scenarios: updating base box selectors to include type="server" (along side platform="linux") in preparation for kali basebox merge

This commit is contained in:
thomashaw
2017-08-19 13:52:03 +01:00
parent 8b2a92915e
commit 0d5bd58fdc
87 changed files with 91 additions and 91 deletions

View File

@@ -8,7 +8,7 @@
<system>
<system_name>system</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<input into_datastore="accounts">
<!-- [0]: Entry account -->

View File

@@ -7,7 +7,7 @@
<!--some basic decoding challenges-->
<system>
<system_name>decode_me</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<!-- comment describes using pseudo code (C#-like methods with named optional arguments) -->
<!-- vulnerability_nfs_share_leak(strings_to_leak: encoder_flag_generator() CONCAT encoder_ascii_reversible(strings_to_encode: encoder_flag_generator()) CONCAT ...) -->
@@ -68,7 +68,7 @@
<!--a few vulnerabilities that are in the wild, with some flags that need decoding, some red herring services to keep things interesting-->
<system>
<system_name>in_the_wild</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<vulnerability read_fact="strings_to_leak" access="remote" privilege="user_rwx">
<input into="strings_to_leak">
@@ -133,7 +133,7 @@
<!-- an example remote storage system, with a remotely exploitable vulnerability that can then be escalated to root -->
<system>
<system_name>that_escalated_quickly</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<vulnerability read_fact="images_to_leak" access="remote" privilege="user_rwx">
<input into="images_to_leak" >

View File

@@ -7,7 +7,7 @@
<!--some basic decoding challenges-->
<system>
<system_name>nw_cyber_games</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<!-- comment describes using pseudo code (C#-like methods with named optional arguments) -->
<!-- vulnerability_nfs_share_leak(strings_to_leak: encoder_flag_generator() CONCAT encoder_ascii_reversible(strings_to_encode: encoder_flag_generator()) CONCAT ...) -->

View File

@@ -7,7 +7,7 @@
<!-- an example remote storage system, with a remotely exploitable vulnerability that can then be escalated to root -->
<system>
<system_name>storage_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<vulnerability privilege="user_rwx" access="remote" />
<vulnerability privilege="root_rwx" access="local" />

View File

@@ -8,7 +8,7 @@
<!--comments describe using pseudo code-->
<system>
<system_name>decode_me</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<!-- flag1 = encoder_flag_generator() -->
<input into_datastore="flag1">

View File

@@ -6,7 +6,7 @@
<system>
<system_name>example_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<input into_datastore="business_name">
<value>BusinessName1</value>

View File

@@ -8,7 +8,7 @@
<system>
<system_name>example_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<!--pre-calculate all flags at once, and store in flags datastore-->
<input into_datastore="flags">

View File

@@ -6,7 +6,7 @@
<system>
<system_name>example_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<input into_datastore="business_name">
<value>BusinessName1</value>

View File

@@ -6,7 +6,7 @@
<system>
<system_name>example_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<!--select a vulnerability that leaks strings-->
<vulnerability read_fact="strings_to_leak">

View File

@@ -7,7 +7,7 @@
<!-- an example system hosting a parameterised randomly generated website -->
<system>
<system_name>web_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<!-- FEED GENERATED 'BUSINESS' DATA ABOVE INTO VULNERABILITY MODULES. -->

View File

@@ -6,7 +6,7 @@
<system>
<system_name>example_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<!-- encode and leak multiple values -->

View File

@@ -6,7 +6,7 @@
<system>
<system_name>example_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<!--select a vulnerability that leaks strings-->
<vulnerability read_fact="strings_to_leak">

View File

@@ -6,7 +6,7 @@
<system>
<system_name>example_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<!--select a vulnerability that leaks strings-->
<vulnerability read_fact="strings_to_leak">

View File

@@ -6,7 +6,7 @@
<system>
<system_name>example_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<!--select a vulnerability that leaks strings-->
<vulnerability read_fact="strings_to_leak">

View File

@@ -6,7 +6,7 @@
<system>
<system_name>example_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<!--select a vulnerability that leaks strings-->
<vulnerability read_fact="strings_to_leak">

View File

@@ -6,7 +6,7 @@
<system>
<system_name>example_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<!--select a vulnerability that leaks strings-->
<vulnerability read_fact="strings_to_leak">

View File

@@ -6,7 +6,7 @@
<system>
<system_name>example_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<!--select a vulnerability that leaks strings-->
<vulnerability read_fact="strings_to_leak">

View File

@@ -6,7 +6,7 @@
<system>
<system_name>example_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<!--select a vulnerability that leaks strings-->
<vulnerability read_fact="strings_to_leak">

