Merge pull request #287 from JD2344/shepherd

Security Shepherd Module

lib/objects/local_string_encoder.rb

@@ -17,6 +17,7 @@ class StringEncoder
   attr_accessor :strings_to_encode
   attr_accessor :has_base64_inputs
   attr_accessor :outputs
+  attr_accessor :iterations
 
   # override this
   def initialize
@@ -24,6 +25,7 @@ class StringEncoder
     self.strings_to_encode = []
     self.module_name = 'Null encoder'
     self.has_base64_inputs = false
+    self.iterations = 1
     self.outputs = []
   end
 
@@ -79,7 +81,8 @@ class StringEncoder
   def get_options_array
     [['--help', '-h', GetoptLong::NO_ARGUMENT],
      ['--b64', GetoptLong::OPTIONAL_ARGUMENT],
-     ['--strings_to_encode', '-s', GetoptLong::OPTIONAL_ARGUMENT]]
+     ['--strings_to_encode', '-s', GetoptLong::OPTIONAL_ARGUMENT],
+     ['--iterations', GetoptLong::OPTIONAL_ARGUMENT],]
   end
 
   # Override this when using read_fact's in your module. Always call super first.
@@ -97,6 +100,12 @@ class StringEncoder
         self.strings_to_encode << arg;
       when '--b64'
         # do nothing
+      when '--iterations'
+        if not arg.to_i == 0
+          self.iterations = arg.to_i
+        else
+          self.iterations = 1
+        end
     end
   end
 

lib/objects/local_string_generator.rb

@@ -14,12 +14,14 @@ class StringGenerator
   attr_accessor :module_name
   attr_accessor :has_base64_inputs
   attr_accessor :outputs
+  attr_accessor :iterations
 
   # override this
   def initialize
     # default values
     self.module_name = 'Null generator'
     self.has_base64_inputs = false
+    self.iterations = 1
     self.outputs = []
   end
 
@@ -66,7 +68,8 @@ class StringGenerator
 
   def get_options_array
     [['--help', '-h', GetoptLong::NO_ARGUMENT],
-     ['--b64', GetoptLong::OPTIONAL_ARGUMENT]]
+     ['--b64', GetoptLong::OPTIONAL_ARGUMENT],
+     ['--iterations', GetoptLong::OPTIONAL_ARGUMENT]]
   end
 
   # Override this when using read_fact's in your module. Always call super first
@@ -82,6 +85,12 @@ class StringGenerator
         usage
       when '--b64'
         # do nothing
+      when '--iterations'
+        if not arg.to_i == 0
+          self.iterations = arg.to_i
+        else
+          self.iterations = 1
+        end
     end
   end
 
@@ -91,6 +100,7 @@ class StringGenerator
 
    OPTIONS:
      --strings_to_encode [string]
+     --iterations [Integer]
 "
     exit
   end
@@ -101,7 +111,9 @@ class StringGenerator
     read_arguments
 
     Print.local_verbose "Generating..."
-    generate
+    self.iterations.times do
+      generate
+    end
 
     # print the first 1000 chars to screen
     output = self.outputs.to_s

modules/generators/flag/flag_words/secgen_metadata.xml

@@ -1,12 +1,13 @@
 <?xml version="1.0"?>
 
 <generator xmlns="http://www.github/cliffe/SecGen/generator"
-               xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-               xsi:schemaLocation="http://www.github/cliffe/SecGen/generator">
+  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+  xsi:schemaLocation="http://www.github/cliffe/SecGen/generator">
   <name>Random Words Flag Generator</name>
   <author>Z. Cliffe Schreuders</author>
   <module_license>MIT</module_license>
-  <description>Uses a wordlist (Ruby gem + a wordlist) to generate a list of random (mostly English) dictionary words. May include punctuation.</description>
+  <description>Uses a wordlist (Ruby gem + a wordlist) to generate a list of random (mostly English)
+    dictionary words. May include punctuation.</description>
 
   <type>flag_generator</type>
   <type>local_calculation</type>
@@ -17,5 +18,5 @@
   <reference>http://wordlist.sourceforge.net/</reference>
 
