mirror of
https://github.com/cliffe/SecGen.git
synced 2026-02-20 13:50:45 +00:00
scenarios: updating base box selectors to include type="server" (along side platform="linux") in preparation for kali basebox merge
This commit is contained in:
@@ -8,7 +8,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>system</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<input into_datastore="accounts">
|
||||
<!-- [0]: Entry account -->
|
||||
|
||||
@@ -7,7 +7,7 @@
|
||||
<!--some basic decoding challenges-->
|
||||
<system>
|
||||
<system_name>decode_me</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<!-- comment describes using pseudo code (C#-like methods with named optional arguments) -->
|
||||
<!-- vulnerability_nfs_share_leak(strings_to_leak: encoder_flag_generator() CONCAT encoder_ascii_reversible(strings_to_encode: encoder_flag_generator()) CONCAT ...) -->
|
||||
@@ -68,7 +68,7 @@
|
||||
<!--a few vulnerabilities that are in the wild, with some flags that need decoding, some red herring services to keep things interesting-->
|
||||
<system>
|
||||
<system_name>in_the_wild</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<vulnerability read_fact="strings_to_leak" access="remote" privilege="user_rwx">
|
||||
<input into="strings_to_leak">
|
||||
@@ -133,7 +133,7 @@
|
||||
<!-- an example remote storage system, with a remotely exploitable vulnerability that can then be escalated to root -->
|
||||
<system>
|
||||
<system_name>that_escalated_quickly</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<vulnerability read_fact="images_to_leak" access="remote" privilege="user_rwx">
|
||||
<input into="images_to_leak" >
|
||||
|
||||
@@ -7,7 +7,7 @@
|
||||
<!--some basic decoding challenges-->
|
||||
<system>
|
||||
<system_name>nw_cyber_games</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<!-- comment describes using pseudo code (C#-like methods with named optional arguments) -->
|
||||
<!-- vulnerability_nfs_share_leak(strings_to_leak: encoder_flag_generator() CONCAT encoder_ascii_reversible(strings_to_encode: encoder_flag_generator()) CONCAT ...) -->
|
||||
|
||||
@@ -7,7 +7,7 @@
|
||||
<!-- an example remote storage system, with a remotely exploitable vulnerability that can then be escalated to root -->
|
||||
<system>
|
||||
<system_name>storage_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<vulnerability privilege="user_rwx" access="remote" />
|
||||
<vulnerability privilege="root_rwx" access="local" />
|
||||
|
||||
@@ -8,7 +8,7 @@
|
||||
<!--comments describe using pseudo code-->
|
||||
<system>
|
||||
<system_name>decode_me</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<!-- flag1 = encoder_flag_generator() -->
|
||||
<input into_datastore="flag1">
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>example_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<input into_datastore="business_name">
|
||||
<value>BusinessName1</value>
|
||||
|
||||
@@ -8,7 +8,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>example_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<!--pre-calculate all flags at once, and store in flags datastore-->
|
||||
<input into_datastore="flags">
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>example_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<input into_datastore="business_name">
|
||||
<value>BusinessName1</value>
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>example_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<!--select a vulnerability that leaks strings-->
|
||||
<vulnerability read_fact="strings_to_leak">
|
||||
|
||||
@@ -7,7 +7,7 @@
|
||||
<!-- an example system hosting a parameterised randomly generated website -->
|
||||
<system>
|
||||
<system_name>web_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
|
||||
<!-- FEED GENERATED 'BUSINESS' DATA ABOVE INTO VULNERABILITY MODULES. -->
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>example_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<!-- encode and leak multiple values -->
|
||||
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>example_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<!--select a vulnerability that leaks strings-->
|
||||
<vulnerability read_fact="strings_to_leak">
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>example_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<!--select a vulnerability that leaks strings-->
|
||||
<vulnerability read_fact="strings_to_leak">
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>example_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<!--select a vulnerability that leaks strings-->
|
||||
<vulnerability read_fact="strings_to_leak">
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>example_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<!--select a vulnerability that leaks strings-->
|
||||
<vulnerability read_fact="strings_to_leak">
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>example_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<!--select a vulnerability that leaks strings-->
|
||||
<vulnerability read_fact="strings_to_leak">
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>example_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<!--select a vulnerability that leaks strings-->
|
||||
<vulnerability read_fact="strings_to_leak">
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>example_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<!--select a vulnerability that leaks strings-->
|
||||
<vulnerability read_fact="strings_to_leak">
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>example_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<!--select a vulnerability that leaks strings-->
