7_post-exploitation.xml

<?xml version="1.0"?>

<scenario xmlns="http://www.github/cliffe/SecGen/scenario"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.github/cliffe/SecGen/scenario">

  <name>Post-exploitation</name>
  <author>Z. Cliffe Schreuders</author>
  <description>
# Introduction
Post-exploitation is the phase where an attacker, having gained initial access to a target system, aims to further exploit the compromised system, gather information, escalate privileges, and maintain access. Once an attacker has a foothold in a system, they can misuse the privileges they have “appropriated” to take actions on the system, or go on to try to gain even more access on this or other connected systems. In this lab, you will delve into the intricacies of post-exploitation in a controlled environment, gaining hands-on experience in a range of activities that mirror real-world cyberattacks.

You will learn the skills used by an attacker or security tester, to take action once an exploit has been successful. Throughout this lab, you will learn how to identify and exploit vulnerabilities in a target system, understand the extent of access you have gained, and execute privilege escalation to elevate your control on the compromised system. You will compile and transfer a local privilege escalation exploit, collect password hashes, and discover sensitive data. Additionally, you will explore advanced payloads, such as Meterpreter, and experiment with features like keylogging and screen capturing. You will also understand the concept of pivoting, where you attack one system through another, and cover your tracks to maintain stealth. By the end of this comprehensive lab, you will have completed the essential stages of a typical cyberattack, enhancing your skills and knowledge in the field of cybersecurity.

# Suggested reading
[An excellent resource is Metasploit Unleashed.](http://www.offensive-security.com/metasploit-unleashed/Exploits)
  </description>
  <lab_sheet_url>https://docs.google.com/document/d/1bt0yKzKjExEih5cmXyl-D__loGwV0UJxQJEDIXxCGxw/edit?usp=sharing</lab_sheet_url>

  <type>ctf-lab</type>
  <type>lab-sheet</type>
  <difficulty>easy</difficulty>

  <CyBOK KA="AB" topic="Models">
    <keyword>kill chains</keyword>
  </CyBOK>
  <CyBOK KA="MAT" topic="Malicious Activities by Malware">
    <keyword>cyber kill chain</keyword>
    <keyword>attack on confidentiality, integrity, availability</keyword>
  </CyBOK>
  <CyBOK KA="MAT" topic="Attacks and exploitation">
    <keyword>Post-exploitation: pivoting attacks, information gathering</keyword>
  </CyBOK>
  <CyBOK KA="SOIM" topic="PENETRATION TESTING">
    <keyword>PENETRATION TESTING - SOFTWARE TOOLS</keyword>
    <keyword>PENETRATION TESTING - ACTIVE PENETRATION</keyword>
  </CyBOK>

  <system>
    <system_name>windows_server</system_name>
    <base platform="windows" distro="7"/>

    <input into_datastore="IP_addresses">
      <!-- 0 windows desktop -->
      <value>172.16.0.2</value>
      <!-- 1 linux server -->
      <value>172.16.0.3</value>
      <!-- 1 kali -->
      <value>172.16.0.4</value>
    </input>

    <utility module_path=".*/parameterised_accounts" platform="windows">
      <input into="accounts" into_datastore="accounts">
        <generator type="account">
          <input into="username">
            <generator type="random_sanitised_word">
              <input into="wordlist">
                <value>mythical_creatures</value>
              </input>
            </generator>
          </input>
          <input into="password">
            <value>tiaspbiqe2r</value>
          </input>
          <input into="super_user">
            <value>true</value>
          </input>
          <input into="strings_to_leak">
            <generator type="flag_generator" />
          </input>
          <input into="leaked_filenames">
            <value>flag.txt</value>
          </input>
        </generator>
      </input>
    </utility>

    <!-- vulnerable ftp server -->
    <vulnerability module_path=".*/easyftp_rce"/>

    <network type="private_network">
      <input into="IP_address">
        <datastore access="0">IP_addresses</datastore>
      </input>
    </network>
    <input into_datastore="spoiler_admin_pass">
      <generator type="strong_password_generator"/>
    </input>
    <!-- <build type="cleanup">
      <input into="root_password">
        <datastore>spoiler_admin_pass</datastore>
      </input>
    </build> -->

  </system>

  <system>
    <system_name>linux_server</system_name>

    <base distro="Debian 12" type="desktop" name="KDE"/>

    <input into_datastore="user_accounts_server">
      <generator type="account">
        <input into="username">
          <value>crackme</value>
        </input>
        <input into="password" into_datastore="server_crackme_password">
          <generator type="weak_password_generator"/>
        </input>
        <!-- this flag is available to root -->
        <input into="leaked_filenames">
          <value>flag</value>
        </input>
        <input into="strings_to_leak">
          <generator type="flag_generator" />
        </input>
      </generator>
    </input>

    <!-- this is password protected by the same password as the crackme user -->
    <vulnerability type="zip_file">
      <input into="base64_file">
        <generator type="zip_file_generator">
          <input into="password">
            <datastore>server_crackme_password</datastore>
          </input>
          <input into="strings_to_leak">
            <generator type="flag_generator"/>
            <value>
              Congratulations you have cracked our protected zip file. Here is a flag for your troubles.
            </value>
          </input>
        </generator>
      </input>
      <input into="leaked_filename">
        <value>protected.zip</value>
      </input>
      <input into="storage_directory">
        <value>/root</value>
      </input>
    </vulnerability>

    <!--Create the users-->
    <utility module_path=".*/parameterised_accounts">
      <input into="accounts">
        <datastore>user_accounts_server</datastore>
      </input>
    </utility>


    <vulnerability module_path=".*/sudoedit">
      <input into="strings_to_leak">
        <generator type="flag_generator" />
      </input>
      <input into="leaked_filenames">
        <value>flag</value>
      </input>
    </vulnerability>
    <!-- vulnerable distcc server -->
    <vulnerability cve="CVE-2004-2687">
      <input into="strings_to_leak">
        <generator type="flag_generator" />
      </input>
      <input into="leaked_filenames">
        <value>flag</value>
      </input>
    </vulnerability>

    <network type="private_network">
      <input into="IP_address">
        <datastore access="1">IP_addresses</datastore>
      </input>
    </network>
    <build type="cleanup">
      <input into="root_password">
        <datastore>spoiler_admin_pass</datastore>
      </input>
    </build>

  </system>

  <system>
    <system_name>kali</system_name>
    <base distro="Kali" name="MSF"/>

    <utility module_path=".*/parameterised_accounts">
      <input into="accounts">
        <value>{"username":"kali","password":"kali","super_user":"true","strings_to_leak":[],"leaked_filenames":[]}</value>
      </input>
    </utility>

    <utility module_path=".*/metasploit_framework"/>
    <utility module_path=".*/armitage"/>
    <utility module_path=".*/exploitdb"/>
    <utility module_path=".*/handy_cli_tools"/>
    <utility module_path=".*/nmap"/>
    <utility module_path=".*/kali_pwtools"/>

    <network type="private_network" >
      <input into="IP_address">
        <datastore access="2">IP_addresses</datastore>
      </input>
    </network>
    <build type="cleanup">
      <input into="root_password">
        <datastore>spoiler_admin_pass</datastore>
      </input>
    </build>

  </system>

</scenario>