oxbrbtx/PrimAITE
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

#2483 Addressed inconsistent naming schema. Now all some tech networks will be referenced using a underscore. E.g "ST-PROJ-A-PRV-PC-1" has now been changed to "ST_PROJ-A-PRV-PC-1".

Browse Source
This commit is contained in:
Archer Bowen
2025-02-25 16:56:46 +00:00
committed by Marek Wolan
parent 80be1d5418
commit f6a6c3dde5
22 changed files with 1449 additions and 1449 deletions
Download Patch File Download Diff File Expand all files Collapse all files

754
src/primaite/config/_package_data/uc7_config.yaml
View File

File diff suppressed because it is too large Load Diff

776
src/primaite/config/_package_data/uc7_config_tap003.yaml
View File

File diff suppressed because it is too large Load Diff

4
src/primaite/config/_package_data/uc7_multiple_attack_variants/TAP001_PC1.yaml
View File

@@ -9,8 +9,8 @@ red: &red
repeat_kill_chain: false
repeat_kill_chain_stages: true
default_target_ip: 192.168.220.3
default_starting_node: "ST-PROJ-C-PRV-PC-1"
# starting_nodes: ["ST-PROJ-A-PRV-PC-1", "ST-PROJ-B-PRV-PC-2", "ST-PROJ-C-PRV-PC-3"]
default_starting_node: "ST_PROJ-C-PRV-PC-1"
# starting_nodes: ["ST_PROJ-A-PRV-PC-1", "ST_PROJ-B-PRV-PC-2", "ST_PROJ-C-PRV-PC-3"]
starting_nodes:
kill_chain:
ACTIVATE:

4
src/primaite/config/_package_data/uc7_multiple_attack_variants/TAP001_PC2.yaml
View File

@@ -9,8 +9,8 @@ red: &red
repeat_kill_chain: false
repeat_kill_chain_stages: true
default_target_ip: 192.168.220.3
default_starting_node: "ST-PROJ-B-PRV-PC-2"
# starting_nodes: ["ST-PROJ-A-PRV-PC-1", "ST-PROJ-B-PRV-PC-2", "ST-PROJ-C-PRV-PC-3"]
default_starting_node: "ST_PROJ-B-PRV-PC-2"
# starting_nodes: ["ST_PROJ-A-PRV-PC-1", "ST_PROJ-B-PRV-PC-2", "ST_PROJ-C-PRV-PC-3"]
starting_nodes:
kill_chain:
ACTIVATE:

4
src/primaite/config/_package_data/uc7_multiple_attack_variants/TAP001_PC3.yaml
View File

@@ -9,8 +9,8 @@ red: &red
repeat_kill_chain: false
repeat_kill_chain_stages: true
default_target_ip: 192.168.220.3
default_starting_node: "ST-PROJ-C-PRV-PC-3"
# starting_nodes: ["ST-PROJ-A-PRV-PC-1", "ST-PROJ-B-PRV-PC-2", "ST-PROJ-C-PRV-PC-3"]
default_starting_node: "ST_PROJ-C-PRV-PC-3"
# starting_nodes: ["ST_PROJ-A-PRV-PC-1", "ST_PROJ-B-PRV-PC-2", "ST_PROJ-C-PRV-PC-3"]
starting_nodes:
kill_chain:
ACTIVATE:

26
src/primaite/config/_package_data/uc7_multiple_attack_variants/TAP003.yaml
View File

@@ -10,28 +10,28 @@ red: &red
variance: 0
repeat_kill_chain: false
repeat_kill_chain_stages: true
default_starting_node: "ST-PROJ-A-PRV-PC-1"
default_starting_node: "ST_PROJ-A-PRV-PC-1"
starting_nodes:
# starting_nodes: ["ST-PROJ-A-PRV-PC-1", "ST-PROJ-B-PRV-PC-2", "ST-PROJ-C-PRV-PC-3"]
# starting_nodes: ["ST_PROJ-A-PRV-PC-1", "ST_PROJ-B-PRV-PC-2", "ST_PROJ-C-PRV-PC-3"]
kill_chain:
PLANNING:
probability: 1
starting_network_knowledge:
credentials:
ST-PROJ-A-PRV-PC-1:
ST_PROJ-A-PRV-PC-1:
username: admin
password: admin
ST-PROJ-B-PRV-PC-2:
ST_PROJ-B-PRV-PC-2:
username: admin
password: admin
ST-PROJ-C-PRV-PC-3:
ST_PROJ-C-PRV-PC-3:
username: admin
password: admin
ST-INTRA-PRV-RT-DR-1:
ST_INTRA-PRV-RT-DR-1:
ip_address: 192.168.230.1
username: admin
password: admin
ST-INTRA-PRV-RT-CR:
ST_INTRA-PRV-RT-CR:
ip_address: 192.168.160.1
username: admin
password: admin
@@ -44,13 +44,13 @@ red: &red
MANIPULATION:
probability: 1
account_changes:
- host: ST-INTRA-PRV-RT-DR-1
ip_address: 192.168.230.1 # ST-INTRA-PRV-RT-DR-1
- host: ST_INTRA-PRV-RT-DR-1
ip_address: 192.168.230.1 # ST_INTRA-PRV-RT-DR-1
action: change_password
username: admin
new_password: "red_pass"
- host: ST-INTRA-PRV-RT-CR
ip_address: 192.168.160.1 # ST-INTRA-PRV-RT-CR
- host: ST_INTRA-PRV-RT-CR
ip_address: 192.168.160.1 # ST_INTRA-PRV-RT-CR
action: change_password
username: "admin"
new_password: "red_pass"
@@ -62,7 +62,7 @@ red: &red
EXPLOIT:
probability: 1
malicious_acls:
- target_router: ST-INTRA-PRV-RT-DR-1
- target_router: ST_INTRA-PRV-RT-DR-1
position: 1
permission: DENY
src_ip: ALL
@@ -72,7 +72,7 @@ red: &red
src_port: POSTGRES_SERVER
dst_port: POSTGRES_SERVER
protocol_name: TCP
- target_router: ST-INTRA-PRV-RT-CR
- target_router: ST_INTRA-PRV-RT-CR
position: 1
permission: DENY
src_ip: ALL

750
src/primaite/config/_package_data/uc7_multiple_attack_variants/uc7_config_no_red.yaml
View File

