BreakEscape/planning_notes/mission_vms/secgen_scenario_summaries.md

SecGen Scenario Summaries

This document provides concise summaries of SecGen lab scenarios to inform BreakEscape mission designers about what players will experience on the VMs.

1. Introduction to Linux and Security lab

desktop (Debian 12 KDE)

• Victim user with weak SSH password (brute forceable from top-20-common-SSH-passwords list), has flag in home directory
• Bystander user with flag (accessible via sudo from victim account)
• SSH root login enabled
• Main user account (random mythical creature name) with sudo access

kali

• Kali MSF with Metasploit framework, nmap, password tools

CTF Steps:

• Use Hydra to brute force SSH password for "victim" account (from common password wordlists)
• SSH into victim account, find flag in home directory
• Use sudo to access bystander's flag (victim has sudo privileges)

---

2. Malware and an Introduction to Metasploit and Payloads

windows_victim (Windows 7)

• User account with secret file (my_secret.txt) containing sensitive data

kali

• Kali MSF with Metasploit framework, Apache web server, nmap, ClamAV antivirus

CTF Steps:

• Create remote access Trojan using msfvenom (e.g., reverse shell payload)
• Host Trojan on Apache, download and execute on Windows VM
• Use remote shell to retrieve my_secret.txt from Windows desktop

---

3. Vulnerabilities, Exploits, and Remote Access Payloads

windows_victim (Windows 7)

• Vulnerable Adobe Reader (CVE-2008-2992) - client-side exploit via malicious PDF
• User account with secret file (my_secret.txt)
• Netcat installed for testing shell connections

linux_victim_server (Debian 12 KDE)

• Vulnerable distcc server (CVE-2004-2687) - remote code execution, yields flag

kali

• Kali MSF with Metasploit framework, Apache web server, nmap

CTF Steps:

• Exploit remote distcc service (CVE-2004-2687) using Metasploit (exploit/unix/misc/distcc_exec)
• Find flag in distccd user's home directory

---

5. Information Gathering: Scanning

linux_victim_server (Debian 12 KDE)

• Vulnerable distcc server (CVE-2004-2687) with flag
• Multiple netcat services with flags (one base64 encoded)
• Apache HTTP server
• FTP server

kali

• Kali MSF with Metasploit framework, nmap, amap

CTF Steps:

• Scan for open ports and services
• Banner grab from netcat services to find flags (one flag is base64 encoded, needs decoding)
• Exploit distcc vulnerability (CVE-2004-2687) to find additional flag

---

6. From Scanning to Exploitation

windows_server (Windows 7)

• Vulnerable EasyFTP server (RCE vulnerability)
• Flag in flag.txt file

linux_server (Debian 12 KDE)

• Vulnerable UnrealIRC 3281 backdoor - yields flag

kali

• Kali MSF with Metasploit framework, Armitage, ExploitDB, nmap

CTF Steps:

• Scan network to identify Windows and Linux servers
• Exploit EasyFTP server on Windows (exploit/windows/ftp/easyftp_cwd_fixret), find flag in flag.txt
• Exploit UnrealIRC 3281 backdoor on Linux server, find flag in user home directory

---

7. Post-exploitation

windows_server (Windows 7)

• Vulnerable EasyFTP server (RCE vulnerability)
• Flag in flag.txt file

linux_server (Debian 12 KDE)

• Vulnerable distcc server (CVE-2004-2687) with flag
• Vulnerable sudoedit (privilege escalation) with flag
• Crackme user account with weak password
• Password-protected ZIP file (/root/protected.zip) with flag (password same as crackme user)

kali

• Kali MSF with Metasploit framework, Armitage, ExploitDB, nmap, password tools

CTF Steps:

• Exploit distcc on Linux server (CVE-2004-2687) to gain initial shell
• Use sudoedit vulnerability (CVE-2023-22809) to escalate privileges to root
• Find flags in user home directories
• Extract password hashes, crack crackme user password
• Use cracked password to decrypt /root/protected.zip file (contains flag)
• Exploit EasyFTP on Windows server, find flag in flag.txt

---

8. Vulnerability Analysis

linux_server (Debian 12 KDE)

• Vulnerable distcc server (CVE-2004-2687) with flag
• Vulnerable WordPress 4.x installation
• Vulnerable UnrealIRC 3281 backdoor
• Vulnerable sudo Baron (privilege escalation) with flag

kali

• Kali "Licensed Tools" with Metasploit framework, ExploitDB, nmap, Nikto, GCC

CTF Steps:

