performance_peril.xml

<?xml version="1.0"?>

<scenario xmlns="http://www.github/cliffe/SecGen/scenario"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.github/cliffe/SecGen/scenario">

    <name>Performance Peril</name>
    <author>James Davis</author>
    <description>
        An administrator has unknowingly left an open door via a vulnerable service. Breach
        the server and collect the secrets.
    </description>

    <type>ctf</type>
    <type>attack-ctf</type>
    <difficulty>intermediate</difficulty>

    <CyBOK KA="MAT" topic="Attacks and exploitation">
        <keyword>EXPLOITATION</keyword>
        <keyword>EXPLOITATION FRAMEWORKS</keyword>
    </CyBOK>
    <CyBOK KA="SS" topic="Categories of Vulnerabilities">
        <keyword>CVEs and CWEs</keyword>
    </CyBOK>
    <CyBOK KA="SOIM" topic="PENETRATION TESTING">
        <keyword>PENETRATION TESTING - SOFTWARE TOOLS</keyword>
        <keyword>PENETRATION TESTING - ACTIVE PENETRATION</keyword>
    </CyBOK>
    <CyBOK KA="WAM" topic="Server-Side Vulnerabilities and Mitigations">
        <keyword>server-side misconfiguration and vulnerable components</keyword>
        <keyword>Command injection</keyword>
    </CyBOK>

    <CyBOK KA="OSV" topic="Primitives for Isolation and Mediation">
        <keyword>Linux security model</keyword>
    </CyBOK>
    <CyBOK KA="F" topic="Artifact Analysis">
        <keyword>Encoding and alternative data formats</keyword>
    </CyBOK>
    <CyBOK KA="AC" topic="Symmetric Cryptography">
        <keyword>symmetric encryption and authentication</keyword>
    </CyBOK>

    <CyBOK KA="AB" topic="Models">
        <keyword>kill chains</keyword>
    </CyBOK>
    <CyBOK KA="MAT" topic="Malicious Activities by Malware">
        <keyword>cyber kill chain</keyword>
    </CyBOK>


    <system>
        <system_name>attack_vm</system_name>
        <base distro="Kali" name="MSF" />

        <input into_datastore="IP_addresses">
            <!-- 0 attack_vm -->
            <value>172.16.0.2</value>
            <!-- 1 hackme_server -->
            <value>172.16.0.3</value>
        </input>

        <utility module_path=".*/parameterised_accounts">
          <input into="accounts">
            <value>{"username":"kali","password":"kali","super_user":"true","strings_to_leak":[],"leaked_filenames":[]}</value>
          </input>
        </utility>

        <utility module_path=".*/iceweasel">
            <input into="accounts">
                <value>
                    {"username":"kali","password":"kali","super_user":"true","strings_to_leak":[],"leaked_filenames":[]}</value>
            </input>
            <input into="autostart">
                <value>false</value>
            </input>
        </utility>

        <utility module_path=".*/kali_web" />
        <utility module_path=".*/metasploit_framework" />
        <utility module_path=".*/nmap" />
        <utility module_path=".*/handy_cli_tools" />
        <utility module_path=".*/kali_pwtools" />

        <network type="private_network">
            <input into="IP_address">
                <datastore access="0">IP_addresses</datastore>
            </input>
        </network>
    <input into_datastore="spoiler_admin_pass">
      <generator type="strong_password_generator"/>
    </input>
    <build type="cleanup">
      <input into="root_password">
        <datastore>spoiler_admin_pass</datastore>
      </input>
    </build>
    </system>

    <system>
        <system_name>server</system_name>
        <base distro="Debian 10" type="desktop" name="KDE" />

        <vulnerability module_path=".*/linuxki_rce">
            <input into="strings_to_leak">
                <generator type="flag_generator" />
            </input>
        </vulnerability>

        <vulnerability type="zip_file">
            <input into="password">
                <generator type="custom_list_password">
                    <input into="list_name">
                        <value>jtrpassword.lst</value>
                    </input>
                </generator>
            </input>

            <input into="leaked_filename">
                <value>private.zip</value>
            </input>
            <!--Check
            if better way?-->
            <input into="storage_directory">
                <value>/home/linuxki</value>
            </input>
        </vulnerability>

        <vulnerability module_path=".*/chkrootkit" />

        <network type="private_network">
            <input into="IP_address">
                <datastore access="1">IP_addresses</datastore>
            </input>
        </network>
    <build type="cleanup">
      <input into="root_password">
        <datastore>spoiler_admin_pass</datastore>
      </input>
    </build>
    </system>

</scenario>