|
||||
<vulnerability read_fact="strings_to_leak">
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>example_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<!-- generate encode and leak multiple values -->
|
||||
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>example_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<!--select a vulnerability that leaks strings-->
|
||||
<vulnerability read_fact="strings_to_leak">
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>example_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<!--select a vulnerability that leaks strings-->
|
||||
<vulnerability read_fact="strings_to_leak">
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>example_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<!--select a vulnerability that leaks strings-->
|
||||
<vulnerability read_fact="strings_to_leak">
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>example_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<!-- generate and leak multiple values -->
|
||||
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>example_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<!-- generate encode and leak multiple values -->
|
||||
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>diff_challenge_box</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<vulnerability name="NFS Share Leak">
|
||||
<input into="strings_to_leak">
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>example_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<!-- Generator which outputs an image with modified exif metadata code containing a flag. -->
|
||||
<vulnerability read_fact="images_to_leak">
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>example_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<!--select a vulnerability that leaks strings-->
|
||||
<vulnerability read_fact="strings_to_leak">
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>example_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<!-- Generator which outputs an ascii_reversible encoded string (usually a flag) appended to raw image data. -->
|
||||
<vulnerability read_fact="images_to_leak">
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>example_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<!-- Generator which outputs an image with a QR code containing a flag. -->
|
||||
<vulnerability read_fact="images_to_leak">
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>example_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<!--select a vulnerability that leaks strings-->
|
||||
<vulnerability read_fact="strings_to_leak">
|
||||
|
||||
@@ -5,7 +5,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>example_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<!--select a vulnerability that takes leaked_filenames-->
|
||||
<vulnerability read_fact="leaked_filenames">
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>example_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<!--select a vulnerability that leaks strings-->
|
||||
<vulnerability read_fact="strings_to_leak">
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>example_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<!--select a vulnerability that leaks strings-->
|
||||
<vulnerability read_fact="strings_to_leak">
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>example_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<!--select a vulnerability that leaks strings-->
|
||||
<vulnerability read_fact="strings_to_leak">
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>example_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<vulnerability read_fact="strings_to_leak">
|
||||
<input into="strings_to_leak">
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>example_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<!-- Generator which outputs 2 binary strings that are XORable together to get the flag. -->
|
||||
<vulnerability read_fact="strings_to_leak">
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>example_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<!-- leak multiple values -->
|
||||
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>online_store</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<vulnerability module_path=".*onlinestore">
|
||||
<input into="domain">
|
||||
|
||||
@@ -7,7 +7,7 @@
|
||||
<!-- an example system hosting a parameterised randomly generated website -->
|
||||
<system>
|
||||
<system_name>web_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<service module_path="services/unix/http/parameterised_website"/>
|
||||
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>storage_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
<service /> <!-- random network service -->
|
||||
<network type="public_network"/>
|
||||
</system>
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
<!-- an example with a random vulnerability and the cleanup module with some inputs. -->
|
||||
<system>
|
||||
<system_name>storage_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<vulnerability/>
|
||||
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>apache_server_with_mysql</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<service module_path="modules/services/unix/database/mysql"/>
|
||||
<service module_path="modules/services/unix/http/apache"/>
|
||||
@@ -16,7 +16,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>apache_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<service module_path="modules/services/unix/http/apache"/>
|
||||
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>apache_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<service module_path="modules/services/unix/http/apache"/>
