Attack/defense automation: PCAPs, SSH keys, git

Most important tools and languages for automating the boring stuff are:

• Terraform
• Ansible
• Nix
• Bash scripts
• SystemD services / cronjobs

PCAPs

Capture network traffic on vulnbox and download it to a remote server for analysis with tulip, caronte$, shovel or zeek

• Add an SSH key for the remote machine to be able to SSH into root@vulnbox

• Also make sure both the vulnbox and the remote machine have compatible versions of rsync installed

• On vulnbox as root:

  dir=$(mktemp -d)
  chmod 770 "$dir"
  # Change port(s) for different services
  screen -S tcpdump -dm tcpdump -A -n -t -C 1 -G 30 -w "$dir"/%s.pcap -i game "tcp port 4242 or tcp port 6666 or tcp port 10055"
  screen -ls
  echo "Run 'screen -a tcpdump' to attach"
  echo "Pcaps will be saved to '$dir'"

• On remote machine:

  dir="/tmp/..."
  vulnbox="x.x.x.x"
  
  mkdir -p "/var/log/pcaps"
  
  while true
  do
      rsync -rchazvP --remove-source-files --mkpath "root@$vulnbox:/$dir" "/var/log/pcaps/"
      sleep 10
  done

  • You can also make it upload pcaps to caronte$ by running this curl command for each pcap file. Make sure the filenames end with .pcap, otherwise caronte$ will mark them as invalid, and not parse them.

    curl \
        -F "file=@$pcap_file;filename=$pcap_file" \
        -u "$CARONTE_USER:$CARONTE_PASS" \
        "$CARONTE_URL/api/pcap/upload"

  • Uploading pcaps to tulip is as simple as configuring tulip to use /var/log/pcaps/ as its pcap directory

SSH keys

Allow teammates to log into vulnbox as root without having to use the provided root password

• On vulnbox as root:

  users=("alpha" "bravo" "charlie")
  keys=""
  
  for user in "${users[@]}"
  do
      key=$(curl "https://github.com/$user.keys")
      keys="${keys}
  ${key}"
  done
  
  echo "$keys" | tee -a "/root/.ssh/authorized_keys"

Initialize Git in service directories

This enables version control per service which makes patching a lot safer

• On vulnbox as root:

  service_dirs=$(find "/root" -maxdepth 1 -mindepth 1 -type d ! -name "snap" ! -name ".*")
  
  for dir in "${service_dirs[@]}"
  do
      git -C "$dir" init
      git -C "$dir" add --all
      git -C "$dir" commit -m "Initial state"
  done