File diff suppressed because it is too large Load Diff

184
src/primaite/notebooks/UC7-E2E-Demo.ipynb
View File

@@ -269,7 +269,7 @@
"outputs": [],
"source": [
"# ST DMZ Public Firewall (Permits all traffic by default)\n",
"st_pub_fw: Firewall = uc7_network.get_node_by_hostname(hostname=\"ST-PUB-FW\")\n",
"st_pub_fw: Firewall = uc7_network.get_node_by_hostname(hostname=\"ST_PUB-FW\")\n",
"st_pub_fw.show_nic()"
]
},
@@ -280,7 +280,7 @@
"outputs": [],
"source": [
"# ST DMZ Public web-server\n",
"st_dmz_pub_srv_web: Server = uc7_network.get_node_by_hostname(hostname=\"ST-DMZ-PUB-SRV-WEB\")\n",
"st_dmz_pub_srv_web: Server = uc7_network.get_node_by_hostname(hostname=\"ST_DMZ-PUB-SRV-WEB\")\n",
"st_dmz_pub_srv_web.software_manager.show()"
]
},
@@ -301,9 +301,9 @@
"| `ST_PROJ_B` | Development Network |\n",
"| `ST_PROJ_C` | Development Network |\n",
"\n",
"In order for hosts to communicate between each network and the wider internet, the main site utilises three routers' `ST-INTRA-PRV-RT-DR-1`, `ST-INTRA-PRV-RT-DR-2` and `ST-INTRA-PRV-RT-CR`.\n",
"In order for hosts to communicate between each network and the wider internet, the main site utilises three routers' `ST_INTRA-PRV-RT-DR-1`, `ST_INTRA-PRV-RT-DR-2` and `ST_INTRA-PRV-RT-CR`.\n",
"\n",
"The `ST-INTRA-PRV-RT-DR-1` router is responsible for routing all traffic from the `ST_PROJ_A`/`B`/`C` networks whereas the `ST-INTRA-PRV-RT-DR-2` router routes all traffic from the `ST_HO`/`HR` networks. Both of which then forward all traffic to the main `ST-INTRA-PRV-RT-CR` router. \n",
"The `ST_INTRA-PRV-RT-DR-1` router is responsible for routing all traffic from the `ST_PROJ_A`/`B`/`C` networks whereas the `ST_INTRA-PRV-RT-DR-2` router routes all traffic from the `ST_HO`/`HR` networks. Both of which then forward all traffic to the main `ST_INTRA-PRV-RT-CR` router. \n",
"\n",
"This central router connects to the `ST_DMZ` firewall (`ST-PUB-FW`) as well as any traffic that is headed to the `ST_DATA` (the ST database and database storage) network.\n"
]
@@ -314,7 +314,7 @@
"metadata": {},
"outputs": [],
"source": [
"st_intra_prv_rt_cr: Router = uc7_network.get_node_by_hostname(hostname=\"ST-INTRA-PRV-RT-CR\")\n",
"st_intra_prv_rt_cr: Router = uc7_network.get_node_by_hostname(hostname=\"ST_INTRA-PRV-RT-CR\")\n",
"st_intra_prv_rt_cr.route_table.show()"
]
},
@@ -324,7 +324,7 @@
"metadata": {},
"outputs": [],
"source": [
"st_intra_prv_rt_dr_1: Router = uc7_network.get_node_by_hostname(hostname=\"ST-INTRA-PRV-RT-DR-1\")"
"st_intra_prv_rt_dr_1: Router = uc7_network.get_node_by_hostname(hostname=\"ST_INTRA-PRV-RT-DR-1\")"
]
},
{
@@ -333,7 +333,7 @@
"metadata": {},
"outputs": [],
"source": [
"st_intra_prv_rt_dr_2: Router = uc7_network.get_node_by_hostname(hostname=\"ST-INTRA-PRV-RT-DR-2\")"
"st_intra_prv_rt_dr_2: Router = uc7_network.get_node_by_hostname(hostname=\"ST_INTRA-PRV-RT-DR-2\")"
]
},
{
@@ -351,7 +351,7 @@
"metadata": {},
"outputs": [],
"source": [
"st_head_office_private_pc_1: Computer = uc7_network.get_node_by_hostname(\"ST-HO-PRV-PC-1\")\n",
"st_head_office_private_pc_1: Computer = uc7_network.get_node_by_hostname(\"ST_HO-PRV-PC-1\")\n",
"st_head_office_private_pc_1.software_manager.show()"
]
},
@@ -370,7 +370,7 @@
"metadata": {},
"outputs": [],
"source": [
"st_human_resources_private_pc_2: Computer = uc7_network.get_node_by_hostname(\"ST-HR-PRV-PC-2\")\n",
"st_human_resources_private_pc_2: Computer = uc7_network.get_node_by_hostname(\"ST_HR-PRV-PC-2\")\n",
"st_human_resources_private_pc_2.software_manager.show()"
]
},
@@ -384,8 +384,8 @@
"\n",
"| Server | Purpose |\n",
"|--------|---------|\n",
"| `ST-DATA-PRV-SRV-DB` | Hosts the `database-service` that all `database-client` are configured to use. | \n",
"| `ST-DATA-PRV-SRV-STORAGE`| Acts as a storage server for the `ST-DATA-PRV-SRV-DB`. |"
"| `ST_DATA-PRV-SRV-DB` | Hosts the `database-service` that all `database-client` are configured to use. | \n",
"| `ST_DATA-PRV-SRV-STORAGE`| Acts as a storage server for the `ST_DATA-PRV-SRV-DB`. |"
]
},
{
@@ -394,7 +394,7 @@
"metadata": {},
"outputs": [],
"source": [
"st_data_private_server_database: Server = uc7_network.get_node_by_hostname(\"ST-DATA-PRV-SRV-DB\")\n",
"st_data_private_server_database: Server = uc7_network.get_node_by_hostname(\"ST_DATA-PRV-SRV-DB\")\n",
"st_data_private_server_database_service: DatabaseService = st_data_private_server_database.software_manager.software[\"database-service\"]\n",
"st_data_private_server_database.software_manager.show()\n",
"st_data_private_server_database.software_manager.file_system.show(full=True)\n",
@@ -407,7 +407,7 @@
"metadata": {},
"outputs": [],
"source": [
"st_data_private_server_storage: Server = uc7_network.get_node_by_hostname(\"ST-DATA-PRV-SRV-STORAGE\")\n",
"st_data_private_server_storage: Server = uc7_network.get_node_by_hostname(\"ST_DATA-PRV-SRV-STORAGE\")\n",
"st_data_private_server_storage.software_manager.show()"
]
},
@@ -426,7 +426,7 @@
"metadata": {},
"outputs": [],
"source": [
"st_project_a_private_pc_1: Computer = uc7_network.get_node_by_hostname(\"ST-PROJ-A-PRV-PC-1\")\n",
"st_project_a_private_pc_1: Computer = uc7_network.get_node_by_hostname(\"ST_PROJ-A-PRV-PC-1\")\n",
"st_project_a_private_pc_1.software_manager.show()"
]
},
@@ -443,7 +443,7 @@
"metadata": {},
"outputs": [],
"source": [
"st_project_b_private_pc_2: Computer = uc7_network.get_node_by_hostname(\"ST-PROJ-B-PRV-PC-2\")\n",
"st_project_b_private_pc_2: Computer = uc7_network.get_node_by_hostname(\"ST_PROJ-B-PRV-PC-2\")\n",
"st_project_b_private_pc_2.software_manager.show()"
]
},
@@ -460,7 +460,7 @@
"metadata": {},
"outputs": [],
"source": [
"st_project_c_private_pc_3: Computer = uc7_network.get_node_by_hostname(\"ST-PROJ-C-PRV-PC-3\")\n",
"st_project_c_private_pc_3: Computer = uc7_network.get_node_by_hostname(\"ST_PROJ-C-PRV-PC-3\")\n",
"st_project_c_private_pc_3.software_manager.show()"
]
},
@@ -489,14 +489,14 @@
"| `REMOTE SITE` |`REM-PUB-PC-1`| `database-client`| *Periodic* | |**12** |**1** |**4** |**1** |**MEDIUM** |\n",
"| `REMOTE SITE` |`REM-PUB-PC-2`| `database-client`| *Periodic* | |**16** |**1** |**4** |**1** |**MEDIUM** |\n",
"| `REMOTE SITE` |`REM-PUB-PC-1`/`2`| `web-browser` | *Probabilistic* |**20%** | | | | |**LOW** |\n",
"| `ST PROJECT A`/`B`/`C` |`ST-PROJ-*-PRV-PC-1`| `database-client`| *Periodic* | |**1** |**1** |**4** |**1** |**HIGH** |\n",
"| `ST PROJECT A`/`B`/`C` |`ST-PROJ-*-PRV-PC-1`| `web-browser` | *Probabilistic* |**40%** | | | | |**LOW** |\n",
"| `ST PROJECT A`/`B`/`C` |`ST-PROJ-*-PRV-PC-2`/`3`| `database-client`| *Periodic* | |**1** |**1** |**4** |**1** |**MEDIUM** |\n",
"| `ST PROJECT A`/`B`/`C` |`ST-PROJ-*-PRV-PC-2`/`3`| `web-browser` | *Probabilistic* |**20%** | | | | |**LOW** |\n",
"| `ST PROJECT A`/`B`/`C` |`ST_PROJ-*-PRV-PC-1`| `database-client`| *Periodic* | |**1** |**1** |**4** |**1** |**HIGH** |\n",
"| `ST PROJECT A`/`B`/`C` |`ST_PROJ-*-PRV-PC-1`| `web-browser` | *Probabilistic* |**40%** | | | | |**LOW** |\n",
"| `ST PROJECT A`/`B`/`C` |`ST_PROJ-*-PRV-PC-2`/`3`| `database-client`| *Periodic* | |**1** |**1** |**4** |**1** |**MEDIUM** |\n",
"| `ST PROJECT A`/`B`/`C` |`ST_PROJ-*-PRV-PC-2`/`3`| `web-browser` | *Probabilistic* |**20%** | | | | |**LOW** |\n",
"| `ST HEAD OFFICE` |`ST-HO-PRV-PC-1`| `web-browser` | *Probabilistic* |**60%** | | | | |**HIGH** |\n",
"| `ST HEAD OFFICE` |`ST-HO-PRV-PC-2`/`3`| `web-browser` | *Probabilistic* |**60%** | | | | |**MEDIUM** |\n",
"| `ST HUMAN RESOURCES` |`ST-HR-PRV-PC-1`| `web-browser` | *Probabilistic* |**60%** | | | | |**MEDIUM** |\n",
"| `ST HUMAN RESOURCES` |`ST-HR-PRV-PC-2`/`3`| `web-browser` | *Probabilistic* |**60%** | | | | |**LOW** |\n",
"| `ST HUMAN RESOURCES` |`ST_HR-PRV-PC-1`| `web-browser` | *Probabilistic* |**60%** | | | | |**MEDIUM** |\n",
"| `ST HUMAN RESOURCES` |`ST_HR-PRV-PC-2`/`3`| `web-browser` | *Probabilistic* |**60%** | | | | |**LOW** |\n",
"\n",
"\n",
"For the full details on each green agent then please click on the drop-down menu below:\n",
@@ -547,7 +547,7 @@
"source": [
"#### AGENTS | Green *PoL* | database-client Agents Demo\n",
"\n",
"The `database-client` green agents will attempt to use their host's `database-client` application to make a simple connection to the `database-service` on the `ST-DATA-PRV-SRV-DB` host (these connections have no direct impact to the `database-service` or the `database.db` file itself).\n",
"The `database-client` green agents will attempt to use their host's `database-client` application to make a simple connection to the `database-service` on the `ST_DATA-PRV-SRV-DB` host (these connections have no direct impact to the `database-service` or the `database.db` file itself).\n",
"\n",