|
||||
|
||||
|
||||
@@ -7,7 +7,7 @@
|
||||
<!-- an example of a clean and updated linux system -->
|
||||
<system>
|
||||
<system_name>clean_system_with_update</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<utility module_path="modules/utilities/unix/update/unix_update"/>
|
||||
|
||||
|
||||
@@ -7,7 +7,7 @@
|
||||
<!-- an example remote storage system, with a remotely exploitable vulnerability that can then be escalated to root -->
|
||||
<system>
|
||||
<system_name>firewall_configuration_example</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<utility module_path="modules/utilities/unix/firewall/firewall"/>
|
||||
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>irc_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<service type="irc"/>
|
||||
|
||||
|
||||
@@ -7,7 +7,7 @@
|
||||
<!-- A secure system running java -->
|
||||
<system>
|
||||
<system_name>system_with_java</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<utility module_path="modules/utilities/unix/languages/java"/>
|
||||
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>lamp_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<service module_path="modules/services/unix/http/lamp"/>
|
||||
|
||||
|
||||
@@ -7,7 +7,7 @@
|
||||
<!-- an example remote storage system, with a remotely exploitable vulnerability that can then be escalated to root -->
|
||||
<system>
|
||||
<system_name>nginx_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<service module_path="modules/services/unix/http/nginx"></service>
|
||||
|
||||
|
||||
@@ -7,7 +7,7 @@
|
||||
<!-- an example remote storage system, with a remotely exploitable vulnerability that can then be escalated to root -->
|
||||
<system>
|
||||
<system_name>ntp_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<service module_path="modules/services/unix/ntp/ntp"></service>
|
||||
|
||||
|
||||
@@ -7,7 +7,7 @@
|
||||
<!-- An example secure ftp server using the service proftpd -->
|
||||
<system>
|
||||
<system_name>proftpd_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<service module_path="modules/services/unix/ftp/proftpd"></service>
|
||||
|
||||
|
||||
@@ -7,7 +7,7 @@
|
||||
<!-- A secure samba service -->
|
||||
<system>
|
||||
<system_name>samba_service</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<service module_path="modules/services/unix/smb/samba"></service>
|
||||
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>smbclient_utility</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<utility module_path="modules/utilities/unix/smb/smbclient"></utility>
|
||||
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>user_account_module_test</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<utility module_path="modules/utilities/unix/system/accounts"/>
|
||||
|
||||
|
||||
@@ -7,7 +7,7 @@
|
||||
<!-- An example secure ftp server using the service vsftpd -->
|
||||
<system>
|
||||
<system_name>vsftpd_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<service module_path="modules/services/unix/ftp/vsftpd"></service>
|
||||
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>desktop</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<utility module_path=".*xfce"/>
|
||||
<utility module_path=".*iceweasel" />
|
||||
|
||||
@@ -7,13 +7,13 @@
|
||||
<!-- an example of a system with static IP address resolution. -->
|
||||
<system>
|
||||
<system_name>storage_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
<network type="private_network" range="172.16.0.0"/>
|
||||
</system>
|
||||
|
||||
<system>
|
||||
<system_name>another_system</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
<network type="private_network" range="172.16.0.0"/>
|
||||
</system>
|
||||
|
||||
|
||||
@@ -7,7 +7,7 @@
|
||||
<!-- An example access control misconfiguration, shadow file is readable -->
|
||||
<system>
|
||||
<system_name>access_control_misconfigurations_readable_shadow</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<vulnerability module_path="vulnerabilities/unix/access_control_misconfigurations/readable_shadow"/>
|
||||
|
||||
|
||||
@@ -7,7 +7,7 @@
|
||||
<!-- An example access control misconfiguration, setuid root nano with a test account -->
|
||||
<system>
|
||||
<system_name>access_control_misconfigurations_suid_root_nano</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<vulnerability module_path="vulnerabilities/unix/access_control_misconfigurations/suid_root_nano"/>
|
||||
|
||||
|
||||
@@ -7,7 +7,7 @@
|
||||
<!-- An example access control misconfiguration, setuid on /bin/bash allows programs to run with root privileges -->
|
||||
<system>
|
||||
<system_name>access_control_misconfigurations_uid_bash_root</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<vulnerability module_path="vulnerabilities/unix/access_control_misconfigurations/uid_bash_root"/>
|
||||
|
||||
|
||||
@@ -7,7 +7,7 @@
|
||||
<!-- An example access control misconfiguration, setuid on less allows root read access -->
|
||||
<system>
|
||||
<system_name>access_control_misconfigurations_uid_less_root</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<vulnerability module_path="modules/vulnerabilities/unix/access_control_misconfigurations/uid_less_root"/>
|
||||
|
||||
|
||||
@@ -7,7 +7,7 @@
|
||||
<!-- An example access control misconfiguration, setuid on vi allows root read/write access -->
|
||||
<system>
|
||||
<system_name>access_control_misconfigurations_vi_root</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<vulnerability module_path="vulnerabilities/unix/access_control_misconfigurations/uid_vi_root"/>
|
||||
|
||||
|
||||
@@ -7,7 +7,7 @@
|
||||