   <output_type>generated_strings</output_type>
-  
-</generator>
+
+</generator>

modules/generators/structured_content/ss_modules/secgen_local/local.rb

@@ -0,0 +1,58 @@
+#!/usr/bin/ruby
+require_relative '../../../../../lib/objects/local_string_generator.rb'
+require 'fileutils'
+
+class SSModuleListGenerator < StringGenerator
+  attr_accessor :filter
+
+  LOCAL_DIR = File.expand_path('../../',__FILE__)
+  TEMPLATE_PATH = "#{LOCAL_DIR}/templates/active-modules"
+
+  def initialize
+    super
+
+    self.module_name = 'Security Shepherd Module Generator'
+    self.filter = []
+  end
+
+  def generate
+    modules = File.new(TEMPLATE_PATH)
+    if not self.filter.empty?
+      self.filter.each { |criteria|
+        IO.foreach(modules) { |line|
+          # Very basic filter to capture matches based on a filter string
+          if "#{line}".match(criteria)
+            self.outputs << "#{line}".strip
+          end
+        }
+      }
+    else
+      modules.each { |line| self.outputs << "#{line}".strip}
+    end
+  end
+
+  def get_options_array
+    super + [['--filter', GetoptLong::OPTIONAL_ARGUMENT]]
+  end
+
+  def process_options(opt, arg)
+    super
+
+    case opt
+      when '--filter'
+        self.filter << arg
+    end
+  end
+
+  def usage
+    Print.err "Usage:
+   #{$0} [--options]
+
+   OPTIONS:
+     --filter [String]
+"
+    exit
+  end
+end
+
+SSModuleListGenerator.new.run

modules/generators/structured_content/ss_modules/secgen_metadata.xml

@@ -0,0 +1,20 @@
+<?xml version="1.0"?>
+
+<generator xmlns="http://www.github/cliffe/SecGen/generator"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://www.github/cliffe/SecGen/generator">
+    <name>Security Shepherd module list Generator</name>
+    <author>James Davis</author>
+    <module_license>MIT</module_license>
+    <description>Generates a list of strings based on security shepherd modules
+    </description>
+
+    <type>ss_modules</type>
+    <platform>linux</platform>
+
+    <!--Takes
+    a comma seperated list I.E SQL,CSRF-->
+    <read_fact>filter</read_fact>
+
+    <output_type>module_list</output_type>
+</generator>

modules/generators/structured_content/ss_modules/templates/active-modules

@@ -0,0 +1,55 @@
+Broken Session Management
+Session Management Challenge 1
+Session Management Challenge 2
+Session Management Challenge 3
+Session Management Challenge 4
+Session Management Challenge 5
+Session Management Challenge 6
+Session Management Challenge 7
+Session Management Challenge 8
+Failure to Restrict URL Access
+Failure to Restrict URL Access 1
+Failure to Restrict URL Access 2
+Failure to Restrict URL Access 3
+Security Misconfiguration
+Security Misconfig Cookie Flag
+Unvalidated Redirects and Forwards
+Poor Data Validation
+Poor Data Validation 1
+Poor Data Validation 2
+Insecure Direct Object References
+Insecure Direct Object Reference Bank
+Insecure Direct Object Reference Challenge 1
+Insecure Direct Object Reference Challenge 2
+Cross Site Scripting
+Cross Site Scripting 1
+Cross Site Scripting 2
+Cross Site Scripting 3
+Cross Site Scripting 4
+Cross Site Scripting 5
+Cross Site Scripting 6
+SQL Injection
+SQL Injection 1
+SQL Injection 2
+SQL Injection 3
+SQL Injection 4
+SQL Injection 5
+SQL Injection 6
+SQL Injection 7
+SQL Injection Escaping
+SQL Injection Stored Procedure
+Cross Site Request Forgery
+CSRF 1
+CSRF 2
+CSRF 3
+CSRF 4
+CSRF 5
+CSRF 6
+CSRF 7
+CSRF JSON
+Insecure Cryptographic Storage
+Insecure Cryptographic Storage Challenge 1
+Insecure Cryptographic Storage Challenge 2
+Insecure Cryptographic Storage Challenge 3
+Insecure Cryptographic Storage Challenge 4
+Insecure Cryptographic Storage Home Made Key

modules/vulnerabilities/unix/web_training/security_shepherd/files/database.properties