"Additionally, `database-client` green agents are *Periodic* meaning they will attempt to use the database based on game time-steps. Specifically, these agents will begin on the time-step given in their `start step` setting and will then will reattempt on each subsequence timestep based on the `Frequency` setting. These settings are then randomised using the remaining `Start Variance` and `Variance` options (also given in timesteps). These values are used to *±* their respective base settings to ensure the green agents achieve a moderate amount of domain randomisation in each PrimAITE episode.\n",
"\n",
@@ -632,7 +632,7 @@
"source": [
"### AGENTS | RED AGENT | Threat Actor Profile 001 (TAP001)\n",
"\n",
"This TAP aims to exfiltrate and then encrypt the `database.db` file on `ST-DATA-PRV-SRV-DB` host, whilst leaving the functionality of the database intact. Configured by default to start on the `ST-PROJ-A-PRV-PC-1` host, `TAP001` must first embed itself on the host, locate the target (`ST-DATA-PRV-SRV-DB`) through a series of NMAP scans, establish a connection to it's `C2Server` (`ISP-PUB-SRV-DNS` by default) and then finally attempt to exfiltrate and encrypt. \n",
"This TAP aims to exfiltrate and then encrypt the `database.db` file on `ST_DATA-PRV-SRV-DB` host, whilst leaving the functionality of the database intact. Configured by default to start on the `ST_PROJ-A-PRV-PC-1` host, `TAP001` must first embed itself on the host, locate the target (`ST_DATA-PRV-SRV-DB`) through a series of NMAP scans, establish a connection to it's `C2Server` (`ISP-PUB-SRV-DNS` by default) and then finally attempt to exfiltrate and encrypt. \n",
"\n",
"If successful, the blue agent is configured to receive a serve negative reward and thus must prevent `TAP001` from ever reaching the target database. This could be through blocking it's connection to the target or it's `C2Server` via a carefully crafted ACL or perhaps through more a forceful approach such as shutting down the starting host.\n",
"\n",
@@ -661,7 +661,7 @@
"outputs": [],
"source": [
"# TAP001 starting host\n",
"st_project_a_private_pc_1: Computer = env.game.simulation.network.get_node_by_hostname(\"ST-PROJ-A-PRV-PC-1\")\n",
"st_project_a_private_pc_1: Computer = env.game.simulation.network.get_node_by_hostname(\"ST_PROJ-A-PRV-PC-1\")\n",
"st_project_a_private_pc_1.software_manager.show()"
]
},
@@ -683,7 +683,7 @@
"outputs": [],
"source": [
"# Database Impact \n",
"st_data_private_server_database: Server = env.game.simulation.network.get_node_by_hostname(hostname=\"ST-DATA-PRV-SRV-DB\")\n",
"st_data_private_server_database: Server = env.game.simulation.network.get_node_by_hostname(hostname=\"ST_DATA-PRV-SRV-DB\")\n",
"st_data_private_server_database.file_system.show(full=True)"
]
},
@@ -699,8 +699,8 @@
"\n",
"|Target Router | Impact |\n",
"|----------------------|--------|\n",
"|`ST-INTRA-PRV-RT-DR-1`| Blocks all `POSTGRES_SERVER` that arrives at the `ST-INTRA-PRV-RT-DR-1` router. This rule will prevent all ST_PROJ_* hosts from accessing the database (`ST-DATA-PRV-SRV-DB`).|\n",
"|`ST-INTRA-PRV-RT-CR`| Blocks all `HTTP` traffic that arrives at the`ST-INTRA-PRV-RT-CR` router. This rule will prevent all SOME_TECH hosts from accessing the web-server (`ST-DMZ-PUB-SRV-WEB`)|\n",
"|`ST_INTRA-PRV-RT-DR-1`| Blocks all `POSTGRES_SERVER` that arrives at the `ST_INTRA-PRV-RT-DR-1` router. This rule will prevent all ST_PROJ_* hosts from accessing the database (`ST_DATA-PRV-SRV-DB`).|\n",
"|`ST_INTRA-PRV-RT-CR`| Blocks all `HTTP` traffic that arrives at the`ST_INTRA-PRV-RT-CR` router. This rule will prevent all SOME_TECH hosts from accessing the web-server (`ST-DMZ-PUB-SRV-WEB`)|\n",
"|`REM-PUB-RT-DR`| Blocks all `DNS` traffic that arrives at the `REM-PUB-RT-DR` router. This rule prevents any remote site works from accessing the DNS Server (`ISP-PUB-SRV-DNS`).|\n",
"\n",
"Lastly, it's highly recommended that users refer to the [TAP003 E2E notebook](./UC7-TAP003-Kill-Chain-E2E.ipynb) for further information or for the [UC7 attack variants notebook](./UC7-attack-variants.ipynb) demonstration of TAP003 defence."
@@ -743,7 +743,7 @@
"metadata": {},
"outputs": [],
"source": [
"env.game.simulation.network.get_node_by_hostname(\"ST-INTRA-PRV-RT-DR-1\").acl.show()"
"env.game.simulation.network.get_node_by_hostname(\"ST_INTRA-PRV-RT-DR-1\").acl.show()"
]
},
{
@@ -752,7 +752,7 @@
"metadata": {},
"outputs": [],
"source": [
"env.game.simulation.network.get_node_by_hostname(\"ST-INTRA-PRV-RT-CR\").acl.show()"
"env.game.simulation.network.get_node_by_hostname(\"ST_INTRA-PRV-RT-CR\").acl.show()"
]
},
{
@@ -861,34 +861,34 @@
"|10|REM-PUB-SW-AS:eth-2|REM-PUB-PC-1:eth-1 |\n",
"|11|REM-PUB-SW-AS:eth-3|REM-PUB-PC-2:eth-1 | \n",
"|12|REM-PUB-SW-AS:eth-4|REM-PUB-SRV:eth-1 |\n",
"|13|ISP-PUB-RT-BR:eth-4|ST-PUB-FW:eth-1 |\n",
"|14|ST-PUB-FW:eth-3|ST-DMZ-PUB-SRV-WEB:eth-1 |\n",
"|15|ST-INTRA-PRV-RT-CR:eth-1|ST-PUB-FW:eth-2 |\n",
"|16|ST-INTRA-PRV-RT-CR:eth-2|ST-INTRA-PRV-RT-DR-1:eth-1 |\n",
"|17|ST-INTRA-PRV-RT-CR:eth-3|ST-INTRA-PRV-RT-DR-2:eth-1 | \n",
"|18|ST-INTRA-PRV-RT-CR:eth-4|ST-DATA-PRV-SW-AS:eth-1 |\n",
"|19|ST-HO-PRV-SW-AS:eth-1|ST-INTRA-PRV-RT-DR-2:eth-2 |\n",
"|20|ST-HO-PRV-SW-AS:eth-2|ST-HO-PRV-PC-1:eth-1 |\n",
"|21|ST-HO-PRV-SW-AS:eth-3|ST-HO-PRV-PC-2:eth-1 |\n",
"|22|ST-HO-PRV-SW-AS:eth-4|ST-HO-PRV-PC-3:eth-1 |\n",
"|23|ST-HR-PRV-SW-AS:eth-1|ST-INTRA-PRV-RT-DR-2:eth-3 |\n",
"|24|ST-HR-PRV-SW-AS:eth-2|ST-HR-PRV-PC-1:eth-1 |\n",
"|25|ST-HR-PRV-SW-AS:eth-3|ST-HR-PRV-PC-2:eth-1 |\n",
"|26|ST-HR-PRV-SW-AS:eth-4|ST-HR-PRV-PC-3:eth-1 |\n",
"|27|ST-DATA-PRV-SW-AS:eth-2|ST-DATA-PRV-SRV-STORAGE:eth-1 |\n",
"|28|ST-DATA-PRV-SW-AS:eth-3|ST-DATA-PRV-SRV-DB:eth-1 | \n",
"|29|ST-INTRA-PRV-RT-DR-1:eth-2|ST-PROJ-A-PRV-SW-AS:eth-1 |\n",
"|30|ST-PROJ-A-PRV-SW-AS:eth2|ST-PROJ-A-PRV-PC-1:eth-1|\n",
"|31|ST-PROJ-A-PRV-SW-AS:eth3|ST-PROJ-A-PRV-PC-2:eth-1 |\n",
"|32|ST-PROJ-A-PRV-SW-AS:eth4|ST-PROJ-A-PRV-PC-3:eth-1 | \n",
"|33|ST-INTRA-PRV-RT-DR-1:eth-3|ST-PROJ-B-PRV-SW-AS:eth-1 |\n",
"|34|ST-PROJ-B-PRV-SW-AS:eth2|ST-PROJ-B-PRV-PC-1:eth-1 |\n",
"|35|ST-PROJ-B-PRV-SW-AS:eth3|ST-PROJ-B-PRV-PC-2:eth-1 |\n",
"|36|ST-PROJ-B-PRV-SW-AS:eth4|ST-PROJ-B-PRV-PC-3:eth-1 | \n",
"|37|ST-INTRA-PRV-RT-DR-1:eth-4|ST-PROJ-C-PRV-SW-AS:eth-1 |\n",
"|38|ST-PROJ-A-PRV-SW-AS:eth2|ST-PROJ-C-PRV-PC-1:eth-1 |\n",
"|39|ST-PROJ-A-PRV-SW-AS:eth3|ST-PROJ-C-PRV-PC-2:eth-1 |\n",
"|40|ST-PROJ-A-PRV-SW-AS:eth4|ST-PROJ-C-PRV-PC-3:eth-1 |\n",
"|13|ISP-PUB-RT-BR:eth-4|ST_PUB-FW:eth-1 |\n",
"|14|ST_PUB-FW:eth-3|ST_DMZ-PUB-SRV-WEB:eth-1 |\n",
"|15|ST_INTRA-PRV-RT-CR:eth-1|ST_PUB-FW:eth-2 |\n",
"|16|ST_INTRA-PRV-RT-CR:eth-2|ST_INTRA-PRV-RT-DR-1:eth-1 |\n",
"|17|ST_INTRA-PRV-RT-CR:eth-3|ST_INTRA-PRV-RT-DR-2:eth-1 | \n",
"|18|ST_INTRA-PRV-RT-CR:eth-4|ST_DATA-PRV-SW-AS:eth-1 |\n",
"|19|ST_HO-PRV-SW-AS:eth-1|ST_INTRA-PRV-RT-DR-2:eth-2 |\n",
"|20|ST_HO-PRV-SW-AS:eth-2|ST_HO-PRV-PC-1:eth-1 |\n",
"|21|ST_HO-PRV-SW-AS:eth-3|ST_HO-PRV-PC-2:eth-1 |\n",
"|22|ST_HO-PRV-SW-AS:eth-4|ST_HO-PRV-PC-3:eth-1 |\n",
"|23|ST_HR-PRV-SW-AS:eth-1|ST_INTRA-PRV-RT-DR-2:eth-3 |\n",
"|24|ST_HR-PRV-SW-AS:eth-2|ST_HR-PRV-PC-1:eth-1 |\n",
"|25|ST_HR-PRV-SW-AS:eth-3|ST_HR-PRV-PC-2:eth-1 |\n",
"|26|ST_HR-PRV-SW-AS:eth-4|ST_HR-PRV-PC-3:eth-1 |\n",
"|27|ST_DATA-PRV-SW-AS:eth-2|ST_DATA-PRV-SRV-STORAGE:eth-1 |\n",
"|28|ST_DATA-PRV-SW-AS:eth-3|ST_DATA-PRV-SRV-DB:eth-1 | \n",
"|29|ST_INTRA-PRV-RT-DR-1:eth-2|ST_PROJ-A-PRV-SW-AS:eth-1 |\n",
"|30|ST_PROJ-A-PRV-SW-AS:eth2|ST_PROJ-A-PRV-PC-1:eth-1|\n",
"|31|ST_PROJ-A-PRV-SW-AS:eth3|ST_PROJ-A-PRV-PC-2:eth-1 |\n",
"|32|ST_PROJ-A-PRV-SW-AS:eth4|ST_PROJ-A-PRV-PC-3:eth-1 | \n",
"|33|ST_INTRA-PRV-RT-DR-1:eth-3|ST_PROJ-B-PRV-SW-AS:eth-1 |\n",
"|34|ST_PROJ-B-PRV-SW-AS:eth2|ST_PROJ-B-PRV-PC-1:eth-1 |\n",
"|35|ST_PROJ-B-PRV-SW-AS:eth3|ST_PROJ-B-PRV-PC-2:eth-1 |\n",
"|36|ST_PROJ-B-PRV-SW-AS:eth4|ST_PROJ-B-PRV-PC-3:eth-1 | \n",
"|37|ST_INTRA-PRV-RT-DR-1:eth-4|ST_PROJ-C-PRV-SW-AS:eth-1 |\n",
"|38|ST_PROJ-A-PRV-SW-AS:eth2|ST_PROJ-C-PRV-PC-1:eth-1 |\n",
"|39|ST_PROJ-A-PRV-SW-AS:eth3|ST_PROJ-C-PRV-PC-2:eth-1 |\n",
"|40|ST_PROJ-A-PRV-SW-AS:eth4|ST_PROJ-C-PRV-PC-3:eth-1 |\n",
"\n",
"</details>"
]
@@ -923,10 +923,10 @@
"\n",
"|Host label|hostname| services | applications | folders | files |\n",
"|:--:|:--:|:--:|:--:|:--:|:--:|\n",
"|HOST1|ST-PROJ-A-PRV-PC-1 | ftp-client | ransomware_script, database-client | downloads, exfiltration_folder | malware_dropper.ps1, database.db |\n",
"|HOST2|ST-PROJ-B-PRV-PC-2| ftp-client | ransomware-script, database-client | downloads, exfiltration_folder | malware_dropper.ps1, database.db |\n",
"|HOST3|ST-PROJ-C-PRV-PC-3| ftp-client | ransomware-script, database-client | downloads, exfiltration_folder | malware_dropper.ps1, database.db |\n",
