Nr. 2 Hadoop +(10.2.2.2) |
+(Vulnerable) | +
|---|---|
| OS: | +Ubuntu 16.04.05 x64 | +
| Software: | +JDK, + |
+
| Default server’s port: | +8020 | +
| Server’s config: | +Single node cluster | +
| Scan results: | +Machine exploited using Hadoop exploiter | +
| Notes: | ++ |
Nr. 3 Hadoop +(10.2.2.3) |
+(Vulnerable) | +
|---|---|
| OS: | +Windows 10 x64 | +
| Software: | +JDK, + |
+
| Default server’s port: | +8020 | +
| Server’s config: | +Single node cluster | +
| Scan results: | +Machine exploited using Hadoop exploiter | +
| Notes: | ++ |
Nr. 4 Elastic +(10.2.2.4) |
+(Vulnerable) | +
|---|---|
| OS: | +Ubuntu 16.04.05 x64 | +
| Software: | +JDK, + |
+
| Default server’s port: | +9200 | +
| Server’s config: | +Default | +
| Scan results: | +Machine exploited using Elastic exploiter | +
| Notes: | +Quick tutorial on how to add entries (was useful when setting up). | +
| + | + |
Nr. 5 Elastic +(10.2.2.5) |
+(Vulnerable) | +
|---|---|
| OS: | +Windows 10 x64 | +
| Software: | +JDK, + |
+
| Default server’s port: | +9200 | +
| Server’s config: | +Default | +
| Scan results: | +Machine exploited using Elastic exploiter | +
| Notes: | +Quick tutorial on how to add entries (was useful when setting up). | +
Nr. 6 Sambacry +(10.2.2.6) |
+(Not implemented) | +
|---|---|
| OS: | +Ubuntu 16.04.05 x64 | +
| Software: | +Samba > 3.5.0 and < 4.6.4, 4.5.10 and 4.4.14 | +
| Default server’s port: | +- | +
| Root password: | +;^TK`9XN_x^ | +
| Server’s config: | ++ |
| Scan results: | +Machine exploited using Sambacry exploiter | +
| Notes: | ++ |
| + | + |
Nr. 7 Sambacry +(10.2.2.7) |
+(Not implemented) | +
|---|---|
| OS: | +Ubuntu 16.04.05 x32 | +
| Software: | +Samba > 3.5.0 and < 4.6.4, 4.5.10 and 4.4.14 | +
| Default server’s port: | +- | +
| Root password: | +*.&A7/W}Rc$ | +
| Server’s config: | ++ |
| Scan results: | +Machine exploited using Sambacry exploiter | +
| Notes: | ++ |
Nr. 8 Shellshock +(10.2.2.8) |
+(Vulnerable) | +
|---|---|
| OS: | +Ubuntu 12.04 LTS x64 | +
| Software: | +Apache2, bash 4.2. | +
| Default server’s port: | +80 | +
| Scan results: | +Machine exploited using Shellshock exploiter | +
| Notes: | +Vulnerable app is under /cgi-bin/test.cgi | +
| + | + |
Nr. 9 Tunneling M1 +(10.2.2.9, 10.2.1.9) |
+(Vulnerable) | +
|---|---|
| OS: | +Ubuntu 16.04.05 x64 | +
| Software: | +OpenSSL | +
| Default service’s port: | +22 | +
| Root password: | +`))jU7L(w} | +
| Server’s config: | +Default | +
| Notes: | ++ |
Nr. 10 Tunneling M2 +(10.2.1.10) |
+(Exploitable) | +
|---|---|
| OS: | +Ubuntu 16.04.05 x64 | +
| Software: | +OpenSSL | +
| Default service’s port: | +22 | +
| Root password: | +3Q=(Ge(+&w]* | +
| Server’s config: | +Default | +
| Notes: | +Accessible only trough Nr.9 | +
Nr. 11 SSH key steal. +(10.2.2.11) |
+(Vulnerable) | +
|---|---|
| OS: | +Ubuntu 16.04.05 x64 | +
| Software: | +OpenSSL | +
| Default connection port: | +22 | +
| Root password: | +^NgDvY59~8 | +
| Server’s config: | +SSH keys to connect to NR. 11 | +
| Notes: | ++ |
| + | + |
Nr. 12 SSH key steal. +(10.2.2.12) |
+(Exploitable) | +
|---|---|
| OS: | +Ubuntu 16.04.05 x64 | +
| Software: | +OpenSSL | +
| Default connection port: | +22 | +
| Root password: | +u?Sj5@6(-C | +
| Server’s config: | +SSH configured to allow connection from NR.10 | +
| Notes: | +Don’t add this machine’s credentials to exploit configuration. | +
