2_integrity_detection.xml

<?xml version="1.0"?>

<scenario xmlns="http://www.github/cliffe/SecGen/scenario"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.github/cliffe/SecGen/scenario">

  <name>Integrity detection lab</name>
  <author>Z. Cliffe Schreuders</author>
  <description>
    # Introduction
    Integrity management is a crucial aspect of information security, focusing on preventing and detecting unauthorized changes to resources, such as files and configurations, within a computer system. Maintaining the integrity of these resources is vital in ensuring the trustworthiness of a system, as any unauthorized changes can lead to security breaches and data corruption. This lab sheet delves into the various techniques for detecting changes to system integrity, including the use of backups, file hashing, and package verification. It emphasizes the importance of these methods in safeguarding the integrity of a system and provides hands-on exercises to demonstrate their practical application.

    In this lab, you will learn about different strategies for detecting unauthorized changes. You will create and compare backups of critical system files, generate and compare file hashes using tools like md5sum and sha1deep, and explore the concept of package verification to check the integrity of installed software packages. You will face challenges from Hackerbot, where you'll apply the learned techniques to detect and respond to various security threats, such as detecting new users, changes to config files, and replaced binary files with malware. This hands-on experience will equip you with the skills and knowledge needed to protect and maintain the integrity of a computer system, a fundamental component of effective information security.

    This is a Hackerbot lab. The labsheet is available once you claim a set of VMs. Work through the labsheet, then when prompted interact with Hackerbot.
  </description>

  <type>ctf-lab</type>
  <type>hackerbot-lab</type>
  <type>lab-sheet</type>
  <difficulty>intermediate</difficulty>

  <CyBOK KA="F" topic="Artifact Analysis">
    <keyword>cryptographic hashing</keyword>
  </CyBOK>
  <CyBOK KA="SOIM" topic="Monitor: Data Sources">
    <keyword>MONITORING - FILE INTEGRITY CHECKERS</keyword>
  </CyBOK>
  <CyBOK KA="OSV" topic="OS Hardening">
    <keyword>code and data integrity checks</keyword>
  </CyBOK>

  <video>
    <title>Monitoring Integrity</title>
    <by>Z. Cliffe Schreuders</by>
    <url>https://www.youtube.com/watch?v=qzyEdeQ_7ZY</url>
    <type>lecture-prerecorded</type>
    <CyBOK KA="F" topic="Artifact Analysis">
      <keyword>cryptographic hashing</keyword>
    </CyBOK>
    <CyBOK KA="SOIM" topic="Monitor: Data Sources">
      <keyword>MONITORING - FILE INTEGRITY CHECKERS</keyword>
    </CyBOK>
    <CyBOK KA="OSV" topic="OS Hardening">
      <keyword>code and data integrity checks</keyword>
    </CyBOK>
  </video>
  <video>
    <title>Incident Response</title>
    <by>Z. Cliffe Schreuders</by>
    <url>https://www.youtube.com/watch?v=kz7m-iyzSOw</url>
    <type>lecture-prerecorded</type>
    <CyBOK KA="OSV" topic="Fundamental Concepts">
      <keyword>workflows and vocabulary</keyword>
      <keyword>architectural principles</keyword>
    </CyBOK>
    <CyBOK KA="OSV" topic="Human Factors: Incident Management">
      <keyword>prepare: incident management planning</keyword>
      <keyword>handle: actual incident response</keyword>
      <keyword>follow up: post incident activities</keyword>
      <keyword>BUSINESS CONTINUITY PLAN - AND INCIDENT RESPONSE</keyword>
      <keyword>incident response methodologies</keyword>
    </CyBOK>
    <CyBOK KA="LR" topic="Data Protection">
      <keyword>investigation and prevention of crime</keyword>
      <keyword>personal data breach notification</keyword>
      <keyword>enforcement and penalties</keyword>
    </CyBOK>
  </video>

  <system>
    <system_name>desktop</system_name>
    <base distro="Debian 12" type="desktop" name="KDE"/>

    <input into_datastore="IP_addresses">
      <value>172.16.0.2</value>
      <value>172.16.0.3</value>
    </input>

