From e6ff59c39a604fea282fd767401dcb8ff9d90ee6 Mon Sep 17 00:00:00 2001 From: JD Date: Thu, 27 Apr 2023 16:08:58 +0100 Subject: [PATCH 1/6] Add Jenkins CTF Scenario --- scenarios/ctf/administration_woes.xml | 103 ++++++++++++++++++++++++++ 1 file changed, 103 insertions(+) create mode 100644 scenarios/ctf/administration_woes.xml diff --git a/scenarios/ctf/administration_woes.xml b/scenarios/ctf/administration_woes.xml new file mode 100644 index 000000000..45813ac26 --- /dev/null +++ b/scenarios/ctf/administration_woes.xml @@ -0,0 +1,103 @@ + + + + + Automation Woes + James Davis + + There is a process hosted on a remote server that is vulnerable to exploit. + Find a way in then escalate to root. + + + ctf + attack-ctf + intermediate + + + EXPLOITATION + EXPLOITATION FRAMEWORKS + + + CVEs and CWEs + + + PENETRATION TESTING - SOFTWARE TOOLS + PENETRATION TESTING - ACTIVE PENETRATION + + + server-side misconfiguration and vulnerable components + Serialized objects + + + + access control + Elevated privileges + Vulnerabilities and attacks on access control misconfigurations + + + Access controls and operating systems + Linux security model + + + + server + + + + + + + + + + + + + + + + + + + + IP_addresses + + + + + + attack_vm + + + + + 172.16.0.2 + + 172.16.0.3 + + + + + + {"username":"root","password":"toor","super_user":"","strings_to_leak":[],"leaked_filenames":[]} + + + false + + + + + + + + + + + IP_addresses + + + + + \ No newline at end of file From a5e7dc23d9897f68baedc0d2b5b98b43711079b4 Mon Sep 17 00:00:00 2001 From: JD Date: Thu, 27 Apr 2023 16:26:50 +0100 Subject: [PATCH 2/6] amend vulnerability tag --- scenarios/ctf/administration_woes.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scenarios/ctf/administration_woes.xml b/scenarios/ctf/administration_woes.xml index 45813ac26..c52ac8a21 100644 --- a/scenarios/ctf/administration_woes.xml +++ b/scenarios/ctf/administration_woes.xml @@ -58,7 +58,7 @@ - + From 68f91ee1e4bc9f2ea55006985cb0e7ec3490f330 Mon Sep 17 00:00:00 2001 From: JD Date: Thu, 27 Apr 2023 16:30:27 +0100 Subject: [PATCH 3/6] Add couchdb CTF Scenario --- scenarios/ctf/erlang_explosion.xml | 105 +++++++++++++++++++++++++++++ 1 file changed, 105 insertions(+) create mode 100644 scenarios/ctf/erlang_explosion.xml diff --git a/scenarios/ctf/erlang_explosion.xml b/scenarios/ctf/erlang_explosion.xml new file mode 100644 index 000000000..0e4975248 --- /dev/null +++ b/scenarios/ctf/erlang_explosion.xml @@ -0,0 +1,105 @@ + + + + + Erlang Explosion + James Davis + + A vulnerable service utilises erlang that has a fatal flaw. + Exploit the server and get root access. + + + ctf + attack-ctf + intermediate + + + server-side misconfiguration and vulnerable components + Vulnerable defaults + + + EXPLOITATION + EXPLOITATION FRAMEWORKS + + + CVEs and CWEs + + + PENETRATION TESTING - SOFTWARE TOOLS + PENETRATION TESTING - ACTIVE PENETRATION + + + + access control + Elevated privileges + Vulnerabilities and attacks on access control misconfigurations + + + Access controls and operating systems + Linux security model + Attacks against SUID + + + + + server + + + + + + + + + + + + + + + + + + + + IP_addresses + + + + + + attack_vm + + + + + 172.16.0.2 + + 172.16.0.3 + + + + + + {"username":"root","password":"toor","super_user":"","strings_to_leak":[],"leaked_filenames":[]} + + + false + + + + + + + + + + + IP_addresses + + + + + \ No newline at end of file From 1ef73cc6864b29061b9377fa5ee65991d5b9b7d6 Mon Sep 17 00:00:00 2001 From: JD Date: Thu, 27 Apr 2023 16:35:35 +0100 Subject: [PATCH 4/6] Add druid CTF Scenario --- scenarios/ctf/eventful_data.xml | 103 ++++++++++++++++++++++++++++++++ 1 file changed, 103 insertions(+) create mode 