1557 Commits

Author SHA1 Message Date
thomashaw
fa10962295 adding breakthenet xss web vulnerability -- Now registers the mysql db + allows www-data to connect with password 'example', change this! register.php claims that registration was successful but logging in does not work... investigate further. 2017-03-30 11:21:33 +01:00
thomashaw
9f41e42381 vsftpd_backdoor: updated metadata, is actually root_rwx not user_rwx 2017-03-29 12:09:23 +01:00
thomashaw
c09341188b gitlist_040 fixed, removed bootstrap repo + added a hyperlink to /gitlist 2017-03-29 12:00:04 +01:00
thomashaw
241e83a7a9 generators/random/random_hex: added number_of_lines and line_length params
generators/challenges/encoded_diff: encodes a flag in hex, generates random_hex, shuffles the ordering, inserts a flag in a random position. accounts for line length vs flag length with random hex padding.
secgen_functions::leak_file.pp: Added division between data leaked to the same file
2017-03-28 10:51:57 +01:00
thomashaw
03aaae2bc3 xfce desktop environment: extracted out auto login as root into vulnerability module 2017-03-24 15:30:30 +00:00
thomashaw
75056b8bc8 Adding images_to_leak to appropriate modules. Use ::secgen_functions::leak_files to leak one or more images. Updated parameterised_website to leak multiple images. Updated gitlist to create a git repo with leaked strings and images. 2017-03-23 20:58:35 +00:00
thomashaw
6918eb1d3e Minor fixes - parameterised_website leaks multiple strings_to_leak & metadata corrections 2017-03-21 11:44:17 +00:00
thomashaw
78b97bdeeb Vignere Cipher - Takes strings_to_encode and encryption_key, outputs: KEY_CIPHERTEXT 2017-03-21 11:44:07 +00:00
thomashaw
b9395ac69a Selecting default_inputs on specific generators rather than string_generator 2017-03-21 11:28:26 +00:00
thomashaw
94aa36cb2b strong_password_generator 2017-03-20 14:31:56 +00:00
Jjk422
7960914a79 Adds the Windows 2008 r2 server 64 bit basebox, allows for no license.
Will download ISO from microsoft site, will then build basebox (storing in VAGRANT_BASEBOX_STORAGE) and will then build with vagrant.
If Basebox is not present SecGen will prompt whether to use packer (requires download from packer website in README.md and for the binary to be in the system path) to build the Basebox.

*** Changes ***
constants.rb
51-57: Added the 2 constants PUPPET_VERSION: version of puppet to install on the newly generated system, and VAGRANT_BASEBOX_STORAGE which stores generated baseboxes (currently set to SecGen_root/.generated).

project_files_creator.rb
48-80: Added logic to check for existing basebox and to generate new basebox if not present.

base_metadata_schema.xsd
11: Added windows to platform options type
45-50: Added extra packer helper tags, packerfile_path (path to packer file in the layout of base_module_name/Packerfile_name) and product_key (will use a trial version if product key is not present)

vulnerability_metadata_schema.xsd
32: Added windows value to platformOptions type to allow for windows system implementation.

Vagrantfile.erb
21: Changed --hwvirtex to default of on without gui output, problems can occur if this is not set to on.
23,28,31: Removed - tags before ending %>, this was causing an error with the vagrantfile as the options were not being placed on different lines.
48-56: Added the use of winrm instead of the default ssh for the base module if the base module is windows.

puppet_install/LICENSE
Added Mozilla Public License Version 2.0 (GPL v3 compatable) that came with the puppet_install/windows.ps1 script, the script to install puppet can be rewritten with a more simple implementation, however this script should do error checking to add an extra level of stability to the puppet install.

puppet_install/windows.ps1
Will install puppet on the Windows machine.

virtualbox_guest_install/windows.bat
Will install the virtualbox guest additions on the Windows machine.

Autounattend.xml.erb
Aurounattend script that allows for setting out the system layout including system information, disk configuration and product keys.

Packerfile.erb
Packerfile that builds the machine via packer, was going to be fully parameterised with all options being in the SecGen metadata (it still can be converted to this easily) however this lead to a large SecGen_metadata file with multiple tags which were only used if the basebox is not present, therefore only the product_key and packerfile_path keys were added to the SecGen_metadata file. Although the product_key data may be moved to a central product_key file later on.