"|HOST4|ST-DATA-PRV-SRV-DB||| database | database.db|\n",
"|HOST1|ST_PROJ-A-PRV-PC-1 | ftp-client | ransomware_script, database-client | downloads, exfiltration_folder | malware_dropper.ps1, database.db |\n",
"|HOST2|ST_PROJ-B-PRV-PC-2| ftp-client | ransomware-script, database-client | downloads, exfiltration_folder | malware_dropper.ps1, database.db |\n",
"|HOST3|ST_PROJ-C-PRV-PC-3| ftp-client | ransomware-script, database-client | downloads, exfiltration_folder | malware_dropper.ps1, database.db |\n",
"|HOST4|ST_DATA-PRV-SRV-DB||| database | database.db|\n",
"\n",
"\n",
"Each `time_step` these hosts report the following to the blue agent:\n",
@@ -1109,8 +1109,8 @@
"\n",
"by default, the UC7 agent is configured to observe `3` different routers:\n",
"\n",
"- `ST-INTRA-PRV-RT-CR`\n",
"- `ST-INTRA-PRV-RT-DR-1`\n",
"- `ST_INTRA-PRV-RT-CR`\n",
"- `ST_INTRA-PRV-RT-DR-1`\n",
"- `REM-PUB-RT-DR`\n"
]
},
@@ -1152,14 +1152,14 @@
"|6|192.168.20.3 | REM-PUB-PC-2 |\n",
"|7|192.168.20.4 | REM-PUB-SRV |\n",
"|8|192.168.100.2| ST_PUB_SRV_WEB_IP |\n",
"|9|192.168.200.2 | ST-HO-PRV-PC-1 |\n",
"|10|192.168.200.3 | ST-HO-PRV-PC-2 |\n",
"|11|192.168.200.4 | ST-HO-PRV-PC-3 |\n",
"|12|192.168.210.2 | ST-HR-PRV-PC-1 |\n",
"|13|192.168.210.3 | ST-HR-PRV-PC-2 |\n",
"|14|192.168.210.4 | ST-HR-PRV-PC-3 |\n",
"|15|192.168.220.2 | ST-DATA-PRV-SRV-STORAGE | \n",
"|16|192.168.220.3 | ST-DATA-PRV-SRV-DB |\n",
"|9|192.168.200.2 | ST_HO-PRV-PC-1 |\n",
"|10|192.168.200.3 | ST_HO-PRV-PC-2 |\n",
"|11|192.168.200.4 | ST_HO-PRV-PC-3 |\n",
"|12|192.168.210.2 | ST_HR-PRV-PC-1 |\n",
"|13|192.168.210.3 | ST_HR-PRV-PC-2 |\n",
"|14|192.168.210.4 | ST_HR-PRV-PC-3 |\n",
"|15|192.168.220.2 | ST_DATA-PRV-SRV-STORAGE | \n",
"|16|192.168.220.3 | ST_DATA-PRV-SRV-DB |\n",
"|17|192.168.230.2 | PROJ-A-PRV-PC-1 |\n",
"|18|192.168.230.3 | PROJ-A-PRV-PC-2 |\n",
"|19|192.168.230.4 | PROJ-A-PRV-PC-3 |\n",
@@ -1261,24 +1261,24 @@
" options: {}\n",
"\n",
" # |======================================|\n",
" # | ST-PROJ-A-PRV-PC-1 |\n",
" # | ST_PROJ-A-PRV-PC-1 |\n",
" # |======================================|\n",
"\n",
" # ST-PROJ-A-PRV-PC-1 | node-os-scan\n",
" # ST_PROJ-A-PRV-PC-1 | node-os-scan\n",
" 1:\n",
" action: node-os-scan\n",
" options:\n",
" node_name: ST-PROJ-A-PRV-PC-1\n",
" # ST-PROJ-A-PRV-PC-1 | node-shutdown\n",
" node_name: ST_PROJ-A-PRV-PC-1\n",
" # ST_PROJ-A-PRV-PC-1 | node-shutdown\n",
" 2:\n",
" action: node-shutdown\n",
" options:\n",
" node_name: ST-PROJ-A-PRV-PC-1\n",
" # ST-PROJ-A-PRV-PC-1 | node-startup\n",
" node_name: ST_PROJ-A-PRV-PC-1\n",
" # ST_PROJ-A-PRV-PC-1 | node-startup\n",
" 3:\n",
" action: node-startup\n",
" options:\n",
" node_name: ST-PROJ-A-PRV-PC-1\n",
" node_name: ST_PROJ-A-PRV-PC-1\n",
"```\n",
"\n",
"Converting the yaml snippet below we end up with the following:\n",
@@ -1286,9 +1286,9 @@
"|Action Num | Action Type | Options|\n",
"|:---------:|:-----------:|:------:|\n",
"|0|**DONOTHING**|*n/a*|\n",
"|1|**NODE_OS_SCAN**|*node_name: ST-PROJ-A-PRV-PC-1*|\n",
"|2|**NODE_SHUTDOWN**|*node_name: ST-PROJ-A-PRV-PC-1*|\n",
"|3|**NODE_STARTUP**|*node_name: ST-PROJ-A-PRV-PC-1*|\n"
"|1|**NODE_OS_SCAN**|*node_name: ST_PROJ-A-PRV-PC-1*|\n",
"|2|**NODE_SHUTDOWN**|*node_name: ST_PROJ-A-PRV-PC-1*|\n",
"|3|**NODE_STARTUP**|*node_name: ST_PROJ-A-PRV-PC-1*|\n"
]
},
{
@@ -1332,7 +1332,7 @@
"\n",
"For example, if a red agent corrupts and alters the health status of a file, the blue agent's observation space will not reflect this until the agent performs a `NODE_FILE_SCAN` on the newly corrupted file. It's worth noting that blue agents can be configured to see the true `HEALTH_STATUS` of software and files without needing to scan in the yaml. Although this may make it easier for an train and create an effective blue agent it could be seen as reducing the fidelity of the simulation.\n",
"\n",
"The code snippet below demonstrates an example where the blue agent uses the `NODE_OS_SCAN` action to reveal the true health status `ST-PROJ-A-PRV-PC-1`."
"The code snippet below demonstrates an example where the blue agent uses the `NODE_OS_SCAN` action to reveal the true health status `ST_PROJ-A-PRV-PC-1`."
]
},
{
@@ -1353,7 +1353,7 @@
"metadata": {},
"outputs": [],
"source": [
"st_project_a_private_pc_1: Computer = env.game.simulation.network.get_node_by_hostname(\"ST-PROJ-A-PRV-PC-1\")\n",
"st_project_a_private_pc_1: Computer = env.game.simulation.network.get_node_by_hostname(\"ST_PROJ-A-PRV-PC-1\")\n",
"st_project_a_private_pc_1.software_manager.software[\"ftp-client\"].set_health_state(SoftwareHealthState.COMPROMISED)\n",
"st_project_a_private_pc_1.software_manager.software[\"database-client\"].set_health_state(SoftwareHealthState.COMPROMISED)\n",
"st_project_a_private_pc_1.software_manager.show()"
@@ -1388,7 +1388,7 @@
"source": [
"`2: NODE_SHUTDOWN`:\n",
"\n",
"The next action available is the `NODE_SHUTDOWN` action. This action quite is quite simple in comparison and literally attempts to shut down the target host given in the `options` settings which is set to `ST-PROJ-A-PRV-PC-1`. Shutting a PC down affects the `operating_status` of the host machine which the following snippets demonstrate."
"The next action available is the `NODE_SHUTDOWN` action. This action quite is quite simple in comparison and literally attempts to shut down the target host given in the `options` settings which is set to `ST_PROJ-A-PRV-PC-1`. Shutting a PC down affects the `operating_status` of the host machine which the following snippets demonstrate."
]
},
{
@@ -1399,7 +1399,7 @@
"source": [
"# `1` is equal to 'ON' in this case.\n",
"obs, reward, term, trunc, info = env.step(0)\n",
"print(f\"ST-PROJ-A-PRV-PC-1's (prior shutdown) operating state: {defender.observation_manager.current_observation['NODES']['HOST0']['operating_status']}\")"
"print(f\"ST_PROJ-A-PRV-PC-1's (prior shutdown) operating state: {defender.observation_manager.current_observation['NODES']['HOST0']['operating_status']}\")"
]
},
{
@@ -1420,7 +1420,7 @@
"outputs": [],
"source": [
"obs, reward, term, trunc, info = env.step(0)\n",
"print(f\"ST-PROJ-A-PRV-PC-1's (post shutdown) operating state: {defender.observation_manager.current_observation['NODES']['HOST0']['operating_status']}\")"
"print(f\"ST_PROJ-A-PRV-PC-1's (post shutdown) operating state: {defender.observation_manager.current_observation['NODES']['HOST0']['operating_status']}\")"
]
},
{
@@ -1429,7 +1429,7 @@
"source": [
"`3: NODE_STARTUP`:\n",
"\n",
"Luckily, the blue agent can use it's third action `NODE_STARTUP` has been configured to bring the `ST-PROJ-A-PRV-PC-1` back up and running. Although, with the a three timestep reboot time.\n"
"Luckily, the blue agent can use it's third action `NODE_STARTUP` has been configured to bring the `ST_PROJ-A-PRV-PC-1` back up and running. Although, with the a three timestep reboot time.\n"
]
},
{
@@ -1444,7 +1444,7 @@
" env.step(0) # 3 second reboot time.\n",
" \n",
"obs, reward, term, trunc, info = env.step(0)\n",
"print(f\"ST-PROJ-A-PRV-PC-1's (prior shutdown) operating state: {defender.observation_manager.current_observation['NODES']['HOST0']['operating_status']}\")"
"print(f\"ST_PROJ-A-PRV-PC-1's (prior shutdown) operating state: {defender.observation_manager.current_observation['NODES']['HOST0']['operating_status']}\")"
]
},
{
@@ -1463,7 +1463,7 @@
" - type: DATABASE_FILE_INTEGRITY\n",
" weight: *HIGH_WEIGHT_IMPACT\n",
" options: \n",
" node_hostname: ST-DATA-PRV-SRV-DB \n",
" node_hostname: ST_DATA-PRV-SRV-DB \n",
" folder_name: database\n",
" file_name: database.db\n",
"```\n",
@@ -1576,14 +1576,14 @@
"defender = env.game.rl_agents.get(\"defender\")\n",
"\n",
"# Corrupting and Disabling the database-service\n",
"st_data_private_server_database: Server = env.game.simulation.network.get_node_by_hostname(\"ST-DATA-PRV-SRV-DB\")\n",
"st_data_private_server_database: Server = env.game.simulation.network.get_node_by_hostname(\"ST_DATA-PRV-SRV-DB\")\n",
"st_data_private_server_database_file = st_data_private_server_database.file_system.get_file(folder_name=\"database\", file_name=\"database.db\")\n",
"st_data_private_server_database_file.health_status = FileSystemItemHealthStatus.COMPROMISED\n",
"st_data_private_server_database.software_manager.software[\"database-service\"].operating_state = ServiceOperatingState.DISABLED\n",
"\n",
"# Shutting down the web-server\n",
"\n",
"st_dmz_pub_srv_web: Server = env.game.simulation.network.get_node_by_hostname(\"ST-DMZ-PUB-SRV-WEB\")\n",
"st_dmz_pub_srv_web: Server = env.game.simulation.network.get_node_by_hostname(\"ST_DMZ-PUB-SRV-WEB\")\n",
"st_dmz_pub_srv_web.software_manager.software[\"web-server\"].operating_state = ServiceOperatingState.DISABLED\n",
"\n",
"# Shutting down the DNSServer\n",

