4_exploit_development.xml

<?xml version="1.0"?>

<scenario xmlns="http://www.github/cliffe/SecGen/scenario"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.github/cliffe/SecGen/scenario">

  <name>Exploit Development</name>
  <author>Z. Cliffe Schreuders</author>
  <description>
    # Introduction
    Exploit development involves identifying and exploiting vulnerabilities in software or systems, potentially granting unauthorized access. In this hands-on lab, you will delve into the advanced topic of exploit development, focusing on Windows stack-smashing buffer overflows, a common type of vulnerability.

    Throughout this lab, you will work on a Kali Linux system as the attacker and a Windows VM as the victim/debugger, targeting a vulnerable FTP server. The lab guides you through several crucial steps, including manual exploitation, writing your first Metasploit (MSF) exploit module, finding the offset within the input that overwrites the EIP (Extended Instruction Pointer), adding shellcode to control the target system, and ultimately gaining remote access to the compromised system. By the end of this lab, you will have not only gained theoretical knowledge of exploit development but also practical experience in crafting and launching your own exploits against real-world vulnerabilities.
  </description>
  <lab_sheet_url>https://docs.google.com/document/d/1tsKUaCetdqwDmey4JK9DYrcO9XDx4EwE2RIvSbP6zQQ/edit?usp=sharing</lab_sheet_url>

  <type>ctf-lab</type>
  <type>lab-sheet</type>
  <difficulty>advanced</difficulty>

  <CyBOK KA="SS" topic="Categories of Vulnerabilities">
    <keyword>memory management vulnerabilities</keyword>
    <keyword>Stack smashing buffer overflows</keyword>
  </CyBOK>
  <CyBOK KA="MAT" topic="Attacks and exploitation">
    <keyword>EXPLOITATION</keyword>
    <keyword>EXPLOITATION FRAMEWORKS</keyword>
    <keyword>Exploit development</keyword>
    <keyword>Metasploit Framework development</keyword>
  </CyBOK>

  <video>
    <title>Overflows and Stack Smashing Buffer Overflows</title>
    <by>Z. Cliffe Schreuders</by>
    <url>https://youtu.be/Zh7IdmnCfy0</url>
    <type>lecture-prerecorded</type>
    <CyBOK KA="SS" topic="Categories of Vulnerabilities">
      <keyword>memory management vulnerabilities</keyword>
    </CyBOK>
  </video>
  <video>
    <title>Writing Exploits (Buffer Overflows Part 2)</title>
    <by>Z. Cliffe Schreuders</by>
    <url>https://youtu.be/WU06L-u0t2Q</url>
    <type>lecture-prerecorded</type>
    <CyBOK KA="SS" topic="Categories of Vulnerabilities">
      <keyword>memory management vulnerabilities</keyword>
    </CyBOK>
  </video>
  <video>
    <title>Memory Vulnerabilities</title>
    <by>Tom Shaw</by>
    <url>https://youtu.be/j2S-XgY-Fyg</url>
    <type>lecture-prerecorded</type>
    <CyBOK KA="SS" topic="Categories of Vulnerabilities">
      <keyword>memory management vulnerabilities</keyword>
    </CyBOK>
  </video>
  <video>
    <title>The Stack (part 1)</title>
    <by>Tom Shaw</by>
    <url>https://youtu.be/Lf1UPaqPJMM</url>
    <type>lecture-prerecorded</type>
    <CyBOK KA="SS" topic="Technical Underpinning">
      <keyword>Technical underpinnings for memory management vulnerabilities: the stack</keyword>
    </CyBOK>
  </video>
  <video>
    <title>The Stack (part 2)</title>
    <by>Tom Shaw</by>
    <url>https://youtu.be/5OUQ7ExlgKI</url>
    <type>demo-prerecorded</type>
    <CyBOK KA="SS" topic="Technical Underpinning">
      <keyword>Technical underpinnings for memory management vulnerabilities: the stack</keyword>
    </CyBOK>
  </video>