@@ -0,0 +1,6 @@
+databaseConnectionURL=jdbc:mariadb://localhost:3306/
+DriverType=org.mariadb.jdbc.Driver
+databaseSchema=core
+databaseUsername=root
+databasePassword=CowSaysMoo
+databaseOptions=useUnicode=true&character_set_server=utf8mb4

modules/vulnerabilities/unix/web_training/security_shepherd/files/grant.sql

@@ -0,0 +1 @@
+GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' IDENTIFIED BY 'CowSaysMoo' WITH GRANT OPTION;

modules/vulnerabilities/unix/web_training/security_shepherd/files/my.cnf

@@ -0,0 +1,15 @@
+[client-server]
+# Port or socket location where to connect
+# port = 3306
+socket = /run/mysqld/mysqld.sock
+
+# Import all .cnf files from configuration directory
+!includedir /etc/mysql/conf.d/
+!includedir /etc/mysql/mariadb.conf.d/
+
+[mysqld]
+skip-host-cache
+datadir = /var/lib/mysql
+!includedir /etc/mysql/conf.d/
+ssl=0
+bind-address=*

modules/vulnerabilities/unix/web_training/security_shepherd/files/server.xml

@@ -0,0 +1,167 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  Licensed to the Apache Software Foundation (ASF) under one or more
+  contributor license agreements.  See the NOTICE file distributed with
+  this work for additional information regarding copyright ownership.
+  The ASF licenses this file to You under the Apache License, Version 2.0
+  (the "License"); you may not use this file except in compliance with
+  the License.  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+-->
+<!-- Note:  A "Server" is not itself a "Container", so you may not
+     define subcomponents such as "Valves" at this level.
+     Documentation at /docs/config/server.html
+ -->
+<Server port="8005" shutdown="SHUTDOWN">
+    <Listener className="org.apache.catalina.startup.VersionLoggerListener" />
+    <!-- Security listener. Documentation at /docs/config/listeners.html
+  <Listener className="org.apache.catalina.security.SecurityListener" />
+  -->
+    <!--APR
+    library loader. Documentation at /docs/apr.html -->
+    <Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />
+    <!-- Prevent memory leaks due to use of particular java/javax APIs-->
+    <Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener" />
+    <Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />
+    <Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener" />
+
+    <!-- Global JNDI resources
+       Documentation at /docs/jndi-resources-howto.html
+  -->
+    <GlobalNamingResources>
+        <!-- Editable user database that can also be used by
+         UserDatabaseRealm to authenticate users
+    -->
+        <Resource name="UserDatabase" auth="Container"
+            type="org.apache.catalina.UserDatabase"
+            description="User database that can be updated and saved"
+            factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
+            pathname="conf/tomcat-users.xml" />
+    </GlobalNamingResources>
+
+    <!-- A "Service" is a collection of one or more "Connectors" that share
+       a single "Container" Note:  A "Service" is not itself a "Container",
+       so you may not define subcomponents such as "Valves" at this level.
+       Documentation at /docs/config/service.html
+   -->
+    <Service name="Catalina">
+
+        <!--The
+        connectors can use a shared executor, you can define one or more named thread pools-->
+        <!--
+    <Executor name="tomcatThreadPool" namePrefix="catalina-exec-"
+        maxThreads="150" minSpareThreads="4"/>
+    -->
+
+
+        <!-- A "Connector" represents an endpoint by which requests are received
+         and responses are returned. Documentation at :
+         Java HTTP Connector: /docs/config/http.html
+         Java AJP  Connector: /docs/config/ajp.html
+         APR (HTTP/AJP) Connector: /docs/apr.html
+         Define a non-SSL/TLS HTTP/1.1 Connector on port 8080
+    -->
+        <!--    <Connector port="8080" protocol="HTTP/1.1"
+               connectionTimeout="20000"
+               redirectPort="8443" />
+ -->   <!-- A "Connector" using the shared thread pool-->
+
+        <Connector executor="tomcatThreadPool"
+            address="0.0.0.0" port="80" protocol="HTTP/1.1"
+            connectionTimeout="20000"