52
src/primaite/notebooks/UC7-TAP001-Kill-Chain-E2E.ipynb
View File

@@ -187,10 +187,10 @@
"# The TAP001 Agent\n",
"tap001 = env.game.agents.get(\"attacker\")\n",
"# A potential starting client\n",
"starting_host = env.game.simulation.network.get_node_by_hostname('ST-PROJ-A-PRV-PC-1')\n",
"starting_host = env.game.simulation.network.get_node_by_hostname('ST_PROJ-A-PRV-PC-1')\n",
"\n",
"# The database server which acts as the initial target of the ransomware kill-chain\n",
"database_server = env.game.simulation.network.get_node_by_hostname('ST-DATA-PRV-SRV-DB')"
"database_server = env.game.simulation.network.get_node_by_hostname('ST_DATA-PRV-SRV-DB')"
]
},
{
@@ -240,7 +240,7 @@
"source": [
"#### **Initial State** | Database Server:\n",
"\n",
"TAP001 opts to attack the UC7 database server (`ST-DATA-PRV-SRV-DB`):"
"TAP001 opts to attack the UC7 database server (`ST_DATA-PRV-SRV-DB`):"
]
},
{
@@ -282,7 +282,7 @@
"# The TAP001's Starting Client:\n",
"starting_host = env.game.simulation.network.get_node_by_hostname(tap001.starting_node)\n",
"# The TAP001's Database Server:\n",
"target_host = env.game.simulation.network.get_node_by_hostname('ST-DATA-PRV-SRV-DB')"
"target_host = env.game.simulation.network.get_node_by_hostname('ST_DATA-PRV-SRV-DB')"
]
},
{
@@ -318,8 +318,8 @@
"In this stage, TAP001 uses the **NODE_FOLDER_CREATE** and **NODE_FILE_CREATE** to create a file called ```\"malware_dropper.ps1\"``` within a ```\"Downloads\"``` folder. <br>\n",
"These actions are intended to simulate the malicious payload creating a ```ps1``` (A windows powershell script) malware dropper on the `SOME_TECH` employee's phone. \n",
"\n",
"Currently, PrimAITE cannot simulate hosts joining the simulation mid-episode thus we must treat `ST-PROJ-A-PRV-PC-1`'s as also including the employee's phone. <br>\n",
"From a narrative perspective, this could be explained as the employee plugging his phone into the `ST-PROJ-A-PRV-PC-1`.\n",
"Currently, PrimAITE cannot simulate hosts joining the simulation mid-episode thus we must treat `ST_PROJ-A-PRV-PC-1`'s as also including the employee's phone. <br>\n",
"From a narrative perspective, this could be explained as the employee plugging his phone into the `ST_PROJ-A-PRV-PC-1`.\n",
"\n",
"Additionally, it's worth noting that in the real world, malware droppers (small scripts or executables which download/install the malware after initially entering a host) use a variety of obfuscation methods to avoid detection. <br> For example, some malware droppers are concealed within legitimate files such as word document macros in order to trick a user into running the dropper.\n",
"\n",
@@ -465,7 +465,7 @@
"In this stage, TAP001 uses **NODE_NMAP_PORT_SCAN**, **NODE_NMAP_PING_SCAN** and **NODE_NMAP_NETWORK_SERVICE_RECON** to scan the simulation in order to search for a valid database target.\n",
"\n",
"Unlike previous stages, the behaviour of this stage is dependant on the simulation and thus will perform differently dependant on the location of the target as well as the topology of the network. Specifically, the ```PROPAGATE``` stage uses three network enumeration actions and their action responses to populate its knowledge of the network.<br>\n",
"These actions represent the now infected `ST-PROJ-A-PRV-PC-1` searching the UC7 network for valid targets ransomware. \n",
"These actions represent the now infected `ST_PROJ-A-PRV-PC-1` searching the UC7 network for valid targets ransomware. \n",
"\n",
"For more information around how agent requests and responses work then the [request-response notebook can provide some useful insights](./Requests-and-Responses.ipynb).\n",
"\n",
@@ -528,7 +528,7 @@
"cell_type": "markdown",
"metadata": {},
"source": [
"#### **Kill Chain** | PROPAGATE | ST-PROJ-A-PRV-PC-1\n",
"#### **Kill Chain** | PROPAGATE | ST_PROJ-A-PRV-PC-1\n",
"\n",
"<p align=\"center\">\n",
" <a href=\"./_package_data/uc7/uc7_tap001/uc7_tap001_propagate_1.png\" target=\"_blank\">\n",
@@ -884,11 +884,11 @@
"We can use the blue agent's NODE_FILE_SCAN action to scan the database file:\n",
"\n",
"```yaml\n",
"# ST-DATA-PRV-SRV-DB | node-file-scan | Scans the database.db file (health status)\n",
"# ST_DATA-PRV-SRV-DB | node-file-scan | Scans the database.db file (health status)\n",
"49:\n",
" action: node-file-scan\n",
" options:\n",
" node_name: ST-DATA-PRV-SRV-DB\n",
" node_name: ST_DATA-PRV-SRV-DB\n",
" folder_name: database\n",
" file_name: database.db\n",
"```\n",
@@ -1001,8 +1001,8 @@
" repeat_kill_chain: false\n",
" repeat_kill_chain_stages: true\n",
" default_target_ip: *ST_SRV_DB_IP\n",
" default_starting_node: \"ST-PROJ-A-PRV-PC-1\"\n",
" # starting_nodes: [\"ST-PROJ-A-PRV-PC-1\", \"ST-PROJ-B-PRV-PC-2\", \"ST-PROJ-C-PRV-PC-3\"]\n",
" default_starting_node: \"ST_PROJ-A-PRV-PC-1\"\n",
" # starting_nodes: [\"ST_PROJ-A-PRV-PC-1\", \"ST_PROJ-B-PRV-PC-2\", \"ST_PROJ-C-PRV-PC-3\"]\n",
" kill_chain:\n",
" ... # Next notebook section will cover this configuration option\n",
"\n",
@@ -1364,7 +1364,7 @@
"metadata": {},
"outputs": [],
"source": [
"starting_host = env.game.simulation.network.get_node_by_hostname('ST-PROJ-A-PRV-PC-1')\n",
"starting_host = env.game.simulation.network.get_node_by_hostname('ST_PROJ-A-PRV-PC-1')\n",
"c2_beacon = starting_host.software_manager.software[\"c2-beacon\"]\n",
"c2_beacon.show()"
]
@@ -1507,8 +1507,8 @@
"metadata": {},
"outputs": [],
"source": [
"starting_host = env.game.simulation.network.get_node_by_hostname('ST-PROJ-A-PRV-PC-1')\n",
"target_host = env.game.simulation.network.get_node_by_hostname('ST-DATA-PRV-SRV-DB')\n",
"starting_host = env.game.simulation.network.get_node_by_hostname('ST_PROJ-A-PRV-PC-1')\n",
"target_host = env.game.simulation.network.get_node_by_hostname('ST_DATA-PRV-SRV-DB')\n",
"target_host.file_system.show(full=True)\n",
"starting_host.file_system.show(full=True)"
]
@@ -1535,8 +1535,8 @@
"metadata": {},
"outputs": [],
"source": [
"starting_host = env.game.simulation.network.get_node_by_hostname('ST-PROJ-A-PRV-PC-1')\n",
"target_host = env.game.simulation.network.get_node_by_hostname('ST-DATA-PRV-SRV-DB')\n",
"starting_host = env.game.simulation.network.get_node_by_hostname('ST_PROJ-A-PRV-PC-1')\n",
"target_host = env.game.simulation.network.get_node_by_hostname('ST_DATA-PRV-SRV-DB')\n",
"target_host.file_system.show(full=True)\n",
"starting_host.file_system.show(full=True)"
]
@@ -1563,8 +1563,8 @@
"metadata": {},
"outputs": [],
"source": [
"starting_host = env.game.simulation.network.get_node_by_hostname('ST-PROJ-A-PRV-PC-1')\n",
"target_host = env.game.simulation.network.get_node_by_hostname('ST-DATA-PRV-SRV-DB')\n",
"starting_host = env.game.simulation.network.get_node_by_hostname('ST_PROJ-A-PRV-PC-1')\n",
"target_host = env.game.simulation.network.get_node_by_hostname('ST_DATA-PRV-SRV-DB')\n",
"target_host.file_system.show(full=True)\n",
"starting_host.file_system.show(full=True)"
]
@@ -1625,8 +1625,8 @@
"metadata": {},
"outputs": [],
"source": [
"starting_host = env.game.simulation.network.get_node_by_hostname('ST-PROJ-A-PRV-PC-1')\n",
"target_host = env.game.simulation.network.get_node_by_hostname('ST-DATA-PRV-SRV-DB')\n",
"starting_host = env.game.simulation.network.get_node_by_hostname('ST_PROJ-A-PRV-PC-1')\n",
"target_host = env.game.simulation.network.get_node_by_hostname('ST_DATA-PRV-SRV-DB')\n",
"target_host.file_system.show(full=True)\n",
"starting_host.file_system.show(full=True)"
]
@@ -1676,7 +1676,7 @@
"metadata": {},
"outputs": [],
"source": [
"target_host = env.game.simulation.network.get_node_by_hostname('ST-DATA-PRV-SRV-DB')\n",
"target_host = env.game.simulation.network.get_node_by_hostname('ST_DATA-PRV-SRV-DB')\n",
"target_host.user_manager.show()\n",
"target_host.file_system.show()\n",
"tap001.logger.show()"
@@ -1699,11 +1699,11 @@
"The code cells below demonstrate the differences by using the blue agent to change the user account details on the target database before the exfiltration occurs using action 50\n",
"\n",
"```yaml\n",
" # ST-DATA-PRV-SRV-DB | node-account-change-password | Changes the password of a user account\n",
" # ST_DATA-PRV-SRV-DB | node-account-change-password | Changes the password of a user account\n",
" 50:\n",
" action: node-account-change-password\n",
" options:\n",
" node_name: ST-DATA-PRV-SRV-DB\n",
" node_name: ST_DATA-PRV-SRV-DB\n",
" username: admin # default account\n",
" current_password: admin # default password\n",
" new_password: thr33_alert_wolv3z # A more 'secure' password\n",
@@ -1760,7 +1760,7 @@
"source": [
"# Yet the target database.db is still corrupt.\n",
"\n",
"target_host = env.game.simulation.network.get_node_by_hostname('ST-DATA-PRV-SRV-DB')\n",
"target_host = env.game.simulation.network.get_node_by_hostname('ST_DATA-PRV-SRV-DB')\n",
"target_host.file_system.show()"
]
},
@@ -1814,7 +1814,7 @@
"source": [
"# And the target database.db remains healthy.\n",
"\n",
"target_host = env.game.simulation.network.get_node_by_hostname('ST-DATA-PRV-SRV-DB')\n",
"target_host = env.game.simulation.network.get_node_by_hostname('ST_DATA-PRV-SRV-DB')\n",
"target_host.file_system.show()"
]
}

