3_backups_and_recovery.xml

<?xml version="1.0"?>

<scenario xmlns="http://www.github/cliffe/SecGen/scenario"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.github/cliffe/SecGen/scenario">

  <name>Backups lab</name>
  <author>Z. Cliffe Schreuders</author>
  <description>
    # Introduction
    This lab focuses on the critical aspect of contingency planning in the context of cybersecurity and data management. It highlights the importance of maintaining data availability and system reliability, especially when dealing with potential disasters and security incidents. The lab delves into practical strategies for creating reliable backups, understanding recovery procedures, and implementing backup solutions using the powerful rsync command.

    In this lab, you will learn how to utilize SSH/SCP for secure file transfer, create full, differential, and incremental backups using the rsync tool, and employ backups for efficient data protection. You will also explore the concept of snapshot backups, which allow for efficient storage of data by using hard links to unchanged files. Throughout the lab, you will engage in hands-on tasks such as copying directories, performing backups, restoring files, and setting up remote backups. By completing these exercises, you will gain valuable skills in contingency planning and data backup strategies, which are essential for maintaining the availability and security of critical systems and data.

    This is a Hackerbot lab. The labsheet is available once you claim a set of VMs. Work through the labsheet, then when prompted interact with Hackerbot.

    # Tips for the lab

    [This resource is really really useful for understanding what happens when using Rsync depending on whether you include or don't include a slash at the end of a path, which often catches people out.](https://web.archive.org/web/20220703112235/http://qdosmsq.dunbar-it.co.uk/blog/2013/02/rsync-to-slash-or-not-to-slash/)

    This lab needs to be completed in order.

    Manually check you have done your backups correctly before telling Hackerbot you are ready. It may be a good idea to ssh to your backup server in a separate console tab ssh IP-ADDRESS (but do keep an eye on which system you are running each command on!).

    Keep an eye on the trailing slashes in rsync commands and how it changes the behaviour (the difference between copying a directory or it's contents).

    Each time you can test that your rsync command is going to do what you expect by adding -n to the command, which does a "Dry Run" without making any of the actual changes -- once you are happy it's making the changes you expect, run it again without the -n

  </description>

  <type>ctf-lab</type>
  <type>hackerbot-lab</type>
  <type>lab-sheet</type>
  <difficulty>intermediate</difficulty>

  <CyBOK KA="SOIM" topic="Execute: Mitigation and Countermeasures">
    <keyword>Recover data and services after an incident</keyword>
    <keyword>BACKUP - DIFFERENTIAL</keyword>
    <keyword>BACKUP - INFERENTIAL</keyword>
  </CyBOK>

  <video>
    <title>Contingency Planning</title>
    <by>Z. Cliffe Schreuders</by>
    <url>https://youtu.be/lak1Sued4GY</url>
    <type>lecture-prerecorded</type>
    <CyBOK KA="OSV" topic="Human Factors: Incident Management">
      <keyword>prepare: incident management planning</keyword>
      <keyword>BUSINESS CONTINUITY PLAN - AND INCIDENT RESPONSE</keyword>
    </CyBOK>
  </video>
  <video>
    <title>Backup Planning</title>
    <by>Z. Cliffe Schreuders</by>
    <url>https://youtu.be/stVomGROfbQ</url>
    <type>lecture-prerecorded</type>
    <CyBOK KA="SOIM" topic="Execute: Mitigation and Countermeasures">
      <keyword>Recover data and services after an incident</keyword>
    </CyBOK>
    <CyBOK KA="OSV" topic="Human Factors: Incident Management">
      <keyword>prepare: incident management planning</keyword>
      <keyword>BUSINESS CONTINUITY PLAN - AND INCIDENT RESPONSE</keyword>
    </CyBOK>
  </video>
  <video>
    <title>Backup Levels: Differential and Incremental Backups Using Rsync</title>
    <by>Z. Cliffe Schreuders</by>
    <url>https://youtu.be/n8IKEJUOISY</url>
    <type>lecture-prerecorded</type>
    <CyBOK KA="SOIM" topic="Execute: Mitigation and Countermeasures">
      <keyword>Recover data and services after an incident</keyword>
      <keyword>BACKUP - DIFFERENTIAL</keyword>
      <keyword>BACKUP - INFERENTIAL</keyword>
    </CyBOK>
    <CyBOK KA="OSV" topic="Human Factors: Incident Management">
      <keyword>prepare: incident management planning</keyword>
    </CyBOK>
  </video>

