_generator" />
        </input>

      </generator>
      <!-- other users, with the SAME weak passwords, WITH flags -->
      <generator type="account">
        <input into="username">
          <datastore access="next">usernames</datastore>
        </input>
        <input into="password">
          <datastore access="0">weak_passwords</datastore>
        </input>
        <input into="leaked_filenames">
          <value>flag</value>
        </input>
        <input into="strings_to_leak">
          <generator type="flag_generator" />
        </input>
      </generator>
      <generator type="account">
        <input into="username">
          <datastore access="next">usernames</datastore>
        </input>
        <input into="password">
          <datastore access="next">weak_passwords</datastore>
        </input>
        <input into="leaked_filenames">
          <value>flag</value>
        </input>
        <input into="strings_to_leak">
          <generator type="flag_generator" />
        </input>
      </generator>
      <generator type="account">
        <input into="username">
          <datastore access="next">usernames</datastore>
        </input>
        <input into="password">
          <datastore access="next">weak_passwords</datastore>
        </input>
        <input into="leaked_filenames">
          <value>flag</value>
        </input>
        <input into="strings_to_leak">
          <generator type="flag_generator" />
        </input>
      </generator>
      <generator type="account">
        <input into="username">
          <datastore access="next">usernames</datastore>
        </input>
        <input into="password">
          <datastore access="next">weak_passwords</datastore>
        </input>
        <input into="leaked_filenames">
          <value>flag</value>
        </input>
        <input into="strings_to_leak">
          <generator type="flag_generator" />
        </input>
      </generator>
    </input>

    <!--Create the users-->
    <utility module_path=".*/parameterised_accounts">
      <input into="accounts">
        <datastore>user_accounts_server</datastore>
      </input>
    </utility>

    <utility module_path=".*/handy_cli_tools"/>

    <vulnerability module_path=".*/ssh_root_login">
      <input into="root_password">
        <datastore>desktop_root_password</datastore>
      </input>
    </vulnerability>

    <network type="private_network">
      <input into="IP_address">
        <datastore access="1">IP_addresses</datastore>
      </input>
    </network>
    <build type="cleanup">
      <input into="root_password">
        <datastore>spoiler_admin_pass</datastore>
      </input>
    </build>
  </system>

  <system>
    <system_name>kali_cracker</system_name>
    <base distro="Kali" name="MSF"/>

    <utility module_path=".*/parameterised_accounts">
      <input into="accounts">
        <value>{"username":"kali","password":"kali","super_user":"true","strings_to_leak":[],"leaked_filenames":[]}</value>
      </input>
    </utility>
    
    <input into_datastore="kali_root_account">
      <value>{"username":"kali","password":"kali","super_user":"true","strings_to_leak":[],"leaked_filenames":[]}</value>
    </input>

    <utility module_path=".*/kali_pwtools"/>
    <utility module_path=".*/metasploit_framework"/>
    <utility module_path=".*/armitage"/>
    <utility module_path=".*/handy_cli_tools"/>
    <utility module_path=".*/nmap"/>


    <network type="private_network" >
      <input into="IP_address">
        <datastore access="2">IP_addresses</datastore>
      </input>
    </network>
    <build type="cleanup">
      <input into="root_password">
        <datastore>spoiler_admin_pass</datastore>
      </input>
    </build>
  </system>

</scenario>