View File

@@ -6,7 +6,7 @@
<system>
<system_name>example_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<!--select a vulnerability that leaks strings-->
<vulnerability read_fact="strings_to_leak">

View File

@@ -6,7 +6,7 @@
<system>
<system_name>example_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<!-- generate encode and leak multiple values -->

View File

@@ -6,7 +6,7 @@
<system>
<system_name>example_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<!--select a vulnerability that leaks strings-->
<vulnerability read_fact="strings_to_leak">

View File

@@ -6,7 +6,7 @@
<system>
<system_name>example_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<!--select a vulnerability that leaks strings-->
<vulnerability read_fact="strings_to_leak">

View File

@@ -6,7 +6,7 @@
<system>
<system_name>example_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<!--select a vulnerability that leaks strings-->
<vulnerability read_fact="strings_to_leak">

View File

@@ -6,7 +6,7 @@
<system>
<system_name>example_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<!-- generate and leak multiple values -->

View File

@@ -6,7 +6,7 @@
<system>
<system_name>example_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<!-- generate encode and leak multiple values -->

View File

@@ -6,7 +6,7 @@
<system>
<system_name>diff_challenge_box</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<vulnerability name="NFS Share Leak">
<input into="strings_to_leak">

View File

@@ -6,7 +6,7 @@
<system>
<system_name>example_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<!-- Generator which outputs an image with modified exif metadata code containing a flag. -->
<vulnerability read_fact="images_to_leak">

View File

@@ -6,7 +6,7 @@
<system>
<system_name>example_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<!--select a vulnerability that leaks strings-->
<vulnerability read_fact="strings_to_leak">

View File

@@ -6,7 +6,7 @@
<system>
<system_name>example_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<!-- Generator which outputs an ascii_reversible encoded string (usually a flag) appended to raw image data. -->
<vulnerability read_fact="images_to_leak">

View File

@@ -6,7 +6,7 @@
<system>
<system_name>example_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<!-- Generator which outputs an image with a QR code containing a flag. -->
<vulnerability read_fact="images_to_leak">

View File

@@ -6,7 +6,7 @@
<system>
<system_name>example_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<!--select a vulnerability that leaks strings-->
<vulnerability read_fact="strings_to_leak">

View File

@@ -5,7 +5,7 @@
<system>
<system_name>example_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<!--select a vulnerability that takes leaked_filenames-->
<vulnerability read_fact="leaked_filenames">

View File

@@ -6,7 +6,7 @@
<system>
<system_name>example_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<!--select a vulnerability that leaks strings-->
<vulnerability read_fact="strings_to_leak">

View File

@@ -6,7 +6,7 @@
<system>
<system_name>example_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<!--select a vulnerability that leaks strings-->
<vulnerability read_fact="strings_to_leak">

View File

@@ -6,7 +6,7 @@
<system>
<system_name>example_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<!--select a vulnerability that leaks strings-->
<vulnerability read_fact="strings_to_leak">

View File

@@ -6,7 +6,7 @@
<system>
<system_name>example_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<vulnerability read_fact="strings_to_leak">
<input into="strings_to_leak">

View File

@@ -6,7 +6,7 @@
<system>
<system_name>example_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<!-- Generator which outputs 2 binary strings that are XORable together to get the flag. -->
<vulnerability read_fact="strings_to_leak">

View File

@@ -6,7 +6,7 @@
<system>
<system_name>example_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<!-- leak multiple values -->

View File

@@ -6,7 +6,7 @@
<system>
<system_name>online_store</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<vulnerability module_path=".*onlinestore">
<input into="domain">

View File

@@ -7,7 +7,7 @@
<!-- an example system hosting a parameterised randomly generated website -->
<system>
<system_name>web_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<service module_path="services/unix/http/parameterised_website"/>

View File

@@ -6,7 +6,7 @@
<system>
<system_name>storage_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<service /> <!-- random network service -->
<network type="public_network"/>
</system>

View File

@@ -6,7 +6,7 @@
<!-- an example with a random vulnerability and the cleanup module with some inputs. -->
<system>
<system_name>storage_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<vulnerability/>

View File

@@ -6,7 +6,7 @@
<system>
<system_name>apache_server_with_mysql</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<service module_path="modules/services/unix/database/mysql"/>
<service module_path="modules/services/unix/http/apache"/>
@@ -16,7 +16,7 @@
<system>
<system_name>apache_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<service module_path="modules/services/unix/http/apache"/>

View File

@@ -6,7 +6,7 @@
<system>
<system_name>apache_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<service module_path="modules/services/unix/http/apache"/>