+            redirectPort="443" />
+        <!-- Define a SSL/TLS HTTP/1.1 Connector on port 8443
+         This connector uses the NIO implementation. The default
+         SSLImplementation will depend on the presence of the APR/native
+         library and the useOpenSSL attribute of the
+         AprLifecycleListener.
+         Either JSSE or OpenSSL style configuration may be used regardless of
+         the SSLImplementation selected. JSSE style configuration is used below.
+    -->
+        <Connector address="0.0.0.0" port="443"
+            protocol="org.apache.coyote.http11.Http11NioProtocol"
+            maxThreads="150" SSLEnabled="true" scheme="https" secure="true" clientAuth="false"
+            sslProtocol="TLS" keystoreFile="conf/shepherdKeystore.p12" keystorePass="CowSaysMoo"
+            keyAlias="tomcat" />
+        <!-- Define a SSL/TLS HTTP/1.1 Connector on port 8443 with HTTP/2
+         This connector uses the APR/native implementation which always uses
+         OpenSSL for TLS.
+         Either JSSE or OpenSSL style configuration may be used. OpenSSL style
+         configuration is used below.
+    -->
+        <!--
+    <Connector port="8443" protocol="org.apache.coyote.http11.Http11AprProtocol"
+               maxThreads="150" SSLEnabled="true" >
+        <UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol" />
+        <SSLHostConfig>
+            <Certificate certificateKeyFile="conf/localhost-rsa-key.pem"
+                         certificateFile="conf/localhost-rsa-cert.pem"
+                         certificateChainFile="conf/localhost-rsa-chain.pem"
+                         type="RSA" />
+        </SSLHostConfig>
+    </Connector>
+    -->
+
+        <!-- Define an AJP 1.3 Connector on port 8009 -->
+        <!--
+    <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" />
+    -->
+
+
+        <!-- An Engine represents the entry point (within Catalina) that processes
+         every request.  The Engine implementation for Tomcat stand alone
+         analyzes the HTTP headers included with the request, and passes them
+         on to the appropriate Host (virtual host).
+         Documentation at /docs/config/engine.html -->
+
+        <!-- You should set jvmRoute to support load-balancing via AJP ie :
+    <Engine name="Catalina" defaultHost="localhost" jvmRoute="jvm1">
+    -->
+        <Engine name="Catalina" defaultHost="localhost">
+
+            <!--For
+            clustering, please take a look at documentation at:
+          /docs/cluster-howto.html  (simple how to)
+          /docs/config/cluster.html (reference documentation) -->
+            <!--
+      <Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"/>
+      -->
+
+            <!-- Use the LockOutRealm to prevent attempts to guess user passwords
+           via a brute-force attack -->
+            <Realm className="org.apache.catalina.realm.LockOutRealm">
+                <!-- This Realm uses the UserDatabase configured in the global JNDI
+             resources under the key "UserDatabase".  Any edits
+             that are performed against this UserDatabase are immediately
+             available for use by the Realm.  -->
+                <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
+                    resourceName="UserDatabase" />
+            </Realm>
+
+            <Host name="localhost" appBase="webapps"
+                unpackWARs="true" autoDeploy="true">
+
+                <!-- SingleSignOn valve, share authentication between web applications
+             Documentation at: /docs/config/valve.html -->
+                <!--
+        <Valve className="org.apache.catalina.authenticator.SingleSignOn" />
+        -->
+
+                <!-- Access log processes all example.
+             Documentation at: /docs/config/valve.html
+             Note: The pattern used is equivalent to using pattern="common" -->
+                <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
+                    prefix="localhost_access_log" suffix=".txt"
+                    pattern="%h %l %u %t &quot;%r&quot; %s %b" />
+
+            </Host>
+        </Engine>
+    </Service>
+</Server>

