I request you to read the problem before suggesting any duplicate or down-voting, I am well aware of hundreds of questions about somewhat similar problem but this one is just to attract some good advises and tricks. So here it goes
I am creating a testing environment on which some different teams of newbie guys will be performing a penetration test. I am arranging this lab for them to learn and to check their skills. I myself am not very much proficient but I am learning with everyone else, that is the first reason I decided to ask for suggestions and tricks.
Right now the setup is like this:
- A 'home-made' cluster of 8 computers running Ubuntu 10.04 server is hosting all the virtual machines
- We have Metasploitable, Ultimate Lamp, NET in VM, Windows XP, Windows 7 and CentOS with a bunch of vulnerable applications installed on each.
- Server also have HoneyD installed on it operating with 30-50 honeypots.
- Metasploitable and Ultimate Lamp are re-configured to make them hard to crack, basically, only a couple ports are open with vulnerabilities that can be exploited for least privileged access only (I collected the data from Metasploit database and exploit-db).
- This virtual network is served on a physical network to which anyone can connect easily.
What I want is to automate a couple things so that I dont have to constantly keep an eye over the situation while our attackers are performing. Also, as there are different kind of peoples with different mindset I am looking for some arrangement to log and examine their actions and behavior. Everybody will be following a strict flow of actions so that they can go through all the techniques without skipping anything.
Desired workflow
- Network Mapping and Vulnerability Scanning
- Exploitation
- Privilege escalation
- Maintaining access with Rootkit and Backdoor
- Cracking passwords and gaining access to every user account
- Downloading some private files from users directory and extracting the information. (A kind of Steganography excercise)
- Information extracted from those files will be used in further exercises.
- Cleanup
I dont know about every person who will be performing on this setup but one thing is sure that they all are just one or two level up from basic. For convenience if you take 10 as measuring parameter I'd say that there are guys with 3 (at least) to 6 (at most) points. everyone will be performing with same set of tools, no 'backtrack' because I want to force everyone into a restricted environment, I customized a ubuntu distro which have following tools installed:
- Network related
- NMAP
- DNSMap
- DNSEnum
- dsniff
- driftnet
- ettercap
- arpspoof
- scapy
- sslstrip
- sslsniff
- sqlscan
- Vulnerability scanning and exploitation
- Nessus
- Metasploit
- Armitage
- Fasttrack
- Utilities
- John the ripper, Cain & able, rainbowcrack, hydra, fcrackzip
- stegdetect
- testdisk, ddrescue, samdump
- hashdeep (MD5, SHA1, SHA256)
I am looking into making this whole penetration venture based more on tactics rather than just technical flaws that can be exploited. I want to create some real life but not hard to crack scenario so that attackers can experience something new rather than just downloading the VM from internet and then following the tutorials to perform attacks.
I think the honeypot setup can be customized to be far more better than just deploying the honeypots but I am empty on thoughts, any suggestion on that would be appreciated.
I request you to advice on what more could be there to make this exercise suit an intermediate level of pentesting and putting a challenge up, even better if it can be turned into a competition among the attackers.
This would not serve the purpose to download and install the vulnerable machine with default configuration, I have to customize the setup or most of the guys will be having root access within seconds.
Also please share some tips and tricks that you think can spruce up the experience. Please take care that you suggest only the tool which you think must be there in our toolkit.