  <system>
    <system_name>windows_victim</system_name>
    <base platform="windows" distro="7"/>

    <input into_datastore="IP_addresses">
      <!-- 0 windows desktop -->
      <value>172.16.0.2</value>
      <!-- 1 kali -->
      <value>172.16.0.3</value>
      <!-- 2 windows_victim_server -->
      <value>172.16.0.4</value>
      <!-- 3 desktop -->
      <value>172.16.0.5</value>
    </input>

    <utility module_path=".*/parameterised_accounts" platform="windows">
      <input into="accounts" into_datastore="accounts">
        <generator type="account">
          <input into="username">
            <generator type="random_sanitised_word">
              <input into="wordlist">
                <value>mythical_creatures</value>
              </input>
            </generator>
          </input>
          <input into="password">
            <value>tiaspbiqe2r</value>
          </input>
          <input into="super_user">
            <value>true</value>
          </input>
          <input into="strings_to_leak">
            <generator type="flag_generator" />
          </input>
          <input into="leaked_filenames">
            <value>flag.txt</value>
          </input>
        </generator>
      </input>
    </utility>

    <!-- vulnerable ftp server -->
    <vulnerability module_path=".*/freefloatftp_user"/>

    <utility module_path=".*/ollydbg"/>
    <!-- <utility module_path=".*/x64dbg"/> -->
    <utility module_path=".*/emet"/>
    <utility module_path=".*/disable_aslr"/>

    <network type="private_network">
      <input into="IP_address">
        <datastore access="0">IP_addresses</datastore>
      </input>
    </network>
    <input into_datastore="spoiler_admin_pass">
      <generator type="strong_password_generator"/>
    </input>
    <build type="cleanup">
      <input into="root_password">
        <datastore>spoiler_admin_pass</datastore>
      </input>
    </build>
  </system>

  <system>
    <system_name>kali</system_name>
    <base distro="Kali" name="MSF"/>

    <utility module_path=".*/parameterised_accounts">
      <input into="accounts">
        <value>{"username":"kali","password":"kali","super_user":"true","strings_to_leak":[],"leaked_filenames":[]}</value>
      </input>
    </utility>

    <utility module_path=".*/metasploit_framework"/>
    <utility module_path=".*/armitage"/>
    <utility module_path=".*/exploitdb"/>
    <utility module_path=".*/handy_cli_tools"/>
    <utility module_path=".*/nmap"/>

    <network type="private_network" >
      <input into="IP_address">
        <datastore access="1">IP_addresses</datastore>
      </input>
    </network>
    <build type="cleanup">
      <input into="root_password">
        <datastore>spoiler_admin_pass</datastore>
      </input>
    </build>
  </system>

  <system>
    <system_name>windows_victim_server</system_name>
    <base platform="windows" distro="7"/>

    <utility module_path=".*/parameterised_accounts" platform="windows">
      <input into="accounts">
        <generator type="account">
          <input into="username">
            <generator type="random_sanitised_word">
              <input into="wordlist">
                <value>mythical_creatures</value>
              </input>
            </generator>
          </input>
          <input into="password">
            <value>tiaspbiqe2r</value>
          </input>
          <input into="super_user">
            <value>true</value>
          </input>
          <input into="strings_to_leak">
            <generator type="flag_generator" />
          </input>
          <input into="leaked_filenames">
            <value>flag.txt</value>
          </input>
        </generator>
      </input>
    </utility>

    <!-- vulnerable ftp server -->
    <vulnerability module_path=".*/freefloatftp_user"/>
    <utility module_path=".*/emet"/>
    <utility module_path=".*/disable_aslr" platform="windows"/>

    <network type="private_network">
      <input into="IP_address">
        <datastore access="2">IP_addresses</datastore>
      </input>
    </network>
    <build type="cleanup">
      <input into="root_password">
        <datastore>spoiler_admin_pass</datastore>
      </input>
    </build>
  </system>

</scenario>