110
src/primaite/notebooks/UC7-TAP003-Kill-Chain-E2E.ipynb
View File

@@ -292,8 +292,8 @@
"source": [
"# TAP003's target routers\n",
"\n",
"st_intra_prv_rt_cr: Router = env.game.simulation.network.get_node_by_hostname(\"ST-INTRA-PRV-RT-CR\")\n",
"st_intra_prv_rt_dr_1: Router = env.game.simulation.network.get_node_by_hostname(\"ST-INTRA-PRV-RT-DR-1\")\n",
"st_intra_prv_rt_cr: Router = env.game.simulation.network.get_node_by_hostname(\"ST_INTRA-PRV-RT-CR\")\n",
"st_intra_prv_rt_dr_1: Router = env.game.simulation.network.get_node_by_hostname(\"ST_INTRA-PRV-RT-DR-1\")\n",
"rem_pub_rt_dr: Router = env.game.simulation.network.get_node_by_hostname(\"REM-PUB-RT-DR\")\n",
"\n",
"st_intra_prv_rt_cr.acl.show()\n",
@@ -321,28 +321,28 @@
" variance: 0\n",
" repeat_kill_chain: false\n",
" repeat_kill_chain_stages: true\n",
" default_starting_node: \"ST-PROJ-A-PRV-PC-1\"\n",
" default_starting_node: \"ST_PROJ-A-PRV-PC-1\"\n",
" starting_nodes:\n",
" # starting_nodes: [\"ST-PROJ-A-PRV-PC-1\", \"ST-PROJ-B-PRV-PC-2\", \"ST-PROJ-C-PRV-PC-3\"]\n",
" # starting_nodes: [\"ST_PROJ-A-PRV-PC-1\", \"ST_PROJ-B-PRV-PC-2\", \"ST_PROJ-C-PRV-PC-3\"]\n",
" kill_chain:\n",
" PLANNING:\n",
" probability: 1\n",
" starting_network_knowledge:\n",
" credentials:\n",
" ST-PROJ-A-PRV-PC-1:\n",
" ST_PROJ-A-PRV-PC-1:\n",
" username: admin\n",
" password: admin\n",
" ST-PROJ-B-PRV-PC-2:\n",
" ST_PROJ-B-PRV-PC-2:\n",
" username: admin\n",
" password: admin\n",
" ST-PROJ-C-PRV-PC-3:\n",
" ST_PROJ-C-PRV-PC-3:\n",
" username: admin\n",
" password: admin\n",
" ST-INTRA-PRV-RT-DR-1:\n",
" ST_INTRA-PRV-RT-DR-1:\n",
" ip_address: 192.168.230.1\n",
" username: admin\n",
" password: admin\n",
" ST-INTRA-PRV-RT-CR:\n",
" ST_INTRA-PRV-RT-CR:\n",
" ip_address: 192.168.160.1\n",
" username: admin\n",
" password: admin\n",
@@ -355,13 +355,13 @@
" MANIPULATION:\n",
" probability: 1\n",
" account_changes:\n",
" - host: ST-INTRA-PRV-RT-DR-1\n",
" ip_address: 192.168.230.1 # ST-INTRA-PRV-RT-DR-1\n",
" - host: ST_INTRA-PRV-RT-DR-1\n",
" ip_address: 192.168.230.1 # ST_INTRA-PRV-RT-DR-1\n",
" action: change_password\n",
" username: admin\n",
" new_password: \"red_pass\"\n",
" - host: ST-INTRA-PRV-RT-CR\n",
" ip_address: 192.168.160.1 # ST-INTRA-PRV-RT-CR\n",
" - host: ST_INTRA-PRV-RT-CR\n",
" ip_address: 192.168.160.1 # ST_INTRA-PRV-RT-CR\n",
" action: change_password\n",
" username: \"admin\"\n",
" new_password: \"red_pass\"\n",
@@ -373,7 +373,7 @@
" EXPLOIT:\n",
" probability: 1\n",
" malicious_acls:\n",
" - target_router: ST-INTRA-PRV-RT-DR-1\n",
" - target_router: ST_INTRA-PRV-RT-DR-1\n",
" position: 1\n",
" permission: DENY\n",
" src_ip: ALL\n",
@@ -383,7 +383,7 @@
" src_port: POSTGRES_SERVER\n",
" dst_port: POSTGRES_SERVER\n",
" protocol_name_name: TCP\n",
" - target_router: ST-INTRA-PRV-RT-CR\n",
" - target_router: ST_INTRA-PRV-RT-CR\n",
" position: 1\n",
" permission: DENY\n",
" src_ip: ALL\n",
@@ -654,8 +654,8 @@
"\n",
"|Target Router | Impact |\n",
"|----------------------|--------|\n",
"|`ST-INTRA-PRV-RT-DR-1`| Blocks all `POSTGRES_SERVER` that arrives at the `ST-INTRA-PRV-RT-DR-1` router. This rule will prevent all ST_PROJ_* hosts from accessing the database (`ST-DATA-PRV-SRV-DB`).|\n",
"|`ST-INTRA-PRV-RT-CR`| Blocks all `HTTP` traffic that arrives at the`ST-INTRA-PRV-RT-CR` router. This rule will prevent all SOME_TECH hosts from accessing the webserver (`ST-DMZ-PUB-SRV-WEB`)|\n",
"|`ST_INTRA-PRV-RT-DR-1`| Blocks all `POSTGRES_SERVER` that arrives at the `ST_INTRA-PRV-RT-DR-1` router. This rule will prevent all ST_PROJ_* hosts from accessing the database (`ST_DATA-PRV-SRV-DB`).|\n",
"|`ST_INTRA-PRV-RT-CR`| Blocks all `HTTP` traffic that arrives at the`ST_INTRA-PRV-RT-CR` router. This rule will prevent all SOME_TECH hosts from accessing the webserver (`ST_DMZ-PUB-SRV-WEB`)|\n",
"|`REM-PUB-RT-DR`| Blocks all `DNS` traffic that arrives at the `REM-PUB-RT-DR` router. This rule prevents any remote site works from accessing the DNS Server (`ISP-PUB-SRV-DNS`).|\n",
"\n",
"\n",
@@ -716,7 +716,7 @@
"source": [
"#### Demonstration of the ACL Rule blocking traffic\n",
"\n",
"As an example of the malicious ACL Rule affecting traffic across the network, attempting to query the database server (ST-DATA-PRV-SRV-DB) from any of the `ST_PROJECT_*` networks should fail because it is must route through the `ST-INTRA-PRV-RT-DR-1` router which TAP003 has configured to block all `POSTGRES_SERVER` traffic."
"As an example of the malicious ACL Rule affecting traffic across the network, attempting to query the database server (ST_DATA-PRV-SRV-DB) from any of the `ST_PROJECT_*` networks should fail because it is must route through the `ST_INTRA-PRV-RT-DR-1` router which TAP003 has configured to block all `POSTGRES_SERVER` traffic."
]
},
{
@@ -725,10 +725,10 @@
"metadata": {},
"outputs": [],
"source": [
"affected_node = env.game.simulation.network.get_node_by_hostname(\"ST-PROJ-A-PRV-PC-1\")\n",
"database_server = env.game.simulation.network.get_node_by_hostname(\"ST-DATA-PRV-SRV-DB\")\n",
"affected_node = env.game.simulation.network.get_node_by_hostname(\"ST_PROJ-A-PRV-PC-1\")\n",
"database_server = env.game.simulation.network.get_node_by_hostname(\"ST_DATA-PRV-SRV-DB\")\n",
"\n",
"st_intra_prv_rt_dr_1 = env.game.simulation.network.get_node_by_hostname(\"ST-INTRA-PRV-RT-DR-1\")\n",
"st_intra_prv_rt_dr_1 = env.game.simulation.network.get_node_by_hostname(\"ST_INTRA-PRV-RT-DR-1\")\n",
"\n",
"database_client: DatabaseClient = affected_node.software_manager.software.get(\"database-client\")\n",
"st_intra_prv_rt_dr_1.acl.show()\n",
@@ -768,10 +768,10 @@
"outputs": [],
"source": [
"# This ACL blocks all web_server traffic from within the main `SOME_TECH` office. Thus leading to every SOME_TECH host unable to access the web-server\n",
"st_intra_prv_rt_cr = env.game.simulation.network.get_node_by_hostname(\"ST-INTRA-PRV-RT-CR\")\n",
"st_intra_prv_rt_cr = env.game.simulation.network.get_node_by_hostname(\"ST_INTRA-PRV-RT-CR\")\n",
"st_intra_prv_rt_cr.acl.show()\n",
"\n",
"st_head_office_private_pc_1: Computer = env.game.simulation.network.get_node_by_hostname(\"ST-HO-PRV-PC-1\")\n",
"st_head_office_private_pc_1: Computer = env.game.simulation.network.get_node_by_hostname(\"ST_HO-PRV-PC-1\")\n",
"st_head_office_private_pc_1_web_browser: WebBrowser = st_head_office_private_pc_1.software_manager.software[\"web-browser\"]\n",
"st_head_office_private_pc_1_web_browser.get_webpage(url=\"http://some_tech.com\")\n",
"st_head_office_private_pc_1_web_browser.sys_log.show()"
@@ -842,9 +842,9 @@
" variance: 0\n",
" repeat_kill_chain: false\n",
" repeat_kill_chain_stages: true\n",
" default_starting_node: \"ST-PROJ-A-PRV-PC-1\"\n",
" default_starting_node: \"ST_PROJ-A-PRV-PC-1\"\n",
" starting_nodes:\n",
" # starting_nodes: [\"ST-PROJ-A-PRV-PC-1\", \"ST-PROJ-B-PRV-PC-2\", \"ST-PROJ-C-PRV-PC-3\"]\n",
" # starting_nodes: [\"ST_PROJ-A-PRV-PC-1\", \"ST_PROJ-B-PRV-PC-2\", \"ST_PROJ-C-PRV-PC-3\"]\n",
"```"
]
},
