mirror of https://github.com/avast/PurpleDome
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
339 lines
9.2 KiB
YAML
339 lines
9.2 KiB
YAML
|
|
###
|
|
# Caldera configuration
|
|
caldera:
|
|
###
|
|
# API key for caldera. See caldera configuration. Default is ADMIN123
|
|
apikey: ADMIN123
|
|
|
|
###
|
|
# Attacks configuration
|
|
attackers:
|
|
###
|
|
# Configuration for the first attacker. One should normally be enough. But it is still implemented as a list
|
|
- name: attacker
|
|
|
|
###
|
|
# Defining VM controller settings for this machine
|
|
vm_controller:
|
|
###
|
|
# Type of the VM controller, Options are "vagrant" and "running_vm"
|
|
vm_type: vagrant
|
|
###
|
|
# # path where the vagrantfile is in
|
|
vagrantfilepath: systems
|
|
|
|
###
|
|
# Name of machine in Vagrantfile, main way to reference this machine
|
|
vm_name: attacker
|
|
|
|
###
|
|
# Machine can have nicknames. They can be used in complex attacks to reference the machine in multiple ways
|
|
nicknames:
|
|
- "suspect 1"
|
|
|
|
###
|
|
# machinepath is a path where the machine specific files and logs are stored. Relative to the Vagrantfile path
|
|
# and will be mounted internally as /vagrant/<name> for linux machines
|
|
# If machinepath is not set PurpleDome will try "vm_name"
|
|
machinepath: attacker1
|
|
|
|
###
|
|
# OS of the VM guest. Options are so far "windows", "linux"
|
|
os: linux
|
|
|
|
###
|
|
# Do not destroy/create the machine: Set this to "yes".
|
|
use_existing_machine: yes
|
|
|
|
###
|
|
# List of targets
|
|
targets:
|
|
###
|
|
# Name of a specific target. It is implemented as a list, you can have several targets in your experiment
|
|
- name: target1
|
|
###
|
|
# Defining VM controller settings for this machine
|
|
vm_controller:
|
|
###
|
|
# Type of the VM controller, Options are "vagrant" and "running_vm"
|
|
vm_type: vagrant
|
|
###
|
|
# # path where the vagrantfile is in
|
|
vagrantfilepath: systems
|
|
|
|
###
|
|
# simple switch if targets is used in attack simulation. Default is true. If set to false the machine will not be started
|
|
active: no
|
|
|
|
###
|
|
# Name of machine in Vagrantfile, main way to reference this machine
|
|
vm_name: target1
|
|
|
|
###
|
|
# Machine can have nicknames. They can be used in complex attacks to reference the machine
|
|
nicknames:
|
|
- "web server"
|
|
|
|
###
|
|
# OS of the VM guest. Options are so far "windows", "linux"
|
|
os: linux
|
|
|
|
###
|
|
# Targets need a unique PAW name for caldera
|
|
paw: target1
|
|
|
|
###
|
|
# Targets need to be in a group for caldera. The group is more relevant than the paw. Better put every target in a unique group
|
|
group: red
|
|
|
|
###
|
|
# machinepath is a path where the machine specific files and logs are stored. Relative to the Vagrantfile path
|
|
# and will be mounted internally as /vagrant/<name> for linux machines
|
|
# If machinepath is not set PurpleDome will try "vm_name"
|
|
machinepath: target1
|
|
|
|
###
|
|
# Do not destroy/create the machine: Set this to "yes". Good if you want to keep this machine around between experiments
|
|
use_existing_machine: yes
|
|
|
|
###
|
|
# The folder all the implants will be installed into. IN the machine
|
|
playground: /home/vagrant
|
|
|
|
###
|
|
# List of sensors to run on this machine. They are implemented as plugins and have a unique name
|
|
sensors:
|
|
# - linux_idp
|
|
|
|
- name: target2
|
|
###
|
|
# Defining VM controller settings for this machine
|
|
vm_controller:
|
|
###
|
|
# Type of the VM controller, Options are "vagrant" and "running_vm"
|
|
vm_type: vagrant
|
|
###
|
|
# path where the vagrantfile is in
|
|
vagrantfilepath: systems
|
|
|
|
###
|
|
# simple switch defining if targets is used in attack simulation. Default is true. If set to false the machine will not be started
|
|
active: no
|
|
|
|
###
|
|
# Name of machine in Vagrantfile, main way to reference this machine
|
|
vm_name: target2
|
|
|
|
###
|
|
# Machine can have nicknames. They can be used in complex attacks to reference the machine
|
|
nicknames:
|
|
- "t2"
|
|
- "practice target"
|
|
|
|
###
|
|
# OS of the VM guest. Options are so far "windows", "linux"
|
|
# This is the example for a windows machine. Windows machines are much trickier to handle in Vagrant ! Check the documentation
|
|
os: windows
|
|
|
|
###
|
|
# Targets need a unique PAW name for caldera
|
|
paw: target2w
|
|
|
|
###
|
|
# Targets need to be in a group for caldera. The group is more relevant than the paw. Better put every target in a unique group