| + | + |
Nr. 13 RDP grinder +(10.2.2.13) |
+(Not implemented) | +
|---|---|
| OS: | +Windows 10 x64 | +
| Software: | +- | +
| Default connection port: | +3389 | +
| Root password: | +2}p}aR]&=M | +
| Scan results: | +Machine exploited using RDP grinder | +
| Server’s config: | +Remote desktop enabled +Admin user’s credentials: +m0nk3y, 2}p}aR]&=M |
+
| Notes: | ++ |
| + | + |
Nr. 14 Mimikatz +(10.2.2.14) |
+(Vulnerable) | +
|---|---|
| OS: | +Windows 10 x64 | +
| Software: | +- | +
| Admin password: | +Ivrrw5zEzs | +
| Server’s config: | +Has cashed mimikatz-15 RDP credentials +SMB turned on |
+
| Notes: | ++ |
Nr. 15 Mimikatz +(10.2.2.15) |
+(Exploitable) | +
|---|---|
| OS: | +Windows 10 x64 | +
| Software: | +- | +
| Admin password: | +pAJfG56JX>< | +
| Server’s config: | +It’s credentials are cashed at mimikatz-14 +SMB turned on |
+
| Notes: | +If you change this machine’s IP it won’t get exploited. | +
| + | + |
Nr. 16 MsSQL +(10.2.2.16) |
+(Vulnerable) | +
|---|---|
| OS: | +Windows 10 x64 | +
| Software: | +MSSQL Server | +
| Default service port: | +1433 | +
| Server’s config: | +xp_cmdshell feature enabled in MSSQL server +Server’s creds (sa): admin, }8Ys#" |
+
| Notes: | +Enabled SQL server browser service + + |
+
| + | + |
Nr. 17 Upgrader +(10.2.2.17) |
+(Not implemented) | +
|---|---|
| OS: | +Windows 10 x64 | +
| Default service port: | +445 | +
| Root password: | +U??7ppG_ | +
| Server’s config: | +Turn on SMB | +
| Notes: | ++ |
| + | + |
Nr. 18 WebLogic +(10.2.2.18) |
+(Vulnerable) | +
|---|---|
| OS: | +Ubuntu 16.04.05 x64 | +
| Software: | +JDK, + |
+
| Default server’s port: | +7001 | +
| Admin domain credentials: | +weblogic : B74Ot0c4 | +
| Server’s config: | +Default | +
| Notes: | ++ |
Nr. 19 WebLogic +(10.2.2.19) |
+(Vulnerable) | +
|---|---|
| OS: | +Windows 10 x64 | +
| Software: | +JDK, + |
+
| Default server’s port: | +7001 | +
| Admin servers credentials: | +weblogic : =ThS2d=m(`B | +
| Server’s config: | +Default | +
| Notes: | ++ |
Nr. 20 SMB +(10.2.2.20) |
+(Vulnerable) | +
|---|---|
| OS: | +Windows 10 x64 | +
| Software: | +- | +
| Default service’s port: | +445 | +
| Root password: | +YbS,<tpS.2av | +
| Server’s config: | +SMB turned on | +
| Notes: | ++ |
Nr. 21 Scan +(10.2.2.21) |
+(Secure) | +
|---|---|
| OS: | +Ubuntu 16.04.05 x64 | +
| Software: | +Apache tomcat 7.0.92 | +
| Default server’s port: | +8080 | +
| Server’s config: | +Default | +
| Notes: | +Used to scan a machine that has no vulnerabilities (to evaluate scanning speed for e.g.) | +
| + | + |
Nr. 22 Scan +(10.2.2.22) |
+(Secure) | +
|---|---|
| OS: | +Windows 10 x64 | +
| Software: | +Apache tomcat 7.0.92 | +
| Default server’s port: | +8080 | +
| Server’s config: | +Default | +
| Notes: | +Used to scan a machine that has no vulnerabilities (to evaluate scanning speed for e.g.) | +
| + | + |
Nr. 23 Struts2 +(10.2.2.23) |
+(Vulnerable) | +
|---|---|
| OS: | +Ubuntu 16.04.05 x64 | +
| Software: | +JDK, +struts2 2.3.15.1, +tomcat 9.0.0.M9 |
+
| Default server’s port: | +8080 | +
| Server’s config: | +Default | +
| Notes: | ++ |
Nr. 24 Struts2 +(10.2.2.24) |
+(Vulnerable) | +
|---|---|
| OS: | +Windows 10 x64 | +
| Software: | +JDK, +struts2 2.3.15.1, +tomcat 9.0.0.M9 |
+
| Default server’s port: | +8080 | +
| Server’s config: | +Default | +