<!-- An example access control misconfiguration, /etc/groups file is globally writable -->
|
||||
<system>
|
||||
<system_name>access_control_misconfigurations_writable_groups</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<vulnerability module_path="vulnerabilities/unix/access_control_misconfigurations/writable_groups"/>
|
||||
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<vulnerability module_path=".*writable_passwd" type="access_control_misconfiguration"/>
|
||||
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<vulnerability module_path=".*writable_shadow" type="access_control_misconfiguration"/>
|
||||
|
||||
|
||||
@@ -7,7 +7,7 @@
|
||||
<!-- An example access control misconfiguration, allows vi to run as root for any user -->
|
||||
<system>
|
||||
<system_name>access_control_misconfigurations_vi_root</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<vulnerability module_path="vulnerabilities/unix/access_control_misconfigurations/uid_vi_root"/>
|
||||
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>new_vuln_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<vulnerability access="remote" privilege="user_rwx" />
|
||||
<vulnerability module_path=".*chkrootkit" />
|
||||
|
||||
@@ -8,7 +8,7 @@
|
||||
username/pw: challenges/password -->
|
||||
<system>
|
||||
<system_name>reverse_me</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<vulnerability module_path=".*dc16_amadhj.*"/>
|
||||
|
||||
|
||||
@@ -7,7 +7,7 @@
|
||||
<!-- example usage of the hidden_file CTF challenge module. -->
|
||||
<system>
|
||||
<system_name>a_system</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<vulnerability module_path=".*hidden_file.*">
|
||||
<input into="storage_directory">
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>symlinks</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<vulnerability module_path=".*symlinks" />
|
||||
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>ssh_leaked_keys</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<vulnerability module_path=".*two_shell_calls"/>
|
||||
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>distcc_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<vulnerability module_path="vulnerabilities/unix/misc/distcc_exec" />
|
||||
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>file_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<vulnerability module_path=".*gitlist_040"/>
|
||||
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>file_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<vulnerability module_path="vulnerabilities/unix/webapp/moinmoin_195"/>
|
||||
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>file_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<vulnerability module_path=".*nfs_overshare">
|
||||
<input into="strings_to_leak">
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>online_store</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<vulnerability module_path=".*onlinestore" />
|
||||
|
||||
|
||||
@@ -7,7 +7,7 @@
|
||||
<!-- an example remote linux system with the ProFTPd 1.3.3c backdoor vulnerability -->
|
||||
<system>
|
||||
<system_name>file_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<vulnerability module_path="vulnerabilities/unix/ftp/proftpd_133c_backdoor"/>
|
||||
|
||||
|
||||
@@ -7,7 +7,7 @@
|
||||
<!-- an example remote storage system running samba, with a misconfiguration vulnerability which enables symlink traversal -->
|
||||
<system>
|
||||
<system_name>samba_service</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<vulnerability module_path="modules/vulnerabilities/unix/smb/samba_symlink_traversal"/>
|
||||
|
||||
|
||||
@@ -5,7 +5,7 @@
|
||||
xsi:schemaLocation="http://www.github/cliffe/SecGen/scenario">
|
||||
<system>
|
||||
<system_name>box_with_remote_user_level_vuln_and_setuid_nmap_priv_escalation</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<!--We need a remote user privilege vulnerability so we can escalate to root with setuid_nmap -->
|
||||
<vulnerability access="remote" privilege="user_rwx"/>
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>storage_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<vulnerability module_path=".*shellshock_apache_cgi.*"/>
|
||||
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>storage_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<vulnerability module_path="modules/vulnerabilities/unix/bash/shellshock"/>
|
||||
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>ssh_leaked_keys</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<vulnerability module_path="modules/vulnerabilities/unix/system/ssh_leaked_keys"/>
|
||||
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>ssh_leaked_keys</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<vulnerability module_path=".*ssh_root_login"/>
|
||||
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>file_server</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
|
||||
<vulnerability software_name="vsftpd"/>
|
||||
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
|
||||
<system>
|
||||
<system_name>xfce_lightdm_root_login</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" distro="Debian 7.8"/>
|
||||
|
||||
<vulnerability module_path=".*xfce_lightdm_root_login"/>
|
||||
|
||||
|
||||
@@ -213,7 +213,7 @@
|
||||
<!-- Desktop Client on NIC2 -->
|
||||
<system>
|
||||
<system_name>desktop</system_name>
|
||||
<base platform="linux"/>
|
||||
<base platform="linux" type="server"/>
|
||||
<vulnerability module_path=".*xfce_lightdm_root_login"/>
|
||||
<utility module_path=".*iceweasel" />
|
||||
<network module_path=".*private_network_2"/>
|
||||
|
||||
Reference in New Issue
Block a user