|
|
group: red_windows
|
|
|
|
###
|
|
# machinepath is a path where the machine specific files and logs are stored. Relative to the Vagrantfile path
|
|
# and will be mounted internally as /vagrant/<name> for linux machines
|
|
# If machinepath is not set PurpleDome will try "vm_name"
|
|
machinepath: target2w
|
|
|
|
###
|
|
# Do not destroy/create the machine: Set this to "yes".
|
|
use_existing_machine: yes
|
|
|
|
###
|
|
# Optional setting to activate force when halting the machine. Windows guests sometime get stuck
|
|
halt_needs_force: yes
|
|
|
|
###
|
|
# If SSH without vagrant support is used (Windows !) we need a user name (uppercase)
|
|
ssh_user: PURPLEDOME
|
|
|
|
###
|
|
# If SSH without vagrant support is used (Windows !) we maybe need a password
|
|
ssh_password: PURPLEDOME
|
|
|
|
###
|
|
# For non-vagrant ssh connections a ssh keyfile stored in the machinepath is required.
|
|
ssh_keyfile: id_rsa.3
|
|
|
|
###
|
|
# The folder all the implants will be installed into
|
|
# Windows can only use default playground at the moment !
|
|
|
|
# playground: C:\\Users\\PurpleDome
|
|
|
|
###
|
|
# Sensors to run on this machine
|
|
sensors:
|
|
- windows_idp
|
|
|
|
###
|
|
# Vulnerabilities to pre-install. They are implemented as plugins
|
|
vulnerabilities:
|
|
- weak_user_passwords
|
|
- rdp_config_vul
|
|
|
|
|
|
# Ubuntu 20.10 (Groovy)
|
|
- name: target3
|
|
###
|
|
# Defining VM controller settings for this machine
|
|
vm_controller:
|
|
###
|
|
# Type of the VM controller, Options are "vagrant" and "running_vm"
|
|
vm_type: vagrant
|
|
###
|
|
# path where the vagrantfile is in
|
|
vagrantfilepath: systems
|
|
|
|
###
|
|
# simple switch if targets is used in attack simulation. Default is true. If set to false the machine will not be started
|
|
active: yes
|
|
|
|
|
|
###
|
|
# Name of machine in Vagrantfile, main way to reference this machine
|
|
vm_name: target3
|
|
|
|
###
|
|
# Machine can have nicknames. They can be used in complex attacks to reference the machine
|
|
nicknames:
|
|
- "red shirt"
|
|
- "the flag"
|
|
|
|
|
|
###
|
|
# OS of the VM guest. Options are so far "windows", "linux"
|
|
# This is the example for a windows machine. Windows machines are much trickier to handle in Vagrant ! Check the documentation
|
|
os: linux
|
|
|
|
###
|
|
# Targets need a unique PAW name for caldera
|
|
paw: target3
|
|
|
|
###
|
|
# Targets need to be in a group for caldera. The group is more relevant than the paw. Better put every target in a unique group
|
|
group: red
|
|
|
|
###
|
|
# machinepath is a path where the machine specific files and logs are stored. Relative to the Vagrantfile path
|
|
# and will be mounted internally as /vagrant/<name> for linux machines
|
|
# If machinepath is not set PurpleDome will try "vm_name"
|
|
machinepath: target3
|
|
|
|
###
|
|
# Do not destroy/create the machine: Set this to "yes".
|
|
use_existing_machine: no
|
|
|
|
###
|
|
# The folder all the implants will be installed into
|
|
playground: /home/vagrant
|
|
|
|
# Sensors to run on this machine
|
|
sensors:
|
|
- linux_idp
|
|
|
|
###
|
|
# Vulnerabilities to pre-install. They are implemented as plugins
|
|
vulnerabilities:
|
|
- sshd_config_vul
|
|
- weak_user_passwords
|
|
|
|
###
|
|
# General attack config
|
|
attacks:
|
|
###
|
|
# configure the seconds the system idles between the attacks. Makes it slower. But attack and defense logs will be simpler to match
|
|
nap_time: 5
|
|
|
|
###
|
|
# The obfuscator to use between the implant and the server. Not all obfuscators are supported by all implants. Existing obfuscators:
|
|
# plain-text, base64, base64jumble, caesar, base64noPadding, steganography
|
|
caldera_obfuscator: plain-text
|
|
|
|
###
|
|
# Jitter settings for the implant. it is min/max seconds. The first number has to be smaller. Default is 4/8
|
|
caldera_jitter: 4/8
|
|
|
|
###
|
|
# A list of caldera attacks to run against the targets.
|
|
caldera_attacks:
|
|
###
|
|
# Linux specific attacks. A list of caldera ability IDs
|
|
linux:
|
|
- "bd527b63-9f9e-46e0-9816-b8434d2b8989"
|
|
###
|
|
# Windows specific attacks. A list of caldera ability IDs
|
|
windows:
|
|
- "bd527b63-9f9e-46e0-9816-b8434d2b8989"
|
|
|
|
###
|
|
# Plugin based attacks. Will result in plugins being called
|
|
plugin_based_attacks:
|
|
###
|
|
# Linux specific attacks, a list
|
|
linux:
|
|
- hydra
|
|
- nmap
|
|
###
|
|
# Windows specific attacks, a list
|
|
windows:
|
|
- hydra
|
|
- nmap
|
|
|
|
###
|
|
# Configuration for the plugin based attack tools
|
|
attack_conf:
|
|
###
|
|
# Hydra configuration
|
|
hydra:
|
|
###
|
|
# A list of protocols to brute force against. Supported: "ssh"
|
|
protocols:
|
|
- ssh
|
|
- rdp
|
|
#- ftps
|
|
###
|
|
# A file containing potential user names
|
|
userfile: users.txt
|
|
###
|
|
# A file containing potential passwords
|
|
pwdfile: passwords.txt
|
|
nmap:
|
|
|
|
###
|
|
# General sensor config config
|
|
sensor_conf:
|
|
###
|
|
# Windows IDP plugin configuration
|
|
windows_idp:
|
|
###
|
|
# Name of the dll to use. Must match AV version
|
|
dll_name: aswidptestdll.dll
|
|
|
|
###
|
|
# Folder where the IDP tool is located
|
|
idp_tool_folder: C:\\capture
|
|
|
|
|
|
###
|
|
# Settings for the results being harvested
|
|
results:
|
|
###
|
|
# The directory the loot will be in
|
|
loot_dir: loot
|