• Scan with Nmap NSE, Nessus, and Nikto to identify vulnerabilities
• Exploit distcc (CVE-2004-2687) to gain initial access, find flag
• Upgrade shell to Meterpreter
• Exploit sudo Baron vulnerability (CVE-2021-3156) for privilege escalation, find flag
• Find additional flags from various vulnerabilities

---

9. Feeling Blu

attack_vm (Kali MSF)

• Kali with top 10 tools, web tools, Iceweasel browser (autostarts pointing to web server)

web_server (Debian 12 KDE)

• Bludit CMS with file upload vulnerability (image upload RCE) - yields flag
• User account (from organization data) with flag in home directory
• Vulnerable sudo root-less (privilege escalation) with flag
• Password-protected ZIP file (/root/whatsmyname.zip) with flag (password is organization manager's name)

CTF Steps:

• Scan web server with dirb and Nikto to find hidden files and admin login page
• Find leaked Bludit credentials in discovered files (or brute force with OWASP ZAP)
• Exploit Bludit file upload vulnerability (exploit/linux/http/bludit_upload_images_exec) using Metasploit
• Switch to Bludit admin user account, find flag in home directory
• Use sudo root-less vulnerability to escalate to root (exploit sudo -l to see allowed commands)
• Find flag in /root directory
• Extract organization manager's name from earlier reconnaissance, use as password to decrypt /root/whatsmyname.zip

---

Access Can Roll

shared_desktop (Debian 12 KDE)

• Main user account (random mythical creature name) with sudo access
• Source code file access_my_secrets.c in home directory
• Another user account (random mythical creature name)

server (Debian 12 KDE)

• Same usernames and passwords as desktop (password: tiaspbiqe2r)
• Two users with shell programs that can be combined
• One user has flag.txt
• Another user has access_me_flag.c, flag1, and flag2

CTF Steps:

• SSH to server using same credentials as desktop
• Combine two shell programs together to get first flag
• Use hardlink trickery with access_my_flag program to access relative paths and get flag1 and flag2

---

Analyse This

attack_vm (Kali MSF)

• Kali with top 10 tools, web tools

server (Debian 10 KDE)

• User account: analyse / password: this!!!
• File encoded_flags with multiple encoded flags
• PCAP file capture.pcap containing flag
• Hidden file with flag

CTF Steps:

• SSH into server (username: analyse, password: this!!!)
• Decode flags from encoded_flags file (various encoding methods: ASCII/alpha reversible, some double-encoded)
• Analyze capture.pcap file to extract flag from network traffic
• Find hidden file in home directory for additional flag

---

Banner Grab and Run For Your Life!

desktop (Debian 9 KDE)

• User account (random mythical creature name), password: tiaspbiqe2r
• Nmap installed

secret_journal_server (Debian 9 KDE)

• 5 netcat services on random ports (1024-50000 range)
• 3 flags in plaintext
• 2 flags encrypted (one double-encrypted with ASCII reversible)

CTF Steps:

• Scan all ports on secret_journal_server using nmap
• Connect to each discovered port using netcat to retrieve flags
• First 3 ports contain plaintext flags
• 4th port contains encrypted flag (needs decoding)
• 5th port contains double-encrypted flag (needs double decoding)

---

Containers Escape

desktop (Debian 9 KDE)

• User account (random mythical creature name), password: tiaspbiqe2r
• Docker installed with multiple images
• Netcat backdoor in Docker container

chroot_esc_server (Debian 9 KDE)

• Chroot environment at /opt/chroot
• Netcat backdoor in chroot container

CTF Steps:

• Find way into Docker container on desktop VM
• Escape Docker container to gain root access, find flag in /root/docker_flag
• Find way into chroot container on chroot_esc_server
• Escape chroot container to gain root access, find flag in /root/chroot_flag

---

Decode Me

attack_vm (Kali MSF)

• Kali with top 10 tools, web tools

decode_me (Debian 10 KDE)

• NFS share with encrypted flags file
• 8 flags total: 1 double-encrypted, 7 single-encrypted (ASCII/alpha reversible encoding)

CTF Steps:

• Use showmount to discover NFS share on decode_me server
• Mount NFS share on attack VM
• Read encrypted flags file from mounted drive
• Decode all 8 flags (7 single encryption, 1 double encryption)

---

Hackme and Crack Me

hack_and_crack_me_server (Debian 9 KDE)

• Vulnerable distcc server (CVE-2004-2687) - use nmap script, not Metasploit
• Readable /etc/shadow file (vulnerability)
• 4 user accounts with weak passwords (from jtrpassword.lst)
• 1 user account with hint: password ends in 2 digits (e.g., "round39")
• 4 leaked strings in user home directories

second_server (Debian 9 KDE)