modules/vulnerabilities/unix/web_training/security_shepherd/manifests/install.pp

@@ -0,0 +1,49 @@
+# Installer process
+class security_shepherd::install {
+  include stdlib
+
+  Exec { path => ['/bin', '/usr/bin', '/usr/local/bin', '/sbin', '/usr/sbin'] }
+
+  ensure_packages(['tomcat9', 'mariadb-server', 'openjdk-11-jdk'], {ensure => installed})
+
+  service { 'tomcat9':
+    ensure     => running,
+    name       => 'tomcat9',
+    enable     => true,
+    hasrestart => true,
+    subscribe  => [
+      File['/var/lib/tomcat9/webapps/ROOT.war'],
+    ],
+  }
+
+  exec { 'remove-default-site':
+    command => 'rm -rf /var/lib/tomcat9/webapps/*',
+  }
+  -> file { '/var/lib/tomcat9/webapps/ROOT.war':
+    ensure => file,
+    source => 'puppet:///modules/security_shepherd/ROOT.war',
+  }
+  file { '/var/lib/tomcat9/conf/shepherdKeystore.p12':
+    ensure => file,
+    source => 'puppet:///modules/security_shepherd/shepherdKeystore.p12',
+  }
+  -> file { '/var/lib/tomcat9/conf/server.xml':
+    ensure  => file,
+    source  => 'puppet:///modules/security_shepherd/server.xml',
+    replace => true,
+  }
+  -> file { '/var/lib/tomcat9/conf/web.xml':
+    ensure  => file,
+    source  => 'puppet:///modules/security_shepherd/web.xml',
+    replace => true,
+  }
+  -> file { '/var/lib/tomcat9/conf/database.properties':
+    ensure => file,
+    source => 'puppet:///modules/security_shepherd/database.properties',
+  }
+  -> file { '/etc/mysql/my.cnf':
+    ensure  => file,
+    source  => 'puppet:///modules/security_shepherd/my.cnf',
+    replace => true,
+  }
+}

modules/vulnerabilities/unix/web_training/security_shepherd/manifests/mariadb.pp

@@ -0,0 +1,56 @@
+# Mariadb setup
+class security_shepherd::mariadb {
+  $secgen_parameters=secgen_functions::get_parameters($::base64_inputs_file)
+  $unix_username = $secgen_parameters['unix_username'][0]
+  $flag_store = $secgen_parameters['flag_store']
+  $modules = $secgen_parameters['modules']
+  $user = 'root'
+  $db_pass = 'CowSaysMoo'
+
+  Exec { path => ['/bin', '/usr/bin', '/usr/local/bin', '/sbin', '/usr/sbin'] }
+
+  # Execute this before we lock down root permissions.
+  file { '/tmp/grant.sql':
+    ensure => file,
+    source => 'puppet:///modules/security_shepherd/grant.sql',
+  }
+  -> exec { 'grant-root':
+    cwd     => '/tmp',
+    command => "mysql -u ${user} -p${db_pass} < grant.sql",
+  }
+
+  file { '/tmp/coreSchema.sql':
+    ensure  => file,
+    content => template('security_shepherd/coreSchema.sql.erb'),
+  }
+  -> file { '/tmp/moduleSchemas.sql':
+    ensure => file,
+    source => 'puppet:///modules/security_shepherd/moduleSchemas.sql',
+  }
+
+  exec { 'create-core':
+    cwd     => '/tmp',
+    command => "mysql -u ${user} -p${db_pass} < coreSchema.sql",
+  }
+  -> exec { 'create-modules':
+    cwd     => '/tmp',
+    command => "mysql -u ${user} -p${db_pass} < moduleSchemas.sql",
+  }
+
+
+  file { '/var/lib/tomcat9/webapps/ROOT/WEB-INF/classes/flags':
+    ensure  => present,
+    content => template('security_shepherd/flags.erb'),
+    replace => true,
+  }
+  -> file { '/var/lib/tomcat9/webapps/ROOT/WEB-INF/classes/active-modules':
+    ensure  => present,
+    content => template('security_shepherd/active-modules.erb'),
+    replace => true,
+    notify  => Service['tomcat9']
+  }
+  # This needs updating? Weird chicanery happens if not used this way
+  -> exec { 'restart-tom':
+    command => 'systemctl restart tomcat9',
+  }
+}