| Notes: | ++ |
| + | + |
Nr. 250 MonkeyIsland +(10.2.2.250) |
++ |
|---|---|
| OS: | +Ubuntu 16.04.05 x64 | +
| Software: | +MonkeyIsland server, git, mongodb etc. | +
| Default server’s port: | +22, 443 | +
| Private key passphrase: | +- | +
| Notes: | +Only accessible trough GCP | +
| + | + |
Nr. 251 MonkeyIsland +(10.2.2.251) |
++ |
|---|---|
| OS: | +Windows Server 2016 x64 | +
| Software: | +MonkeyIsland server, git, mongodb etc. | +
| Default server’s port: | +3389, 443 | +
| Private key passphrase: | +- | +
| Notes: | +Only accessible trough GCP | +
| + | + |
diff --git a/envs/monkey_zoo/terraform/firewalls.tf b/envs/monkey_zoo/terraform/firewalls.tf
new file mode 100644
index 000000000..037531869
--- /dev/null
+++ b/envs/monkey_zoo/terraform/firewalls.tf
@@ -0,0 +1,76 @@
+resource "google_compute_firewall" "islands-in" {
+ name = "islands-in"
+ network = "${google_compute_network.monkeyzoo.name}"
+
+ allow {
+ protocol = "tcp"
+ ports = ["22", "443", "3389"]
+ }
+
+ direction = "INGRESS"
+ priority = "65534"
+ target_tags = ["island"]
+}
+
+resource "google_compute_firewall" "islands-out" {
+ name = "islands-out"
+ network = "${google_compute_network.monkeyzoo.name}"
+
+ allow {
+ protocol = "tcp"
+ }
+
+ direction = "EGRESS"
+ priority = "65534"
+ target_tags = ["island"]
+}
+
+resource "google_compute_firewall" "monkeyzoo-in" {
+ name = "monkeyzoo-in"
+ network = "${google_compute_network.monkeyzoo.name}"
+
+ allow {
+ protocol = "all"
+ }
+
+ direction = "INGRESS"
+ priority = "65534"
+ source_ranges = ["10.2.2.0/24"]
+}
+
+resource "google_compute_firewall" "monkeyzoo-out" {
+ name = "monkeyzoo-out"
+ network = "${google_compute_network.monkeyzoo.name}"
+
+ allow {
+ protocol = "all"
+ }
+
+ direction = "EGRESS"
+ priority = "65534"
+ destination_ranges = ["10.2.2.0/24"]
+}
+
+resource "google_compute_firewall" "tunneling-in" {
+ name = "tunneling-in"
+ network = "${google_compute_network.tunneling.name}"
+
+ allow {
+ protocol = "all"
+ }
+
+ direction = "INGRESS"
+ source_ranges = ["10.2.1.0/28"]
+}
+
+resource "google_compute_firewall" "tunneling-out" {
+ name = "tunneling-out"
+ network = "${google_compute_network.tunneling.name}"
+
+ allow {
+ protocol = "all"
+ }
+
+ direction = "EGRESS"
+ destination_ranges = ["10.2.1.0/28"]
+}
diff --git a/envs/monkey_zoo/terraform/variables.tf b/envs/monkey_zoo/terraform/images.tf
similarity index 100%
rename from envs/monkey_zoo/terraform/variables.tf
rename to envs/monkey_zoo/terraform/images.tf
diff --git a/envs/monkey_zoo/terraform/monkey_zoo.tf b/envs/monkey_zoo/terraform/monkey_zoo.tf
index b7ad4151a..e0b97822f 100644
--- a/envs/monkey_zoo/terraform/monkey_zoo.tf
+++ b/envs/monkey_zoo/terraform/monkey_zoo.tf
@@ -15,58 +15,6 @@ resource "google_compute_network" "tunneling" {
auto_create_subnetworks = false
}
-resource "google_compute_firewall" "monkeyzoo-in" {
- name = "monkeyzoo-in"
- network = "${google_compute_network.monkeyzoo.name}"
-
- allow {
- protocol = "all"
- }
-
- direction = "INGRESS"
- priority = "65534"
- source_ranges = ["10.2.2.0/24"]
-}
-
-resource "google_compute_firewall" "monkeyzoo-out" {
- name = "monkeyzoo-out"
- network = "${google_compute_network.monkeyzoo.name}"
-
- allow {
- protocol = "all"
- }
-
- direction = "EGRESS"
- priority = "65534"
- destination_ranges = ["10.2.2.0/24"]