@@ -900,20 +900,20 @@
" probability: 1\n",
" starting_network_knowledge:\n",
" credentials:\n",
" ST-PROJ-A-PRV-PC-1:\n",
" ST_PROJ-A-PRV-PC-1:\n",
" username: admin\n",
" password: admin\n",
" ST-PROJ-B-PRV-PC-2:\n",
" ST_PROJ-B-PRV-PC-2:\n",
" username: admin\n",
" password: admin\n",
" ST-PROJ-C-PRV-PC-3:\n",
" ST_PROJ-C-PRV-PC-3:\n",
" username: admin\n",
" password: admin\n",
" ST-INTRA-PRV-RT-DR-1:\n",
" ST_INTRA-PRV-RT-DR-1:\n",
" ip_address: 192.168.230.1\n",
" username: admin\n",
" password: admin\n",
" ST-INTRA-PRV-RT-CR:\n",
" ST_INTRA-PRV-RT-CR:\n",
" ip_address: 192.168.160.1\n",
" username: admin\n",
" password: admin\n",
@@ -926,13 +926,13 @@
" MANIPULATION:\n",
" probability: 1\n",
" account_changes:\n",
" - host: ST-INTRA-PRV-RT-DR-1\n",
" ip_address: 192.168.230.1 # ST-INTRA-PRV-RT-DR-1\n",
" - host: ST_INTRA-PRV-RT-DR-1\n",
" ip_address: 192.168.230.1 # ST_INTRA-PRV-RT-DR-1\n",
" action: change_password\n",
" username: admin\n",
" new_password: \"red_pass\"\n",
" - host: ST-INTRA-PRV-RT-CR\n",
" ip_address: 192.168.160.1 # ST-INTRA-PRV-RT-CR\n",
" - host: ST_INTRA-PRV-RT-CR\n",
" ip_address: 192.168.160.1 # ST_INTRA-PRV-RT-CR\n",
" action: change_password\n",
" username: \"admin\"\n",
" new_password: \"red_pass\"\n",
@@ -944,7 +944,7 @@
" EXPLOIT:\n",
" probability: 1\n",
" malicious_acls:\n",
" - target_router: ST-INTRA-PRV-RT-DR-1\n",
" - target_router: ST_INTRA-PRV-RT-DR-1\n",
" ip_address: 192.168.230.1 \n",
" position: 1\n",
" permission: DENY\n",
@@ -1131,7 +1131,7 @@
"source": [
"with open(_EXAMPLE_CFG/\"uc7_config_tap003.yaml\", mode=\"r\") as f:\n",
" cfg = yaml.safe_load(f)\n",
" cfg[\"agents\"][32][\"agent_settings\"][\"default_starting_node\"] = \"ST-PROJ-A-PRV-PC-1\"\n",
" cfg[\"agents\"][32][\"agent_settings\"][\"default_starting_node\"] = \"ST_PROJ-A-PRV-PC-1\"\n",
"env = PrimaiteGymEnv(env_config = cfg)\n",
"tap003 = env.game.agents[\"attacker\"]\n",
"print(f\"TA003's Selected Starting Host: {tap003.starting_node}\")"
@@ -1154,8 +1154,8 @@
"source": [
"with open(_EXAMPLE_CFG/\"uc7_config_tap003.yaml\", mode=\"r\") as f:\n",
" cfg = yaml.safe_load(f)\n",
" cfg[\"agents\"][32][\"agent_settings\"][\"default_starting_node\"] = \"ST-PROJ-A-PRV-PC-1\"\n",
" cfg[\"agents\"][32][\"agent_settings\"][\"starting_nodes\"] = [\"ST-PROJ-A-PRV-PC-1\",\"ST-PROJ-B-PRV-PC-2\"]"
" cfg[\"agents\"][32][\"agent_settings\"][\"default_starting_node\"] = \"ST_PROJ-A-PRV-PC-1\"\n",
" cfg[\"agents\"][32][\"agent_settings\"][\"starting_nodes\"] = [\"ST_PROJ-A-PRV-PC-1\",\"ST_PROJ-B-PRV-PC-2\"]"
]
},
{
@@ -1333,20 +1333,20 @@
" probability: 1\n",
" starting_network_knowledge:\n",
" credentials:\n",
" ST-PROJ-A-PRV-PC-1:\n",
" ST_PROJ-A-PRV-PC-1:\n",
" username: admin\n",
" password: admin\n",
" ST-PROJ-B-PRV-PC-2:\n",
" ST_PROJ-B-PRV-PC-2:\n",
" username: admin\n",
" password: admin\n",
" ST-PROJ-C-PRV-PC-3:\n",
" ST_PROJ-C-PRV-PC-3:\n",
" username: admin\n",
" password: admin\n",
" ST-INTRA-PRV-RT-DR-1:\n",
" ST_INTRA-PRV-RT-DR-1:\n",
" ip_address: 192.168.230.1\n",
" username: admin\n",
" password: admin\n",
" ST-INTRA-PRV-RT-CR:\n",
" ST_INTRA-PRV-RT-CR:\n",
" ip_address: 192.168.160.1\n",
" username: admin\n",
" password: admin\n",
@@ -1391,13 +1391,13 @@
" MANIPULATION:\n",
" probability: 1\n",
" account_changes:\n",
" - host: ST-INTRA-PRV-RT-DR-1\n",
" ip_address: 192.168.230.1 # ST-INTRA-PRV-RT-DR-1\n",
" - host: ST_INTRA-PRV-RT-DR-1\n",
" ip_address: 192.168.230.1 # ST_INTRA-PRV-RT-DR-1\n",
" action: change_password\n",
" username: admin\n",
" new_password: \"red_pass\"\n",
" - host: ST-INTRA-PRV-RT-CR\n",
" ip_address: 192.168.160.1 # ST-INTRA-PRV-RT-CR\n",
" - host: ST_INTRA-PRV-RT-CR\n",
" ip_address: 192.168.160.1 # ST_INTRA-PRV-RT-CR\n",
" action: change_password\n",
" username: \"admin\"\n",
" new_password: \"red_pass\"\n",
@@ -1446,7 +1446,7 @@
"metadata": {},
"outputs": [],
"source": [
"# New ST-PROJ-B-PRV-PC-2 user account\n",
"# New ST_PROJ-B-PRV-PC-2 user account\n",
"user_username = \"example_user_1\"\n",
"user_password = \"example_pass_1\"\n",
"user_admin = \"False\""
@@ -1477,7 +1477,7 @@
"metadata": {},
"outputs": [],
"source": [
"account_changes = [{\"host\":\"ST-PROJ-A-PRV-PC-2\", \"ip_address\": \"192.168.230.2\", \"user_name\": user_username, \"old_password\": user_password, \"new_password\": tap003_new_password}]"
"account_changes = [{\"host\":\"ST_PROJ-A-PRV-PC-2\", \"ip_address\": \"192.168.230.2\", \"user_name\": user_username, \"old_password\": user_password, \"new_password\": tap003_new_password}]"
]
},
{
@@ -1501,15 +1501,15 @@
" cfg['agents'][32]['agent_settings']['start_step'] = 1\n",
" cfg['agents'][32]['agent_settings']['frequency'] = 3\n",
" cfg['agents'][32]['agent_settings']['variance'] = 0\n",
" starting_creds = {\"username\": \"admin\",\"password\":\"admin\", \"ip_address\":\"192.168.230.2\"} # Adding \"ST-PROJ-A-PRV-PC-2\" to TAP003's starting_network_knowledge\n",
" cfg['agents'][32]['agent_settings']['kill_chain']['PLANNING']['starting_network_knowledge']['credentials'].update({\"ST-PROJ-A-PRV-PC-2\": starting_creds})\n",
" starting_creds = {\"username\": \"admin\",\"password\":\"admin\", \"ip_address\":\"192.168.230.2\"} # Adding \"ST_PROJ-A-PRV-PC-2\" to TAP003's starting_network_knowledge\n",
" cfg['agents'][32]['agent_settings']['kill_chain']['PLANNING']['starting_network_knowledge']['credentials'].update({\"ST_PROJ-A-PRV-PC-2\": starting_creds})\n",
" cfg['agents'][32]['agent_settings']['kill_chain']['MANIPULATION']['account_changes'] = account_changes\n",
"env = PrimaiteGymEnv(env_config = cfg)\n",
"env.reset()\n",
"while(env.game.step_counter != 90): # 20 Red Actions (frequency of 3)\n",
" env.step(0)\n",
"tap003 = env.game.agents['attacker']\n",
"target_host = env.game.simulation.network.get_node_by_hostname(\"ST-PROJ-A-PRV-PC-2\")\n",
"target_host = env.game.simulation.network.get_node_by_hostname(\"ST_PROJ-A-PRV-PC-2\")\n",
"target_host.user_manager.show()\n"
]
},
@@ -1603,13 +1603,13 @@
"metadata": {},
"outputs": [],
"source": [
"st_intra_prv_rt_dr_1 = env.game.simulation.network.get_node_by_hostname(\"ST-INTRA-PRV-RT-DR-1\")\n",
"st_intra_prv_rt_dr_1 = env.game.simulation.network.get_node_by_hostname(\"ST_INTRA-PRV-RT-DR-1\")\n",
"st_intra_prv_rt_dr_1.acl.show()\n",
"\n",
"rem_pub_rt_dr = env.game.simulation.network.get_node_by_hostname(\"REM-PUB-RT-DR\")\n",
"rem_pub_rt_dr.acl.show()\n",
"\n",
"st_intra_prv_rt_cr = env.game.simulation.network.get_node_by_hostname(\"ST-INTRA-PRV-RT-CR\")\n",
"st_intra_prv_rt_cr = env.game.simulation.network.get_node_by_hostname(\"ST_INTRA-PRV-RT-CR\")\n",
"st_intra_prv_rt_cr.acl.show()"
]
},
@@ -1658,7 +1658,7 @@
"while(env.game.step_counter != 50):\n",
" env.step(0)\n",
"tap003 = env.game.agents['attacker']\n",
"target_host = env.game.simulation.network.get_node_by_hostname(\"ST-INTRA-PRV-RT-DR-1\")\n",
"target_host = env.game.simulation.network.get_node_by_hostname(\"ST_INTRA-PRV-RT-DR-1\")\n",
"target_host.acl.show()"
]
}

