4_access_controls.xml

<?xml version="1.0"?>

<scenario xmlns="http://www.github/cliffe/SecGen/scenario"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.github/cliffe/SecGen/scenario">

  <name>Access Controls lab</name>
  <author>Z. Cliffe Schreuders</author>
  <description>
    # Introduction
    Access control involves authorizing and mediating access to resources, determining what actions are permitted, and enforcing security policies. In this lab, you will delve into access control and Unix file permissions, gaining a practical understanding of how they work and their significance in maintaining system security. The lab will introduce you to subjects and objects in the context of access control, different access control models, and Unix file permissions.

    Throughout this lab, you will learn how to view and manipulate file permissions in a Unix-like operating system. You will explore the concept of inodes, examine file permissions using the ls command, create and manage hard and symbolic links to files, and understand how directory-level permissions affect file access. Additionally, you will work with the chmod command to change file permissions and discover the significance of the umask command in setting default permissions for new files. By the end of this lab, you will have an understanding of access control, file permissions, and practical skills in managing access rights on a Linux system.

    # Hackerbot and CTF challenges
    This is a Hackerbot lab. The labsheet is available once you claim a set of VMs. Work through the labsheet, then when prompted interact with Hackerbot.

    The Hackerbot tasks are designed to provide hands-on experience in managing user access, group permissions, and file ownership, and will enhance your understanding of access control mechanisms. You will create files with specific permissions, ownership, and group assignments while ensuring that other users are appropriately restricted from accessing these files.

    # Lecture
    [Slides here](http://z.cliffe.schreuders.org/presentations/slides/1718/ADS_slides_out_week_7/ADS_PDS_Lectures_7_Access_Control.html)

    # Reading
    [Chapter 1 "Foundations of Security and Access Control in Computing": Benantar, M. (2006), Access Control Systems: Security, Identity Management and Trust Models, Springer. (ISBN-10: 0387004459)](https://www-dawsonera-com.ezproxy.leedsbeckett.ac.uk/readonline/9780387277165)
  </description>

  <type>ctf-lab</type>
  <type>hackerbot-lab</type>
  <type>lab-sheet</type>
  <difficulty>intermediate</difficulty>

  <CyBOK KA="AAA" topic="Authorisation">
    <keyword>access control</keyword>
    <keyword>enforcing access control</keyword>
    <keyword>ACCESS CONTROL - DAC (DISCRETIONARY ACCESS CONTROL)</keyword>
    <keyword>Vulnerabilities and attacks on access control misconfigurations</keyword>
  </CyBOK>
  <CyBOK KA="OSV" topic="Primitives for Isolation and Mediation">
    <keyword>Access controls and operating systems</keyword>
    <keyword>Linux security model</keyword>
    <keyword>Unix File Permissions</keyword>
    <keyword>Filesystems, inodes, and commands</keyword>
    <keyword>umask</keyword>
  </CyBOK>
  <CyBOK KA="OSV" topic="Role of Operating Systems">
    <keyword>mediation</keyword>
  </CyBOK>

  <video>
    <title>Access Controls: Introduction</title>
    <by>Z. Cliffe Schreuders</by>
    <url>https://youtu.be/yWJyZEFbchQ</url>
    <type>lecture-prerecorded</type>
    <CyBOK KA="AAA" topic="Authorisation">
      <keyword>access control</keyword>
      <keyword>enforcing access control</keyword>
      <keyword>theory</keyword>
    </CyBOK>
    <CyBOK KA="OSV" topic="Primitives for Isolation and Mediation">
      <keyword>Access controls and operating systems</keyword>
    </CyBOK>
    <CyBOK KA="OSV" topic="Role of Operating Systems">
      <keyword>mediation</keyword>
      <keyword>TRUSTED COMPUTING BASE (TCB)</keyword>
      <keyword>REFERENCE MONITOR</keyword>
    </CyBOK>
  </video>
  <video>
    <title>Unix File Permissions</title>
    <by>Z. Cliffe Schreuders</by>
    <url>https://youtu.be/i0kO_3ExJv4</url>
    <type>lecture-prerecorded</type>
    <CyBOK KA="AAA" topic="Authorisation">
      <keyword>access control</keyword>
      <keyword>enforcing access control</keyword>
      <keyword>ACCESS CONTROL - DAC (DISCRETIONARY ACCESS CONTROL)</keyword>
    </CyBOK>
    <CyBOK KA="OSV" topic="Primitives for Isolation and Mediation">
      <keyword>Access controls and operating systems</keyword>
      <keyword>Linux security model</keyword>
      <keyword>Unix File Permissions</keyword>
      <keyword>filesystems, inodes, and commands</keyword>
    </CyBOK>
    <CyBOK KA="OSV" topic="Role of Operating Systems">
      <keyword>mediation</keyword>
    </CyBOK>
  </video>