-}
-
-resource "google_compute_firewall" "tunneling-in" {
- name = "tunneling-in"
- network = "${google_compute_network.tunneling.name}"
-
- allow {
- protocol = "all"
- }
-
- direction = "INGRESS"
-
- source_ranges = ["10.2.1.0/28"]
-}
-
-resource "google_compute_firewall" "tunneling-out" {
- name = "tunneling-out"
- network = "${google_compute_network.tunneling.name}"
-
- allow {
- protocol = "all"
- }
-
- direction = "EGRESS"
-
- destination_ranges = ["10.2.1.0/28"]
-}
-
resource "google_compute_subnetwork" "monkeyzoo-main" {
name = "monkeyzoo-main"
ip_cidr_range = "10.2.2.0/24"
@@ -79,54 +27,6 @@ resource "google_compute_subnetwork" "tunneling-main" {
network = "${google_compute_network.tunneling.self_link}"
}
-resource "google_compute_instance_template" "ubuntu16" {
- name = "ubuntu16"
- description = "Creates ubuntu 16.04 LTS servers."
-
- tags = ["test-machine", "ubuntu16", "linux"]
-
- machine_type = "n1-standard-1"
- can_ip_forward = false
-
- disk {
- source_image = "ubuntu-os-cloud/ubuntu-1604-lts"
- auto_delete = true
- }
- network_interface {
- subnetwork="monkeyzoo-main"
- access_config {
- // Cheaper, non-premium routing
- network_tier = "STANDARD"
- }
- }
- service_account {
- email ="${local.service_account_email}"
- scopes=["cloud-platform"]
- }
-}
-
-resource "google_compute_instance_template" "windows2016" {
- name = "windows2016"
- description = "Creates windows 2016 core servers."
-
- tags = ["test-machine", "windows2016core", "windows"]
-
- machine_type = "n1-standard-1"
- can_ip_forward = false
-
- disk {
- source_image = "windows-cloud/windows-2016"
- auto_delete = true
- }
- network_interface {
- subnetwork="monkeyzoo-main"
- }
- service_account {
- email="${local.service_account_email}"
- scopes=["cloud-platform"]
- }
-}
-
resource "google_compute_instance_from_template" "hadoop-2" {
name = "hadoop-2"
source_instance_template = "${local.default_ubuntu}"
@@ -143,6 +43,7 @@ resource "google_compute_instance_from_template" "hadoop-2" {
// Add required ssh keys for hadoop service and restart it
metadata_startup_script = "[ ! -f /home/vakaris_zilius/.ssh/authorized_keys ] && sudo cat /home/vakaris_zilius/.ssh/id_rsa.pub >> /home/vakaris_zilius/.ssh/authorized_keys && sudo reboot"
}
+
resource "google_compute_instance_from_template" "hadoop-3" {
name = "hadoop-3"
source_instance_template = "${local.default_windows}"
@@ -157,6 +58,7 @@ resource "google_compute_instance_from_template" "hadoop-3" {
network_ip="10.2.2.3"
}
}
+
resource "google_compute_instance_from_template" "elastic-4" {
name = "elastic-4"
source_instance_template = "${local.default_ubuntu}"
@@ -171,6 +73,7 @@ resource "google_compute_instance_from_template" "elastic-4" {
network_ip="10.2.2.4"
}
}
+
resource "google_compute_instance_from_template" "elastic-5" {
name = "elastic-5"
source_instance_template = "${local.default_windows}"
@@ -185,6 +88,7 @@ resource "google_compute_instance_from_template" "elastic-5" {
network_ip="10.2.2.5"
}
}
+
/* Couldn't find ubuntu packages for required samba version (too old).
resource "google_compute_instance_from_template" "sambacry-6" {
name = "sambacry-6"
@@ -200,6 +104,7 @@ resource "google_compute_instance_from_template" "sambacry-6" {
}
}
*/
+
/* We need custom 32 bit Ubuntu machine for this (there are no 32 bit ubuntu machines in GCP).