  <system>
    <system_name>desktop</system_name>
    <base distro="Debian 12" type="desktop" name="KDE"/>

    <input into_datastore="IP_addresses">
      <value>172.16.0.2</value>
      <value>172.16.0.3</value>
      <value>172.16.0.4</value>
    </input>

    <!--generate two accounts, YOU and someone else-->
    <input into_datastore="accounts">
      <generator type="account">
        <input into="username">
          <generator type="random_sanitised_word">
            <input into="wordlist">
              <value>mythical_creatures</value>
            </input>
          </generator>
        </input>
        <input into="password">
          <value>tiaspbiqe2r</value>
        </input>
        <input into="super_user">
          <value>true</value>
        </input>
        <input into="leaked_filenames">
          <value></value>
        </input>
        <input into="strings_to_leak">
          <value></value>
        </input>
      </generator>
      <generator type="account">
        <input into="username">
          <generator type="random_sanitised_word">
            <input into="wordlist">
              <value>mythical_creatures</value>
            </input>
          </generator>
        </input>
        <input into="password">
          <value>test</value>
        </input>
        <input into="super_user">
          <value>false</value>
        </input>
        <input into="leaked_filenames">
          <value>trade_secrets/code.pl</value>
          <value>trade_secrets/credit_card</value>
          <value>personal_secrets/credit_card</value>
          <value>logs/log1</value>
          <value>personal_secrets/address_book</value>
        </input>
        <input into="strings_to_leak">
          <value>no warnings; `$=`;$_=\%!;($_)=/(.)/;$==++$|;($.,$/,$,,$\,$",$;,$^,$#,$~,$*,$:,@%)=(
            $!=~/(.)(.).(.)(.)(.)(.)..(.)(.)(.)..(.)......(.)/,$"),$=++;$.++;$.++;
            $_++;$_++;($_,$\,$,)=($~.$"."$;$/$%[$?]$_$\$,$:$%[$?]",$"&amp;$~,$#,);$,++
            ;$,++;$^|=$";`$_$\$,$/$:$;$~$*$%[$?]$.$~$*${#}$%[$?]$;$\$"$^$~$*.>&amp;$=`</value>
          <value>Visa  4111 1111 1111 1111
            American Express  3400 0000 0000 009
            Diner's Club  3000 0000 0000 04</value>
          <value>MasterCard  5500 0000 0000 0004</value>
          <value>[80380.876359] usb 3-1: USB disconnect, device number 3
            [80382.626853] usb 3-1: new full-speed USB device number 4 using xhci_hcd
            [80382.755813] usb 3-1: New USB device found, idVendor=096e, idProduct=0858
            [80382.755819] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0
            [80382.755822] usb 3-1: Product: U2F CCID KBOARD
            [80382.755825] usb 3-1: Manufacturer: FT
            [80382.757386] hid-generic 0003:096E:0858.0004: hiddev0,hidraw0: USB HID v1.00 Device [FT U2F CCID KBOARD] on usb-0000:00:14.0-1/input0
            [80383.925811] usb 3-1: USB disconnect, device number 4
          </value>
          <generator type="person" />
        </input>
      </generator>
      <generator type="account">
        <input into="username">
          <generator type="random_sanitised_word">
            <input into="wordlist">
              <value>mythical_creatures</value>
            </input>
          </generator>
        </input>
        <input into="password">
          <value>test</value>
        </input>
        <input into="super_user">
          <value>false</value>
        </input>
        <input into="leaked_filenames">
          <value></value>
        </input>
        <input into="strings_to_leak">
          <value></value>
        </input>
      </generator>
    </input>