    <!--generate two accounts, YOU and someone else-->
    <input into_datastore="accounts">
      <generator type="account">
        <input into="username">
          <generator type="random_sanitised_word">
            <input into="wordlist">
              <value>mythical_creatures</value>
            </input>
          </generator>
        </input>
        <input into="password">
          <value>tiaspbiqe2r</value>
        </input>
        <input into="super_user">
          <value>true</value>
        </input>
        <input into="leaked_filenames">
          <value>trade_secrets/code.pl</value>
          <value>trade_secrets/credit_card</value>
          <value>personal_secrets/credit_card</value>
          <value>logs/log1</value>
          <value>personal_secrets/address_book</value>
        </input>
        <input into="strings_to_leak">
          <value>no warnings; `$=`;$_=\%!;($_)=/(.)/;$==++$|;($.,$/,$,,$\,$",$;,$^,$#,$~,$*,$:,@%)=(
            $!=~/(.)(.).(.)(.)(.)(.)..(.)(.)(.)..(.)......(.)/,$"),$=++;$.++;$.++;
            $_++;$_++;($_,$\,$,)=($~.$"."$;$/$%[$?]$_$\$,$:$%[$?]",$"&amp;$~,$#,);$,++
            ;$,++;$^|=$";`$_$\$,$/$:$;$~$*$%[$?]$.$~$*${#}$%[$?]$;$\$"$^$~$*.>&amp;$=`</value>
          <value>Visa  4111 1111 1111 1111
American Express  3400 0000 0000 009
Diner's Club  3000 0000 0000 04</value>
          <value>MasterCard  5500 0000 0000 0004</value>
          <value>[80380.876359] usb 3-1: USB disconnect, device number 3
[80382.626853] usb 3-1: new full-speed USB device number 4 using xhci_hcd
[80382.755813] usb 3-1: New USB device found, idVendor=096e, idProduct=0858
[80382.755819] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[80382.755822] usb 3-1: Product: U2F CCID KBOARD
[80382.755825] usb 3-1: Manufacturer: FT
[80382.757386] hid-generic 0003:096E:0858.0004: hiddev0,hidraw0: USB HID v1.00 Device [FT U2F CCID KBOARD] on usb-0000:00:14.0-1/input0
[80383.925811] usb 3-1: USB disconnect, device number 4
          </value>
          <generator type="person" />
        </input>
      </generator>
      <generator type="account">
        <input into="username">
          <generator type="random_sanitised_word">
            <input into="wordlist">
              <value>mythical_creatures</value>
            </input>
          </generator>
        </input>
        <input into="password">
          <value>test</value>
        </input>
        <input into="super_user">
          <value>false</value>
        </input>
        <input into="leaked_filenames">
          <value></value>
        </input>
        <input into="strings_to_leak">
          <value></value>
        </input>
      </generator>
      <generator type="account">
        <input into="username">
          <generator type="random_sanitised_word">
            <input into="wordlist">
              <value>mythical_creatures</value>
            </input>
          </generator>
        </input>
        <input into="password">
          <value>test</value>
        </input>
        <input into="super_user">
          <value>false</value>
        </input>
        <input into="leaked_filenames">
          <value></value>
        </input>
        <input into="strings_to_leak">
          <value></value>
        </input>
      </generator>
    </input>

    <!-- an admin account used for hackerbot access to the desktop and also spoilers/administration of the challenge -->
    <input into_datastore="spoiler_admin_pass">
      <generator type="strong_password_generator"/>
    </input>

    <!--Create the users-->
    <utility module_path=".*/parameterised_accounts">
      <input into="accounts">
        <datastore>accounts</datastore>
      </input>
    </utility>

    <utility module_path=".*/kde_minimal">
      <input into="autologin_user">
        <datastore access="0" access_json="['username']">accounts</datastore>
      </input>
      <input into="accounts">
        <datastore>accounts</datastore>
      </input>
      <input into="autostart_konsole">
        <value>true</value>
      </input>
    </utility>
    <utility module_path=".*/handy_cli_tools"/>
    <utility module_path=".*/hash_tools"/>

    <utility module_path=".*/iceweasel">
      <input into="accounts">
        <datastore>accounts</datastore>
      </input>
      <input into="autostart">
        <value>true</value>
      </input>
      <input into="start_page">
        <datastore access="1">IP_addresses</datastore>
      </input>
    </utility>

    <utility module_path=".*/pidgin">
      <input into="server_ip">
        <datastore access="1">IP_addresses</datastore>
      </input>
      <input into="accounts">
        <datastore access="0">accounts</datastore>
      </input>
    </utility>

    <vulnerability module_path=".*/ssh_root_login">
      <input into="root_password">
        <datastore>spoiler_admin_pass</datastore>
      </input>
    </vulnerability>

    <network type="private_network" >
      <input into="IP_address">
        <datastore access="0">IP_addresses</datastore>
      </input>
    </network>

    <build type="cleanup">
      <input into="root_password">
        <datastore>spoiler_admin_pass</datastore>
      </input>
    </build>
  </system>

  <system>
    <system_name>hackerbot_server</system_name>
    <base distro="Kali" name="MSF"/>

    <service type="ircd"/>

    <utility module_path=".*/metasploit_framework"/>
    <utility module_path=".*/nmap"/>
    <utility module_path=".*/handy_cli_tools"/>

    <service type="httpd"/>

    <utility module_path=".*/hackerbot">
      <input into="hackerbot_configs" into_datastore="hackerbot_instructions">
        <generator module_path=".*/integrity_detection">
          <input into="accounts">
            <datastore>accounts</datastore>
          </input>
          <input into="root_password">
            <datastore>spoiler_admin_pass</datastore>
          </input>
        </generator>
      </input>
    </utility>

    <network type="private_network" >
      <input into="IP_address">
        <datastore access="1">IP_addresses</datastore>
      </input>
    </network>

    <!-- an admin account only for spoilers/administration of the challenge -->
    <build type="cleanup">
      <input into="root_password">
        <datastore>spoiler_admin_pass</datastore>
      </input>
    </build>

  </system>

</scenario>