resource "google_compute_instance_from_template" "sambacry-7" {
name = "sambacry-7"
@@ -216,6 +121,7 @@ resource "google_compute_instance_from_template" "sambacry-7" {
}
}
*/
+
resource "google_compute_instance_from_template" "shellshock-8" {
name = "shellshock-8"
source_instance_template = "${local.default_ubuntu}"
@@ -230,6 +136,7 @@ resource "google_compute_instance_from_template" "shellshock-8" {
network_ip="10.2.2.8"
}
}
+
resource "google_compute_instance_from_template" "tunneling-9" {
name = "tunneling-9"
source_instance_template = "${local.default_ubuntu}"
@@ -242,7 +149,7 @@ resource "google_compute_instance_from_template" "tunneling-9" {
network_interface{
subnetwork="tunneling-main"
network_ip="10.2.1.9"
-
+
}
network_interface{
subnetwork="monkeyzoo-main"
@@ -265,7 +172,6 @@ resource "google_compute_instance_from_template" "tunneling-10" {
}
}
-
resource "google_compute_instance_from_template" "sshkeys-11" {
name = "sshkeys-11"
source_instance_template = "${local.default_ubuntu}"
@@ -295,6 +201,7 @@ resource "google_compute_instance_from_template" "sshkeys-12" {
network_ip="10.2.2.12"
}
}
+
/*
resource "google_compute_instance_from_template" "rdpgrinder-13" {
name = "rdpgrinder-13"
@@ -355,6 +262,7 @@ resource "google_compute_instance_from_template" "mssql-16" {
network_ip="10.2.2.16"
}
}
+
/* We need to alter monkey's behavior for this to upload 32-bit monkey instead of 64-bit (not yet developed)
resource "google_compute_instance_from_template" "upgrader-17" {
name = "upgrader-17"
@@ -374,6 +282,7 @@ resource "google_compute_instance_from_template" "upgrader-17" {
}
}
*/
+
resource "google_compute_instance_from_template" "weblogic-18" {
name = "weblogic-18"
source_instance_template = "${local.default_ubuntu}"
@@ -448,6 +357,7 @@ resource "google_compute_instance_from_template" "scan-22" {
network_ip="10.2.2.22"
}
}
+
resource "google_compute_instance_from_template" "struts2-23" {
name = "struts2-23"
source_instance_template = "${local.default_ubuntu}"
@@ -481,6 +391,7 @@ resource "google_compute_instance_from_template" "struts2-24" {
resource "google_compute_instance_from_template" "island-linux-250" {
name = "island-linux-250"
machine_type = "n1-standard-2"
+ tags = ["island", "linux", "ubuntu16"]
source_instance_template = "${local.default_ubuntu}"
boot_disk{
initialize_params {
@@ -501,6 +412,7 @@ resource "google_compute_instance_from_template" "island-linux-250" {
resource "google_compute_instance_from_template" "island-windows-251" {
name = "island-windows-251"
machine_type = "n1-standard-2"
+ tags = ["island", "windows", "windowsserver2016"]
source_instance_template = "${local.default_windows}"
boot_disk{
initialize_params {
diff --git a/envs/monkey_zoo/terraform/templates.tf b/envs/monkey_zoo/terraform/templates.tf
new file mode 100644
index 000000000..ed48864d9
--- /dev/null
+++ b/envs/monkey_zoo/terraform/templates.tf
@@ -0,0 +1,45 @@
+resource "google_compute_instance_template" "ubuntu16" {
+ name = "ubuntu16"
+ description = "Creates ubuntu 16.04 LTS servers at europe-west3-a."
+
+ tags = ["test-machine", "ubuntu16", "linux"]
+
+ machine_type = "n1-standard-1"
+ can_ip_forward = false
+
+ disk {
+ source_image = "ubuntu-os-cloud/ubuntu-1604-lts"
+ }
+ network_interface {
+ subnetwork="monkeyzoo-main"
+ access_config {
+ // Cheaper, non-premium routing
+ network_tier = "STANDARD"
+ }
+ }
+ service_account {
+ email ="${local.service_account_email}"
+ scopes=["cloud-platform"]
+ }
+}
+
+resource "google_compute_instance_template" "windows2016" {
+ name = "windows2016"
+ description = "Creates windows 2016 core servers at europe-west3-a."
+
+ tags = ["test-machine", "windowsserver2016", "windows"]
+
+ machine_type = "n1-standard-1"
+ can_ip_forward = false
+
+ disk {
+ source_image = "windows-cloud/windows-2016"
+ }
+ network_interface {
+ subnetwork="monkeyzoo-main"
+ }
+ service_account {
+ email="${local.service_account_email}"
+ scopes=["cloud-platform"]
+ }
+}
\ No newline at end of file