    <!-- an admin account used for hackerbot access to the desktop and also spoilers/administration of the challenge -->
    <input into_datastore="spoiler_admin_pass">
      <generator type="strong_password_generator"/>
    </input>

    <!--Create the users-->
    <utility module_path=".*/parameterised_accounts">
      <input into="accounts">
        <datastore>accounts</datastore>
      </input>
    </utility>

    <utility module_path=".*/kde_minimal">
      <input into="autologin_user">
        <datastore access="0" access_json="['username']">accounts</datastore>
      </input>
      <input into="accounts">
        <datastore>accounts</datastore>
      </input>
      <input into="autostart_konsole">
        <value>true</value>
      </input>
    </utility>
    <utility module_path=".*/handy_cli_tools"/>
    <utility module_path=".*/hash_tools"/>

    <utility module_path=".*/iceweasel">
      <input into="accounts">
        <datastore>accounts</datastore>
      </input>
      <input into="autostart">
        <value>true</value>
      </input>
      <input into="start_page">
        <datastore access="2">IP_addresses</datastore>
      </input>
    </utility>

    <utility module_path=".*/pidgin">
      <input into="server_ip">
        <datastore access="2">IP_addresses</datastore>
      </input>
      <input into="accounts">
        <datastore access="0">accounts</datastore>
      </input>
    </utility>

    <vulnerability module_path=".*/ssh_root_login">
      <input into="root_password">
        <datastore>spoiler_admin_pass</datastore>
      </input>
    </vulnerability>

    <network type="private_network" >
      <input into="IP_address">
        <datastore access="0">IP_addresses</datastore>
      </input>
    </network>

    <build type="cleanup">
      <input into="root_password">
        <datastore>spoiler_admin_pass</datastore>
      </input>
    </build>
  </system>

  <system>
    <system_name>backup_server</system_name>
    <base distro="Debian 10" type="desktop" name="KDE"/>

    <utility module_path=".*/parameterised_accounts">
      <input into="accounts">
        <datastore>accounts</datastore>
      </input>
    </utility>

    <vulnerability module_path=".*/ssh_root_login">
      <input into="root_password">
        <datastore>spoiler_admin_pass</datastore>
      </input>
    </vulnerability>

    <network type="private_network" >
      <input into="IP_address">
        <datastore access="1">IP_addresses</datastore>
      </input>
    </network>

    <!-- an admin account only for spoilers/administration of the challenge -->
    <build type="cleanup">
      <input into="root_password">
        <datastore>spoiler_admin_pass</datastore>
      </input>
    </build>
  </system>

  <system>
    <system_name>hackerbot_server</system_name>
    <base distro="Kali" name="MSF"/>

    <service type="ircd"/>

    <utility module_path=".*/metasploit_framework"/>
    <utility module_path=".*/nmap"/>
    <utility module_path=".*/handy_cli_tools"/>

    <service type="httpd"/>

    <utility module_path=".*/hackerbot">
      <input into="hackerbot_configs" into_datastore="hackerbot_instructions">
        <generator module_path=".*/backups">
          <input into="accounts">
            <datastore>accounts</datastore>
          </input>
          <input into="root_password">
            <datastore>spoiler_admin_pass</datastore>
          </input>
          <input into="server_ip">
            <datastore access="1">IP_addresses</datastore>
          </input>
        </generator>
      </input>
    </utility>

    <network type="private_network" >
      <input into="IP_address">
        <datastore access="2">IP_addresses</datastore>
      </input>
    </network>

    <!-- an admin account only for spoilers/administration of the challenge -->
    <build type="cleanup">
      <input into="root_password">
        <datastore>spoiler_admin_pass</datastore>
      </input>
    </build>

  </system>

</scenario>