View File

@@ -7,7 +7,7 @@
<!-- an example of a clean and updated linux system -->
<system>
<system_name>clean_system_with_update</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<utility module_path="modules/utilities/unix/update/unix_update"/>

View File

@@ -7,7 +7,7 @@
<!-- an example remote storage system, with a remotely exploitable vulnerability that can then be escalated to root -->
<system>
<system_name>firewall_configuration_example</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<utility module_path="modules/utilities/unix/firewall/firewall"/>

View File

@@ -6,7 +6,7 @@
<system>
<system_name>irc_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<service type="irc"/>

View File

@@ -7,7 +7,7 @@
<!-- A secure system running java -->
<system>
<system_name>system_with_java</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<utility module_path="modules/utilities/unix/languages/java"/>

View File

@@ -6,7 +6,7 @@
<system>
<system_name>lamp_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<service module_path="modules/services/unix/http/lamp"/>

View File

@@ -7,7 +7,7 @@
<!-- an example remote storage system, with a remotely exploitable vulnerability that can then be escalated to root -->
<system>
<system_name>nginx_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<service module_path="modules/services/unix/http/nginx"></service>

View File

@@ -7,7 +7,7 @@
<!-- an example remote storage system, with a remotely exploitable vulnerability that can then be escalated to root -->
<system>
<system_name>ntp_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<service module_path="modules/services/unix/ntp/ntp"></service>

View File

@@ -7,7 +7,7 @@
<!-- An example secure ftp server using the service proftpd -->
<system>
<system_name>proftpd_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<service module_path="modules/services/unix/ftp/proftpd"></service>

View File

@@ -7,7 +7,7 @@
<!-- A secure samba service -->
<system>
<system_name>samba_service</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<service module_path="modules/services/unix/smb/samba"></service>

View File

@@ -6,7 +6,7 @@
<system>
<system_name>smbclient_utility</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<utility module_path="modules/utilities/unix/smb/smbclient"></utility>

View File

@@ -6,7 +6,7 @@
<system>
<system_name>user_account_module_test</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<utility module_path="modules/utilities/unix/system/accounts"/>

View File

@@ -7,7 +7,7 @@
<!-- An example secure ftp server using the service vsftpd -->
<system>
<system_name>vsftpd_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<service module_path="modules/services/unix/ftp/vsftpd"></service>

View File

@@ -6,7 +6,7 @@
<system>
<system_name>desktop</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<utility module_path=".*xfce"/>
<utility module_path=".*iceweasel" />

View File

@@ -7,13 +7,13 @@
<!-- an example of a system with static IP address resolution. -->
<system>
<system_name>storage_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<network type="private_network" range="172.16.0.0"/>
</system>
<system>
<system_name>another_system</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<network type="private_network" range="172.16.0.0"/>
</system>

View File

@@ -7,7 +7,7 @@
<!-- An example access control misconfiguration, shadow file is readable -->
<system>
<system_name>access_control_misconfigurations_readable_shadow</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<vulnerability module_path="vulnerabilities/unix/access_control_misconfigurations/readable_shadow"/>

View File

@@ -7,7 +7,7 @@
<!-- An example access control misconfiguration, setuid root nano with a test account -->
<system>
<system_name>access_control_misconfigurations_suid_root_nano</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<vulnerability module_path="vulnerabilities/unix/access_control_misconfigurations/suid_root_nano"/>

View File

@@ -7,7 +7,7 @@
<!-- An example access control misconfiguration, setuid on /bin/bash allows programs to run with root privileges -->
<system>
<system_name>access_control_misconfigurations_uid_bash_root</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<vulnerability module_path="vulnerabilities/unix/access_control_misconfigurations/uid_bash_root"/>

View File

@@ -7,7 +7,7 @@
<!-- An example access control misconfiguration, setuid on less allows root read access -->
<system>
<system_name>access_control_misconfigurations_uid_less_root</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<vulnerability module_path="modules/vulnerabilities/unix/access_control_misconfigurations/uid_less_root"/>

View File

@@ -7,7 +7,7 @@
<!-- An example access control misconfiguration, setuid on vi allows root read/write access -->
<system>
<system_name>access_control_misconfigurations_vi_root</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<vulnerability module_path="vulnerabilities/unix/access_control_misconfigurations/uid_vi_root"/>

View File

@@ -7,7 +7,7 @@
<!-- An example access control misconfiguration, /etc/groups file is globally writable -->
<system>
<system_name>access_control_misconfigurations_writable_groups</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<vulnerability module_path="vulnerabilities/unix/access_control_misconfigurations/writable_groups"/>