modules/vulnerabilities/unix/web_training/security_shepherd/secgen_metadata.xml

@@ -0,0 +1,45 @@
+<?xml version="1.0"?>
+<vulnerability xmlns="http://www.github/cliffe/SecGen/vulnerability"
+  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+  xsi:schemaLocation="http://www.github/cliffe/SecGen/vulnerability">
+
+  <name>Security Shepherd</name>
+  <author>James Davis</author>
+  <module_license>MIT</module_license>
+  <description>The OWASP Security Shepherd Project is a web and mobile application security training
+    platform. Security Shepherd has been designed to foster and improve security awareness among a
+    varied skill-set demographic. The aim of this project is to take AppSec novices or experienced
+    engineers and sharpen their penetration testing skill set to security expert status.</description>
+
+  <type>web_training_platform</type>
+  <type>webapp</type>
+  <privilege>none</privilege>
+  <access>user_action</access>
+  <platform>unix</platform>
+
+  <read_fact>unix_username</read_fact>
+  <read_fact>modules</read_fact>
+  <read_fact>flag_store</read_fact>
+
+  <default_input into="unix_username">
+    <generator type="username_generator" />
+  </default_input>
+
+  <default_input into="modules">
+    <generator type="ss_modules" />
+  </default_input>
+
+  <default_input into="flag_store">
+    <generator type="flag_generator" />
+  </default_input>
+
+  <reference>https://github.com/OWASP/SecurityShepherd</reference>
+
+  <software_name>security_shepherd</software_name>
+  <software_license>GPLv3</software_license>
+
+  <requires>
+    <module_path>.*mysql.*compatible.*</module_path>
+  </requires>
+
+</vulnerability>

modules/vulnerabilities/unix/web_training/security_shepherd/security_shepherd.pp

@@ -0,0 +1,2 @@
+include security_shepherd::install
+include security_shepherd::mariadb

modules/vulnerabilities/unix/web_training/security_shepherd/templates/active-modules.erb

@@ -0,0 +1,3 @@
+<% @modules.each do |mod| -%>
+<%= mod %>
+<% end -%>

modules/vulnerabilities/unix/web_training/security_shepherd/templates/flags.erb

@@ -0,0 +1,4 @@
+<% @flag_store.each do |flag| -%>
+<%= flag %>
+<% end -%>
+

scenarios/examples/vulnerability_examples/shepherd.xml

@@ -0,0 +1,48 @@
+<?xml version="1.0"?>
+
+<scenario xmlns="http://www.github/cliffe/SecGen/scenario"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://www.github/cliffe/SecGen/scenario">
+
+    <system>
+        <system_name>shepherd</system_name>
+        <base distro="Debian 10" type="desktop" name="KDE" />
+
+        <vulnerability module_path=".*/security_shepherd">
+            <input into="modules" into_datastore="modules">
+                <generator type="ss_modules">
+                    <input into="filter">
+                        <value>SQL</value>
+                        <value>CSRF</value>
+                    </input>
+                </generator>
+            </input>
+            <input into="flag_store" into_datastore="flag_store">
+                <generator type="flag_generator">
+                    <input into="iterations">
+                        <value>10</value>
+                    </input>
+                </generator>
+            </input>
+        </vulnerability>
+
+        <utility module_path=".*/parameterised_accounts" platform="linux">
+            <input into="accounts" into_datastore="accounts">
+                <generator type="account">
+                    <input into="username">
+                        <value>user1</value>
+                    </input>
+                    <input into="password">
+                        <value>password</value>
+                    </input>
+                    <input into="super_user">
+                        <value>true</value>
+                    </input>
+                </generator>
+            </input>
+        </utility>
+
+        <network type="private_network" range="dhcp" />
+    </system>
+
+</scenario>