secgen_metadata.xml
SecGen metadata file for the new windows basebox.
2017-03-19 17:52:17 +00:00
Mihai Ordean
86192340d7 removed debian 8.2 2017-03-18 08:54:49 +00:00
Mihai Ordean
46827cd22c added ssh_leaked_keys module 2017-03-17 16:32:59 +00:00
Mihai Ordean
cb0f6ac289 Merge https://github.com/cliffe/SecGen 2017-03-16 14:04:00 +00:00
thomashaw
3028e076d9 parameterise local root level vulnerabilities -- added strings_to_leak 2017-03-16 13:20:32 +00:00
thomashaw
53149f3fd5 Misc. changes / cleanup 2017-03-16 12:39:50 +00:00
thomashaw
7c4d21e942 generators/images/qr_code: creates a QR code out of a string(usually a flag) and outputs it as a .png represented as a base64 string. 2017-03-16 12:32:33 +00:00
thomashaw
638e87e571 generators/challenges/hidden_data_in_image_file: Appends strings_to_leak to a random image's raw data. 2017-03-16 12:22:03 +00:00
thomashaw
8d61097be5 encoders/string/hex: string to oct encoder - Encodes a string into each character's octal representation 2017-03-16 12:21:03 +00:00
thomashaw
8b83eb1ac3 encoders/string/hex: string to hex encoder - Encodes a string into hexadecimal 2017-03-16 12:18:11 +00:00
thomashaw
bb884e9ffc generators/image/random_image: Returns random image as a base64 string. leaks the image to the parameterised_website. Icons in the public domain - thanks to http://publicicons.org/ 2017-03-16 12:03:22 +00:00
thomashaw
895af9ae89 generators/challenges/bitwise_xor: input is a string_to_mask, output is 2 random bit streams that can, when bitwise xor'd together, reveal the string_to_mask. 2017-03-16 11:09:46 +00:00
thomashaw
5b76e04f9b Encoder: Morse Code. 'parentheses' mapped to [], { }, <> and () to cover as many varieties as we can. Any other character not represented in Morse Code is dropped. 2017-03-16 10:36:02 +00:00
thomashaw
253d983e01 encoders/string/dec: ASCII to DEC encoder - Encodes each character into DEC representation and concats the results 2017-03-16 10:31:01 +00:00
thomashaw
23fcdb626c encoders/string/binary: ASCII to Binary encoder 2017-03-16 10:29:07 +00:00
Z. Cliffe Schreuders
e48cd1b250 mark ascii_value_shift as being ascii_reversable 2017-03-14 17:34:44 +00:00
Z. Cliffe Schreuders
6a14c417c6 marker.xml for marking CTF flags and providing hints (which have IDs so we don't have to give the same hint twice), also updated organisation of scenarios 2017-03-14 17:30:33 +00:00
Mihai Ordean
d9391d384f added check to verify if leaked files is empty 2017-03-13 15:10:17 +00:00
Mihai Ordean
6c97d81250 added gnome desktop env. for debian 2017-03-13 10:44:26 +00:00
Mihai Ordean
45543b2662 added debian 8.2 base 2017-03-13 10:43:16 +00:00
thomashaw
e73b0f3d58 Shift Cipher Encoders: caesar_shift and ascii_value_shift 2017-03-03 12:51:26 +00:00
thomashaw
32091ed0fe Special Character work + generator/encoder superclass refactor.
The full Vagrantfile facter string has been encoded in b64 for now, would be nice to b64 the individual arguments rather than the whole string.
2017-03-01 19:19:54 +00:00
thomashaw
e8f8dcece4 Team project work squashed + removed dead code 2017-02-17 14:59:07 +00:00
Z. Cliffe Schreuders
9466f26f8e security audit remit generator 2017-02-08 00:41:14 +00:00
thomashaw
43c02f220f Updated for post-parameterisation 2017-01-17 16:27:18 +00:00
thomashaw
f8a97b2842 Parameterised Cleanup Module 2017-01-17 16:11:50 +00:00
thomashaw
373b0bc5dc Parameterised Website using datastores. Loads of generators and encoders. Check out the example scenarios. 2017-01-15 19:56:13 +00:00
Z. Cliffe Schreuders
c6780f4a9e flag{generated_flag} format for flags 2017-01-15 16:12:08 +00:00
Z. Cliffe Schreuders
fcc4630187 desktop xfce 2017-01-08 01:20:04 +00:00
Z. Cliffe Schreuders
0548606f70 minor cleanup and directory restructuring 2017-01-07 21:55:26 +00:00
thomashaw
4d6fb601b7 Revert: Updated puppetforge/apache to latest version 2016-12-30 01:10:33 +00:00
thomashaw
f78e2fc404 Updated puppetforge/apache to latest version 2016-12-21 17:57:52 +00:00
thomashaw
2be095be6c Secure/patched version of chkrootkit vulnerability (utilities/unix/scanners/chkrootkit) 2016-12-20 16:09:06 +00:00
thomashaw
e7019afa86 Fixed shellshock 2016-12-20 15:26:21 +00:00
thomashaw
0d890ee535 Corrected proftpd_133c_backdoor as it gives you a root_rwx privilege, not user_rwx privilege, shell when exploiting this vulnerability. 2016-12-20 14:55:58 +00:00
thomashaw
ad49319447 Removed leftover comment 2016-12-14 13:50:49 +00:00
thomashaw
007863e05c weak_password_generator <type> added to the weak and common pw gens, fixed typo in account_hash_builder 2016-12-08 10:54:21 +00:00
thomashaw
17f425b37f Multiple leaked files, new secgen_functions module encapsulating the file_leak and overshare.erb logic. Updated old modules to use the new resource type. 2016-12-08 10:43:48 +00:00
thomashaw
2f58b35857 Temp fix: removed single quote from welcome_message generator 2016-12-06 18:56:45 +00:00
thomashaw
1595b4f3e3 NFS /etc/exports updated to allow all networks 2016-12-06 10:09:57 +00:00