100644 scenarios/ctf/eventful_data.xml diff --git a/scenarios/ctf/eventful_data.xml b/scenarios/ctf/eventful_data.xml new file mode 100644 index 000000000..d8c29077f --- /dev/null +++ b/scenarios/ctf/eventful_data.xml @@ -0,0 +1,103 @@ + + + + + Eventful Data + James Davis + + There is a vulnerable webserver that can be exploited. + Find it and then get root. + + + ctf + attack-ctf + intermediate + + + server-side misconfiguration and vulnerable components + + + EXPLOITATION + EXPLOITATION FRAMEWORKS + + + CVEs and CWEs + + + PENETRATION TESTING - SOFTWARE TOOLS + PENETRATION TESTING - ACTIVE PENETRATION + + + + access control + Elevated privileges + Vulnerabilities and attacks on access control misconfigurations + + + Access controls and operating systems + Linux security model + Attacks against SUDO + + + + server + + + + + + + + + + + + + + + + + + + + IP_addresses + + + + + + attack_vm + + + + + 172.16.0.2 + + 172.16.0.3 + + + + + + {"username":"root","password":"toor","super_user":"","strings_to_leak":[],"leaked_filenames":[]} + + + false + + + + + + + + + + + IP_addresses + + + + + \ No newline at end of file From 94b1407cbd94606f9b2907a80221a1789e550cd1 Mon Sep 17 00:00:00 2001 From: JD Date: Thu, 27 Apr 2023 16:40:26 +0100 Subject: [PATCH 5/6] Add apache spark CTF Scenario --- scenarios/ctf/catching_sparks.xml | 99 +++++++++++++++++++++++++++++++ 1 file changed, 99 insertions(+) create mode 100644 scenarios/ctf/catching_sparks.xml diff --git a/scenarios/ctf/catching_sparks.xml b/scenarios/ctf/catching_sparks.xml new file mode 100644 index 000000000..0bdfe6b1d --- /dev/null +++ b/scenarios/ctf/catching_sparks.xml @@ -0,0 +1,99 @@ + + + + + Catching Sparks + James Davis + + A web vulnerability allows access to a server remotely. Find the website + and gain root privilege. + + + ctf + attack-ctf + intermediate + + + server-side misconfiguration and vulnerable components + Command injection + + + EXPLOITATION + EXPLOITATION FRAMEWORKS + + + CVEs and CWEs + + + PENETRATION TESTING - SOFTWARE TOOLS + PENETRATION TESTING - ACTIVE PENETRATION + + + kill chains + + + cyber kill chain + + + + server + + + + + + + + + + + + + + + + + + + + IP_addresses + + + + + + attack_vm + + + + + 172.16.0.2 + + 172.16.0.3 + + + + + + {"username":"root","password":"toor","super_user":"","strings_to_leak":[],"leaked_filenames":[]} + + + false + + + + + + + + + + + IP_addresses + + + + + \ No newline at end of file From 8f361d36f17183261b6a8978a65988446f2a6cb4 Mon Sep 17 00:00:00 2001 From: JD Date: Thu, 27 Apr 2023 17:04:47 +0100 Subject: [PATCH 6/6] Add glpi CTF Scenario --- scenarios/ctf/manage_this.xml | 96 +++++++++++++++++++++++++++++++++++ 1 file changed, 96 insertions(+) create mode 100644 scenarios/ctf/manage_this.xml diff --git a/scenarios/ctf/manage_this.xml b/scenarios/ctf/manage_this.xml new file mode 100644 index 000000000..0ad6d8ad4 --- /dev/null +++ b/scenarios/ctf/manage_this.xml @@ -0,0 +1,96 @@ + + + + + Manage this! + James Davis + + A vulnerable website is active on a server. Find a way in and obtain root. + + + ctf + attack-ctf + intermediate + + + server-side misconfiguration and vulnerable components + Command injection + + + EXPLOITATION + EXPLOITATION FRAMEWORKS + BACKDOOR TROJANS + + + CVEs and CWEs + + + PENETRATION TESTING - SOFTWARE TOOLS + PENETRATION TESTING - ACTIVE PENETRATION + + + FILE - TRANSFER PROTOCOL (FTP) + + + + server + + + + + + + + + + + + + + + + + + + + IP_addresses + + + + + + attack_vm + + + + + 172.16.0.2 + + 172.16.0.3 + + + + + + {"username":"root","password":"toor","super_user":"","strings_to_leak":[],"leaked_filenames":[]} + + + false + + + + + + + + + + + IP_addresses + + + + + \ No newline at end of file