• Same usernames as hack_and_crack_me_server
• 4 user accounts with flags (passwords match cracked passwords from first server)
• 1 user account with hint file and flag

kali_cracker (Kali MSF)

• Kali with password tools (John the Ripper), Metasploit, Armitage, nmap

CTF Steps:

• Exploit distcc vulnerability using nmap script (not Metasploit) to get flag
• Copy /etc/shadow and /etc/passwd from hack_and_crack_me_server to kali_cracker
• Use unshadow to combine passwd and shadow files
• Crack passwords using John the Ripper (john --wordlist=jtrpassword.lst)
• Find 4 leaked strings in user home directories on hack_and_crack_me_server
• SSH to second_server using cracked credentials to find 4 flags
• Crack last user password (hint: ends in 2 digits, try common words + 2-digit numbers)
• SSH to second_server with last user credentials to find final flag

---

Nosferatu

attack_vm (Kali MSF)

• Kali with top 10 tools, web tools

server (Debian 10 KDE)

• Vulnerable Nostromo web server (directory traversal/code execution)
• User account: nostromousr (gained via exploit)
• Vulnerable sudo root-less (privilege escalation via /bin/less)

CTF Steps:

• Access Nostromo web server, find 2 flags on webpage (1 plaintext, 1 hex-encoded needs decoding)
• Exploit Nostromo using Metasploit (exploit/multi/http/nostromo_code_exec) to gain shell
• Find flag in /home/nostromousr
• Use sudo privilege escalation: sudo -l shows /bin/less allowed, exploit to get root
• Find final flag in /root

---

Putting it together

attack_vm (Kali MSF)

• Kali with top 10 tools, web tools

server (Debian 10 KDE)

• NFS share with leaked information
• Netcat service on random port (1024-2024 range)
• User account (random mythical creature name) with strong password
• Vulnerable sudo root-awk (privilege escalation)

CTF Steps:

• Scan server to discover NFS share
• Mount NFS share, read file to get username and flag
• Scan for open ports, connect to random port (>1024, <2024) with netcat to get password and flag
• SSH to server using discovered credentials
• Find flag in user home directory
• Use sudo privilege escalation with awk: sudo awk 'BEGIN {system("/bin/sh")}' to get root
• Find final flag in /root

---

Rooting for a win

attack_vm (Kali MSF)

• Kali with top 10 tools, web tools

server (Debian 10 KDE)

• Vulnerable ProFTPD 1.3.3c backdoor (code execution)
• Flags in FTP home directory (1 plaintext, 1 binary/encoded)
• Flag in /root (exploit gives root access directly)

CTF Steps:

• Scan server to identify ProFTPD service
• Exploit ProFTPD backdoor using Metasploit (exploit/unix/ftp/proftpd_133c_backdoor)
• Use reverse_perl payload (standard reverse_tcp doesn't work)
• Find 2 flags in FTP home directory (1 plaintext, 1 needs decoding)
• Find final flag in /root (no privilege escalation needed, exploit gives root)

---

Smash Crack Grab and Run

attack_vm (Kali MSF)

• Kali with password tools, Armitage

server (Debian 12 KDE)

• Vulnerable Nostromo 1.9.6 service (code execution)
• User account: nostromousr (gained via exploit)
• Password-protected ZIP file (/home/nostromousr/protected.zip) with weak password
• User account (random mythical creature name) with strong password
• Base64-encoded flag in last user's home directory

CTF Steps:

• Exploit Nostromo service using Metasploit (exploit/multi/http/nostromo_code_exec) to gain shell
• Find flag in /home/nostromousr
• Copy protected.zip from server to attack VM
• Extract hash using zip2john protected.zip > zip.hash
• Crack password using John the Ripper: john zip.hash --show
• Extract ZIP file to get credentials (username and strong password) and flag
• SSH to server using discovered credentials
• Find base64-encoded flag in user home directory, decode it

---

Such a git

attack_vm (Kali MSF)

• Kali with top 10 tools, web tools

web_server (Debian 10 KDE)

• Vulnerable GitList 0.4.0 (argument injection RCE)
• User account (from organization data) with flag in home directory
• Vulnerable sudo root-apt-get (privilege escalation)

CTF Steps:

• Access GitList web interface on server
• Find username and flag leaked in GitList repository files or commit history
• Find password leaked in git/repositories/restricted
• Exploit GitList using Metasploit (exploit/multi/http/gitlist_arg_injection) to gain shell
• Find flag in user home directory
• Use sudo privilege escalation: sudo apt-get update -o APT::Update::Pre-Invoke::=/bin/sh to get root
• Find final flag in /root