View File

@@ -6,7 +6,7 @@
<system>
<system_name>server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<vulnerability module_path=".*writable_passwd" type="access_control_misconfiguration"/>

View File

@@ -6,7 +6,7 @@
<system>
<system_name>server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<vulnerability module_path=".*writable_shadow" type="access_control_misconfiguration"/>

View File

@@ -7,7 +7,7 @@
<!-- An example access control misconfiguration, allows vi to run as root for any user -->
<system>
<system_name>access_control_misconfigurations_vi_root</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<vulnerability module_path="vulnerabilities/unix/access_control_misconfigurations/uid_vi_root"/>

View File

@@ -6,7 +6,7 @@
<system>
<system_name>new_vuln_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<vulnerability access="remote" privilege="user_rwx" />
<vulnerability module_path=".*chkrootkit" />

View File

@@ -8,7 +8,7 @@
username/pw: challenges/password -->
<system>
<system_name>reverse_me</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<vulnerability module_path=".*dc16_amadhj.*"/>

View File

@@ -7,7 +7,7 @@
<!-- example usage of the hidden_file CTF challenge module. -->
<system>
<system_name>a_system</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<vulnerability module_path=".*hidden_file.*">
<input into="storage_directory">

View File

@@ -6,7 +6,7 @@
<system>
<system_name>symlinks</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<vulnerability module_path=".*symlinks" />

View File

@@ -6,7 +6,7 @@
<system>
<system_name>ssh_leaked_keys</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<vulnerability module_path=".*two_shell_calls"/>

View File

@@ -6,7 +6,7 @@
<system>
<system_name>distcc_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<vulnerability module_path="vulnerabilities/unix/misc/distcc_exec" />

View File

@@ -6,7 +6,7 @@
<system>
<system_name>file_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<vulnerability module_path=".*gitlist_040"/>

View File

@@ -6,7 +6,7 @@
<system>
<system_name>file_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<vulnerability module_path="vulnerabilities/unix/webapp/moinmoin_195"/>

View File

@@ -6,7 +6,7 @@
<system>
<system_name>file_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<vulnerability module_path=".*nfs_overshare">
<input into="strings_to_leak">

View File

@@ -6,7 +6,7 @@
<system>
<system_name>online_store</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<vulnerability module_path=".*onlinestore" />

View File

@@ -7,7 +7,7 @@
<!-- an example remote linux system with the ProFTPd 1.3.3c backdoor vulnerability -->
<system>
<system_name>file_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<vulnerability module_path="vulnerabilities/unix/ftp/proftpd_133c_backdoor"/>

View File

@@ -7,7 +7,7 @@
<!-- an example remote storage system running samba, with a misconfiguration vulnerability which enables symlink traversal -->
<system>
<system_name>samba_service</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<vulnerability module_path="modules/vulnerabilities/unix/smb/samba_symlink_traversal"/>

View File

@@ -5,7 +5,7 @@
xsi:schemaLocation="http://www.github/cliffe/SecGen/scenario">
<system>
<system_name>box_with_remote_user_level_vuln_and_setuid_nmap_priv_escalation</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<!--We need a remote user privilege vulnerability so we can escalate to root with setuid_nmap -->
<vulnerability access="remote" privilege="user_rwx"/>

View File

@@ -6,7 +6,7 @@
<system>
<system_name>storage_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<vulnerability module_path=".*shellshock_apache_cgi.*"/>

View File

@@ -6,7 +6,7 @@
<system>
<system_name>storage_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<vulnerability module_path="modules/vulnerabilities/unix/bash/shellshock"/>

View File

@@ -6,7 +6,7 @@
<system>
<system_name>ssh_leaked_keys</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<vulnerability module_path="modules/vulnerabilities/unix/system/ssh_leaked_keys"/>

View File

@@ -6,7 +6,7 @@
<system>
<system_name>ssh_leaked_keys</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<vulnerability module_path=".*ssh_root_login"/>

View File

@@ -6,7 +6,7 @@
<system>
<system_name>file_server</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<vulnerability software_name="vsftpd"/>

View File

@@ -6,7 +6,7 @@
<system>
<system_name>xfce_lightdm_root_login</system_name>
<base platform="linux"/>
<base platform="linux" distro="Debian 7.8"/>
<vulnerability module_path=".*xfce_lightdm_root_login"/>

View File

@@ -213,7 +213,7 @@
<!-- Desktop Client on NIC2 -->
<system>
<system_name>desktop</system_name>
<base platform="linux"/>
<base platform="linux" type="server"/>
<vulnerability module_path=".*xfce_lightdm_root_login"/>
<utility module_path=".*iceweasel" />
<network module_path=".*private_network_2"/>