  <system>
    <system_name>shared_desktop</system_name>
    <base distro="Debian 12" type="desktop" name="KDE"/>

    <input into_datastore="IP_addresses">
      <!-- 0 desktop -->
      <value>172.16.0.2</value>
      <!-- 1 server -->
      <value>172.16.0.3</value>
      <!-- 2 hackerbot_server -->
      <value>172.16.0.4</value>
    </input>

    <!-- generate some usernames to use -->
    <input into_datastore="usernames">
      <!-- main user -->
      <generator type="random_sanitised_word">
        <input into="wordlist">
          <value>mythical_creatures</value>
        </input>
      </generator>
      <!-- 4 other users -->
      <generator type="random_sanitised_word">
        <input into="wordlist">
          <value>mythical_creatures</value>
        </input>
      </generator>
      <generator type="random_sanitised_word">
        <input into="wordlist">
          <value>mythical_creatures</value>
        </input>
      </generator>
      <generator type="random_sanitised_word">
        <input into="wordlist">
          <value>mythical_creatures</value>
        </input>
      </generator>
      <generator type="random_sanitised_word">
        <input into="wordlist">
          <value>mythical_creatures</value>
        </input>
      </generator>
    </input>

    <!-- generate some passwords to be cracked -->
    <input into_datastore="passwords">
      <generator type="medium_password_generator"/>
      <generator type="strong_password_generator"/>
      <generator type="strong_password_generator"/>
      <generator type="strong_password_generator"/>
    </input>

    <input into_datastore="groups">
      <value>staff</value>
      <value>team_one</value>
      <value>team_two</value>
    </input>


    <!-- accounts on the desktop, with the main user as a sudoer, with no flags -->
    <input into_datastore="user_accounts_desktop">
      <!-- main user, sudoer -->
      <generator type="account">
        <input into="username">
          <datastore access="0">usernames</datastore>
        </input>
        <input into="password">
          <value>tiaspbiqe2r</value>
        </input>
        <input into="super_user">
          <value>true</value>
        </input>
      </generator>
      <!-- other users, with weak passwords, no flags -->
      <generator type="account">
        <input into="username">
          <datastore access="next">usernames</datastore>
        </input>
        <input into="password">
          <datastore access="0">passwords</datastore>
        </input>
      </generator>
      <generator type="account">
        <input into="username">
          <datastore access="next">usernames</datastore>
        </input>
        <input into="password">
          <datastore access="next">passwords</datastore>
        </input>
      </generator>
      <generator type="account">
        <input into="username">
          <datastore access="next">usernames</datastore>
        </input>
        <input into="password">
          <datastore access="next">passwords</datastore>
        </input>
      </generator>
      <generator type="account">
        <input into="username">
          <datastore access="next">usernames</datastore>
        </input>
        <input into="password">
          <datastore access="next">passwords</datastore>
        </input>
      </generator>
    </input>

    <!-- an admin account used for hackerbot access to the desktop and also spoilers/administration of the challenge -->
    <input into_datastore="spoiler_admin_pass">
      <generator type="strong_password_generator"/>
    </input>

    <!--Create the groups-->
    <utility module_path=".*/groups">
      <input into="groups">
        <datastore>groups</datastore>
      </input>
    </utility>
    <!--Create the users-->
    <utility module_path=".*/parameterised_accounts">
      <input into="accounts">
        <datastore>user_accounts_desktop</datastore>
      </input>
    </utility>

    <utility module_path=".*/kde_minimal">
      <input into="autologin_user">
        <datastore access="0">usernames</datastore>
      </input>
      <input into="accounts">
        <datastore>user_accounts_desktop</datastore>
      </input>
      <input into="autostart_konsole">
        <value>true</value>
      </input>
    </utility>
    <utility module_path=".*/handy_cli_tools"/>
    <utility module_path=".*/hash_tools"/>
    <utility module_path=".*/pam_modules"/>

    <utility module_path=".*/iceweasel">
      <input into="accounts">
        <datastore>user_accounts_desktop</datastore>
      </input>
      <input into="autostart">
        <value>true</value>
      </input>
      <input into="start_page">
        <datastore access="2">IP_addresses</datastore>
      </input>
    </utility>

    <utility module_path=".*/pidgin">
      <input into="server_ip">
        <datastore access="2">IP_addresses</datastore>
      </input>
      <input into="accounts">
        <datastore access="0">user_accounts_desktop</datastore>
      </input>
    </utility>

