11_coconut.xml

<?xml version="1.0"?>

<scenario xmlns="http://www.github/cliffe/SecGen/scenario"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          xsi:schemaLocation="http://www.github/cliffe/SecGen/scenario">

  <name>Malware Behaviour: Live Sample Analysis</name>
  <author>Tom Shaw</author>
  <author>Mo Hassan</author>
  <description>A Hackerbot lab involving the analysis of a live malware sample.</description>

  <type>hackerbot-lab</type>
  <type>ctf-lab</type>
  <type>lab-sheet</type>
  <difficulty>intermediate</difficulty>

  <CyBOK KA="MAT" topic="Malware Taxonomy">
    <keyword>dimensions</keyword>
    <keyword>kinds</keyword>
  </CyBOK>
  <CyBOK KA="MAT" topic="Malware Analysis">
    <keyword>analysis techniques</keyword>
    <keyword>analysis environments</keyword>
  </CyBOK>

  <system>
    <system_name>desktop</system_name>
    <base distro="Debian 12" type="desktop" name="KDE"/>

    <input into_datastore="IP_addresses">
      <value>172.16.0.2</value>
      <value>172.16.0.3</value>
      <value>172.16.0.4</value>
    </input>

    <input into_datastore="spoiler_admin_pass">
      <generator type="strong_password_generator"/>
    </input>

    <utility module_path=".*/reversing_tools"/>
    <utility module_path=".*/ghidra"/>

    <utility module_path=".*/parameterised_accounts">
      <input into="accounts" into_datastore="account">
        <generator type="account">
          <input into="username">
            <generator type="random_sanitised_word">
              <input into="wordlist">
                <value>mythical_creatures</value>
              </input>
            </generator>
          </input>
          <input into="password">
            <value>tiaspbiqe2r</value>
          </input>
          <input into="super_user">
            <value>true</value>
          </input>
        </generator>
      </input>
    </utility>

    <utility module_path=".*/kde_minimal">
      <input into="autologin_user">
        <datastore access="0" access_json="['username']">account</datastore>
      </input>
      <input into="accounts">
        <datastore>account</datastore>
      </input>
      <input into="autostart_konsole">
        <value>true</value>
      </input>
    </utility>
    <utility module_path=".*/handy_cli_tools"/>
    <utility module_path=".*/hash_tools"/>

    <utility module_path=".*/coconut">
      <input into="account">
        <datastore>account</datastore>
      </input>
      <input into="run_sample">
        <value>false</value>
      </input>
      <input into="coconut_config" into_datastore="coconut_config">
        <generator type="coconut_config"/>
      </input>
    </utility>

    <utility module_path=".*/handy_cli_tools"/>
    <utility module_path=".*/nmap"/>

    <utility module_path=".*/iceweasel">
      <input into="accounts">
        <datastore>account</datastore>
      </input>
      <input into="autostart">
        <value>true</value>
      </input>
      <input into="start_page">
        <datastore access="1">IP_addresses</datastore>
      </input>
    </utility>

    <utility module_path=".*/pidgin">
      <input into="server_ip">
        <datastore access="1">IP_addresses</datastore>
      </input>
      <input into="accounts">
        <datastore access="0">account</datastore>
      </input>
    </utility>

    <vulnerability module_path=".*/ssh_root_login">
      <input into="root_password">
        <datastore>spoiler_admin_pass</datastore>
      </input>
    </vulnerability>

    <network type="private_network">
      <input into="IP_address">
        <datastore access="0">IP_addresses</datastore>
      </input>
    </network>

    <build type="cleanup">
      <input into="root_password">
        <datastore>spoiler_admin_pass</datastore>
      </input>
    </build>
  </system>

  <system>
    <system_name>hb_server</system_name>
    <base distro="Kali" name="MSF"/>

    <service type="ircd"/>
    <utility module_path=".*/nmap"/>
    <utility module_path=".*/handy_cli_tools"/>
    <service type="httpd"/>

    <utility module_path=".*/hackerbot">
      <input into="hackerbot_configs">
        <generator module_path=".*/rema_coconut">
          <input into="accounts">
            <datastore>account</datastore>
          </input>
          <input into="root_password">
            <datastore>spoiler_admin_pass</datastore>
          </input>
          <input into="desktop_ip">
            <datastore access="0">IP_addresses</datastore>
          </input>
          <input into="hackerbot_server_ip">
            <datastore access="1">IP_addresses</datastore>
          </input>
          <input into="victim_server_ip">
            <datastore access="2">IP_addresses</datastore>
          </input>
          <input into="coconut_config">
            <datastore>coconut_config</datastore>
          </input>
        </generator>
      </input>
    </utility>

    <network type="private_network">
      <input into="IP_address">
        <datastore access="1">IP_addresses</datastore>
      </input>
    </network>

    <build type="cleanup">
      <input into="root_password">
        <datastore>spoiler_admin_pass</datastore>
      </input>
    </build>
  </system>

  <system>
    <system_name>victim_server</system_name>
    <base platform="linux" type="desktop" distro="Buster"/>

    <utility module_path=".*/parameterised_accounts">
      <input into="accounts" into_datastore="infected_account">
        <generator type="account">
          <input into="username">
            <value>infected</value>
          </input>
          <input into="password">
            <generator type="strong_password_generator"/>
          </input>
          <input into="super_user">
            <value>false</value>
          </input>
          <input into="leaked_filenames">
            <value>top_secret_file</value>
            <value>flag</value>
          </input>
          <input into="strings_to_leak">
            <value>Visa  4111 1111 1111 1111
American Express  3400 0000 0000 009
Diner's Club  3000 0000 0000 04</value>
            <generator type="flag_generator"/>
          </input>
        </generator>
      </input>
    </utility>

    <utility module_path=".*/coconut">
      <input into="account">
        <datastore>infected_account</datastore>
      </input>
      <input into="run_sample">
        <value>true</value>
      </input>
      <input into="coconut_config">
        <datastore>coconut_config</datastore>
      </input>
    </utility>

    <network type="private_network">
      <input into="IP_address">
        <datastore access="2">IP_addresses</datastore>
      </input>
    </network>

    <build type="cleanup">
      <input into="root_password">
        <datastore>spoiler_admin_pass</datastore>
      </input>
    </build>
  </system>
</scenario>