3_bug_hunting_and_fuzzing.xml

<?xml version="1.0"?>

<scenario xmlns="http://www.github/cliffe/SecGen/scenario"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.github/cliffe/SecGen/scenario">

  <name>Bug Hunting and Fuzzing</name>
  <author>Z. Cliffe Schreuders</author>
  <description>
    # Introduction
    Identifying and fixing software vulnerabilities is of paramount importance. This lab introduces two techniques for bug hunting: Fuzzing and Static Analysis. These methods are essential for uncovering hidden security flaws in software, which can be exploited for malicious purposes if left unaddressed. Fuzzing involves sending unexpected and often malformed data as input to a program, searching for weaknesses, while Static Analysis employs automated tools to analyze the code structure for potential issues. This lab provides a hands-on experience in finding and exploiting vulnerabilities.

    In this lab, you will learn how to manually audit C code to spot errors and use various fuzzing techniques to test network programs for security flaws. You will start by auditing and securing C code, identifying vulnerabilities, and fixing potential issues. You will then explore the world of fuzzing, where you will learn to use tools like Spike to send various inputs to network services to uncover potential vulnerabilities. The lab also guides you through Metasploit's FTP fuzzing module. Finally, you will apply your knowledge to CTF challenges, running and fuzzing network services to crash programs and uncover flags. By the end of this lab, you will have gained practical skills and knowledge in software security testing and vulnerability detection.
  </description>
  <lab_sheet_url>https://docs.google.com/document/d/1yuDcFkI2-KD4Xfti4PahE038o-6324LKSx075ZSsuKw/edit?usp=sharing</lab_sheet_url>

  <type>ctf-lab</type>
  <type>lab-sheet</type>
  <difficulty>advanced</difficulty>

  <CyBOK KA="SS" topic="Detection of Vulnerabilities">
    <keyword>dynamic detection</keyword>
  </CyBOK>

  <video>
    <title>Fuzzing Part 1</title>
    <by>Z. Cliffe Schreuders</by>
    <url>https://youtu.be/nwxtlR31hvw</url>
    <type>lecture-prerecorded</type>
    <CyBOK KA="SS" topic="Detection of Vulnerabilities">
      <keyword>dynamic detection</keyword>
    </CyBOK>
  </video>
  <video>
    <title>Fuzzing Part 2</title>
    <by>Z. Cliffe Schreuders</by>
    <url>https://youtu.be/vT2PP7VnSNw</url>
    <type>lecture-prerecorded</type>
    <CyBOK KA="SS" topic="Detection of Vulnerabilities">
      <keyword>dynamic detection</keyword>
    </CyBOK>
  </video>

  <system>
    <system_name>windows_victim</system_name>
    <base platform="windows" distro="7"/>

    <input into_datastore="IP_addresses">
      <!-- 0 windows desktop -->
      <value>172.16.0.2</value>
      <!-- 1 linux server -->
      <value>172.16.0.3</value>
      <!-- 1 kali -->
      <value>172.16.0.4</value>
    </input>

    <input into_datastore="account_name">
      <generator type="random_sanitised_word">
        <input into="wordlist">
          <value>mythical_creatures</value>
        </input>
      </generator>
    </input>

    <utility module_path=".*/parameterised_accounts" platform="windows">
      <!-- store the account info -->
      <input into="accounts" into_datastore="accounts">
        <generator type="account">
          <input into="username">
            <datastore>account_name</datastore>
          </input>
          <input into="password">
            <value>tiaspbiqe2r</value>
          </input>
          <input into="super_user">
            <value>true</value>
          </input>
          <input into="strings_to_leak">
          </input>
          <input into="leaked_filenames">
          </input>
        </generator>
      </input>
    </utility>

    <!-- vulnerable ftp server -->
    <vulnerability module_path=".*/freefloatftp_user"/>
    <vulnerability module_path=".*/easyftp_rce"/>

    <utility module_path=".*/ollydbg"/>
    <!-- <utility module_path=".*/x64dbg"/> -->

    <network type="private_network">
      <input into="IP_address">
        <datastore access="0">IP_addresses</datastore>
      </input>
    </network>
    <input into_datastore="spoiler_admin_pass">
      <generator type="strong_password_generator"/>
    </input>
    <build type="cleanup">
      <input into="root_password">
        <datastore>spoiler_admin_pass</datastore>
      </input>
    </build>
  </system>

  <system>
    <system_name>kali</system_name>
    <base distro="Kali" name="MSF"/>

    <utility module_path=".*/parameterised_accounts">
      <input into="accounts">
        <value>{"username":"kali","password":"kali","super_user":"true","strings_to_leak":[],"leaked_filenames":[]}</value>
      </input>
    </utility>

    <utility module_path=".*/metasploit_framework"/>
    <utility module_path=".*/armitage"/>
    <utility module_path=".*/exploitdb"/>
    <utility module_path=".*/handy_cli_tools"/>
    <utility module_path=".*/nmap"/>
    <utility module_path=".*/kali_fuzzing"/>
    <utility module_path=".*/wireshark"/>


    <network type="private_network" >
      <input into="IP_address">
        <datastore access="1">IP_addresses</datastore>
      </input>
    </network>
    <build type="cleanup">
      <input into="root_password">
        <datastore>spoiler_admin_pass</datastore>
      </input>
    </build>
  </system>


  <system>
    <system_name>desktop</system_name>
    <base distro="Debian 12" type="desktop" name="KDE"/>

    <utility module_path=".*/reversing_tools"/>

    <utility module_path=".*/parameterised_accounts">
      <!-- same username but without superuser -->
      <input into="accounts">
        <generator type="account">
          <input into="username">
            <datastore>account_name</datastore>
          </input>
          <input into="password">
            <value>tiaspbiqe2r</value>
          </input>
          <input into="super_user">
            <value>false</value>
          </input>
          <input into="strings_to_leak">
          </input>
          <input into="leaked_filenames">
          </input>
        </generator>
      </input>
    </utility>


    <utility module_path=".*/kde_minimal">
      <input into="autologin_user">
        <datastore>account_name</datastore>
      </input>
      <input into="accounts">
        <datastore>accounts</datastore>
      </input>
      <input into="autostart_konsole">
        <value>true</value>
      </input>
    </utility>
    <utility module_path=".*/handy_cli_tools"/>
    <utility module_path=".*/wireshark"/>

    <utility module_path=".*/metactf">
      <input into="challenge_list">
        <generator type="metactf_challenge">
          <input into="challenge_path">
            <value>src_sse/SSE/Ch_Fuzz_1</value>
          </input>
        </generator>
        <generator type="metactf_challenge">
          <input into="challenge_path">
            <value>src_sse/SSE/Ch_Fuzz_2</value>
          </input>
        </generator>
      </input>
      <input into="account">
        <datastore>accounts</datastore>
      </input>
    </utility>

    <network type="private_network">
      <input into="IP_address">
        <datastore access="2">IP_addresses</datastore>
      </input>
    </network>
    <build type="cleanup">
      <input into="root_password">
        <datastore>spoiler_admin_pass</datastore>
      </input>
    </build>
  </system>

</scenario>