    <vulnerability module_path=".*/ssh_root_login">
      <input into="root_password">
        <datastore>spoiler_admin_pass</datastore>
      </input>
    </vulnerability>

    <network type="private_network">
      <input into="IP_address">
        <datastore access="0">IP_addresses</datastore>
      </input>
    </network>
    <build type="cleanup">
      <input into="root_password">
        <datastore>spoiler_admin_pass</datastore>
      </input>
    </build>
  </system>

  <system>
    <system_name>server</system_name>
    <base distro="Debian 12" type="desktop" name="KDE"/>

    <!-- user accounts on the server, with matching usernames and passwords, but with flags to find -->
    <input into_datastore="user_accounts_server">
      <!-- main user, NOT sudoer -->
      <generator type="account">
        <input into="username">
          <datastore access="0">usernames</datastore>
        </input>
        <input into="password">
          <value>tiaspbiqe2r</value>
        </input>
        <input into="super_user">
          <value>false</value>
        </input>
        <input into="groups">
          <value>staff</value>
          <value>team_one</value>
        </input>
      </generator>
      <!-- other users, with the SAME weak passwords, WITH flags -->
      <generator type="account">
        <input into="username">
          <datastore access="next">usernames</datastore>
        </input>
        <input into="password">
          <datastore access="0">passwords</datastore>
        </input>
        <input into="groups">
          <value>staff</value>
          <value>team_one</value>
          <value>team_two</value>
        </input>
      </generator>
      <generator type="account">
        <input into="username">
          <datastore access="next">usernames</datastore>
        </input>
        <input into="password">
          <datastore access="next">passwords</datastore>
        </input>
        <input into="groups">
          <value>staff</value>
          <value>team_two</value>
        </input>
      </generator>
      <generator type="account">
        <input into="username">
          <datastore access="next">usernames</datastore>
        </input>
        <input into="password">
          <datastore access="next">passwords</datastore>
        </input>
        <input into="groups">
          <value>staff</value>
        </input>
      </generator>
      <generator type="account">
        <input into="username">
          <datastore access="next">usernames</datastore>
        </input>
        <input into="password">
          <datastore access="next">passwords</datastore>
        </input>
        <input into="groups">
          <value>staff</value>
        </input>
        <input into="leaked_filenames">
          <value>flags</value>
        </input>
        <input into="strings_to_leak">
          <generator type="flag_generator" />
          <generator type="flag_generator" />
        </input>

      </generator>
    </input>

    <!--Create the groups-->
    <utility module_path=".*/groups">
      <input into="groups">
        <datastore>groups</datastore>
      </input>
    </utility>
    <!--Create the users-->
    <utility module_path=".*/parameterised_accounts">
      <input into="accounts">
        <datastore>user_accounts_server</datastore>
      </input>
    </utility>

    <utility module_path=".*/handy_cli_tools"/>

    <vulnerability module_path=".*/ssh_root_login">
      <input into="root_password">
        <datastore>spoiler_admin_pass</datastore>
      </input>
    </vulnerability>
    <build type="cleanup">
      <input into="root_password">
        <datastore>spoiler_admin_pass</datastore>
      </input>
    </build>

    <!-- This needs to come after the above to work -->
    <!-- TODO: enforce order in the module metadata somehow? -->
    <vulnerability module_path=".*/writable_passwd|.*writable_shadow"/>

    <network type="private_network">
      <input into="IP_address">
        <datastore access="1">IP_addresses</datastore>
      </input>
    </network>
  </system>

  <system>
    <system_name>hackerbot_server</system_name>
    <base distro="Kali" name="MSF"/>

    <service type="ircd"/>

    <utility module_path=".*/metasploit_framework"/>
    <utility module_path=".*/nmap"/>
    <utility module_path=".*/handy_cli_tools"/>

    <service type="httpd"/>

    <utility module_path=".*/hackerbot">
      <input into="hackerbot_configs" into_datastore="hackerbot_instructions">
        <generator module_path=".*/hb_access_controls">
          <input into="accounts">
            <datastore>user_accounts_desktop</datastore>
          </input>
          <input into="root_password">
            <datastore>spoiler_admin_pass</datastore>
          </input>
          <input into="server_ip">
            <datastore access="1">IP_addresses</datastore>
          </input>
        </generator>
      </input>
    </utility>

    <network type="private_network" >
       <input into="IP_address">
        <datastore access="2">IP_addresses</datastore>
       </input>
    </network>

    <build type="cleanup">
      <input into="root_password">
        <generator type="strong_password_generator"/>
      </input>
    </build>
    <build type="cleanup">
      <input into="root_password">
        <datastore>spoiler_admin_pass</datastore>
      </input>
    </build>
  </system>

</scenario>