40
src/primaite/notebooks/UC7-attack-variants.ipynb
View File

@@ -91,7 +91,7 @@
"\n",
"Let's print the schedule so that we can see which attack we can expect on each episode.\n",
"\n",
"On episodes 0-4, the TAP001 agent will be used, and on episodes 5-9, the TAP003 agent will be used. Then, the environment will alternate between the two. Furthermore, the TAP001 agent will alternate between starting at `ST-PROJ-A-PRV-PC-1`, `ST-PROJ-B-PRV-PC-2`, `ST-PROJ-C-PRV-PC-3`."
"On episodes 0-4, the TAP001 agent will be used, and on episodes 5-9, the TAP003 agent will be used. Then, the environment will alternate between the two. Furthermore, the TAP001 agent will alternate between starting at `ST_PROJ-A-PRV-PC-1`, `ST_PROJ-B-PRV-PC-2`, `ST_PROJ-C-PRV-PC-3`."
]
},
{
@@ -125,7 +125,7 @@
" env.step(0)\n",
"\n",
"def print_agent_actions_except_do_nothing(agent_name):\n",
" \"\"\"Get the agent's action history, filter out DONOTHING actions, print relevant data in a table.\"\"\"\n",
" \"\"\"Get the agent's action history, filter out `do-nothing` actions, print relevant data in a table.\"\"\"\n",
" table = PrettyTable()\n",
" table.field_names = [\"Step\", \"Action\", \"Node\", \"Application\", \"Target IP\", \"Response\"]\n",
" print(f\"Episode: {env.episode_counter}, Actions for '{agent_name}':\")\n",
@@ -135,8 +135,8 @@
"\n",
" node, application, target_ip = \"N/A\", \"N/A\", \"N/A\",\n",
"\n",
" if item.action.startswith(\"node-map\"):\n",
" node = item.parameters['source-node']\n",
" if item.action.startswith(\"node-nmap\"):\n",
" node = item.parameters['source_node']\n",
" application = \"nmap\"\n",
" target_ip = str(item.parameters['target_ip_address'])\n",
" target_ip = (target_ip[:25]+'...') if len(target_ip)>25 else target_ip # truncate long string\n",
@@ -194,7 +194,7 @@
"metadata": {},
"outputs": [],
"source": [
"st_data_prv_srv_db: Server = env.game.simulation.network.get_node_by_hostname(\"ST-DATA-PRV-SRV-DB\")\n",
"st_data_prv_srv_db: Server = env.game.simulation.network.get_node_by_hostname(\"ST_DATA-PRV-SRV-DB\")\n",
"st_data_prv_srv_db.file_system.show()"
]
},
@@ -268,7 +268,7 @@
"metadata": {},
"outputs": [],
"source": [
"st_intra_prv_rt_cr: Router = env.game.simulation.network.get_node_by_hostname(\"ST-INTRA-PRV-RT-CR\")\n",
"st_intra_prv_rt_cr: Router = env.game.simulation.network.get_node_by_hostname(\"ST_INTRA-PRV-RT-CR\")\n",
"st_intra_prv_rt_cr.acl.show()"
]
},
@@ -318,8 +318,8 @@
"\n",
"|Target Router | Impact |\n",
"|----------------------|--------|\n",
"|`ST-INTRA-PRV-RT-DR-1`| Blocks all `POSTGRES_SERVER` that arrives at the `ST-INTRA-PRV-RT-DR-1` router. This rule will prevent all ST_PROJ_* hosts from accessing the database (`ST-DATA-PRV-SRV-DB`).|\n",
"|`ST-INTRA-PRV-RT-CR`| Blocks all `HTTP` traffic that arrives at the`ST-INTRA-PRV-RT-CR` router. This rule will prevent all SOME_TECH hosts from accessing the webserver (`ST-DMZ-PUB-SRV-WEB`)|\n",
"|`ST_INTRA-PRV-RT-DR-1`| Blocks all `POSTGRES_SERVER` that arrives at the `ST_INTRA-PRV-RT-DR-1` router. This rule will prevent all ST_PROJ_* hosts from accessing the database (`ST_DATA-PRV-SRV-DB`).|\n",
"|`ST_INTRA-PRV-RT-CR`| Blocks all `HTTP` traffic that arrives at the`ST_INTRA-PRV-RT-CR` router. This rule will prevent all SOME_TECH hosts from accessing the webserver (`ST-DMZ-PUB-SRV-WEB`)|\n",
"|`REM-PUB-RT-DR`| Blocks all `DNS` traffic that arrives at the `REM-PUB-RT-DR` router. This rule prevents any remote site works from accessing the DNS Server (`ISP-PUB-SRV-DNS`).|"
]
},
@@ -357,7 +357,7 @@
"metadata": {},
"outputs": [],
"source": [
"env.game.simulation.network.get_node_by_hostname(\"ST-INTRA-PRV-RT-DR-1\").acl.show()"
"env.game.simulation.network.get_node_by_hostname(\"ST_INTRA-PRV-RT-DR-1\").acl.show()"
]
},
{
@@ -366,7 +366,7 @@
"metadata": {},
"outputs": [],
"source": [
"env.game.simulation.network.get_node_by_hostname(\"ST-INTRA-PRV-RT-CR\").acl.show()"
"env.game.simulation.network.get_node_by_hostname(\"ST_INTRA-PRV-RT-CR\").acl.show()"
]
},
{
@@ -494,8 +494,8 @@
"outputs": [],
"source": [
"env.reset()\n",
"env.step(50) # NODE_ACCOUNTS_CHANGE_PASSWORD | st-intra-prv-rt-cr\n",
"env.step(52) # NODE_ACCOUNTS_CHANGE_PASSWORD | st-intra-prv-rt-dr-1\n",
"env.step(50) # NODE_ACCOUNTS_CHANGE_PASSWORD | ST_INTRA-prv-rt-cr\n",
"env.step(52) # NODE_ACCOUNTS_CHANGE_PASSWORD | ST_INTRA-prv-rt-dr-1\n",
"env.step(54) # NODE_ACCOUNTS_CHANGE_PASSWORD | rem-pub-rt-dr\n",
"finish_episode_and_print_reward()\n",
"\n",
@@ -522,8 +522,8 @@
"for _ in range(45):\n",
" env.step(0)\n",
"\n",
"env.game.simulation.network.get_node_by_hostname(\"ST-INTRA-PRV-RT-CR\").acl.show()\n",
"env.game.simulation.network.get_node_by_hostname(\"ST-INTRA-PRV-RT-DR-1\").acl.show()\n",
"env.game.simulation.network.get_node_by_hostname(\"ST_INTRA-PRV-RT-CR\").acl.show()\n",
"env.game.simulation.network.get_node_by_hostname(\"ST_INTRA-PRV-RT-DR-1\").acl.show()\n",
"env.game.simulation.network.get_node_by_hostname(\"REM-PUB-RT-DR\").acl.show()"
]
},
@@ -533,8 +533,8 @@
"metadata": {},
"outputs": [],
"source": [
"env.step(44) # ROUTER_ACL_REMOVERULE | st-intra-prv-rt-cr\n",
"env.step(53) # ROUTER_ACL_REMOVERULE | st-intra-prv-rt-dr-1\n",
"env.step(44) # ROUTER_ACL_REMOVERULE | ST_INTRA-prv-rt-cr\n",
"env.step(53) # ROUTER_ACL_REMOVERULE | ST_INTRA-prv-rt-dr-1\n",
"env.step(55) # ROUTER_ACL_REMOVERULE | rem-pub-rt-dr"
]
},
@@ -544,8 +544,8 @@
"metadata": {},
"outputs": [],
"source": [
"env.game.simulation.network.get_node_by_hostname(\"ST-INTRA-PRV-RT-CR\").acl.show()\n",
"env.game.simulation.network.get_node_by_hostname(\"ST-INTRA-PRV-RT-DR-1\").acl.show()\n",
"env.game.simulation.network.get_node_by_hostname(\"ST_INTRA-PRV-RT-CR\").acl.show()\n",
"env.game.simulation.network.get_node_by_hostname(\"ST_INTRA-PRV-RT-DR-1\").acl.show()\n",
"env.game.simulation.network.get_node_by_hostname(\"REM-PUB-RT-DR\").acl.show()\n"
]
},
@@ -564,9 +564,9 @@
],
"metadata": {
"kernelspec": {
"display_name": ".venv",
"display_name": "milpac_venv",
"language": "python",
"name": "python3"
"name": "milpac_venv"
},
"language_info": {
"codemirror_mode": {

48
src/primaite/notebooks/UC7-network_connectivity.ipynb
View File

@@ -342,8 +342,8 @@
"metadata": {},
"outputs": [],
"source": [
"st_pub_fw: Firewall = network.get_node_by_hostname(hostname=\"ST-PUB-FW\")\n",
"st_dmz_pub_srv_web: Server = network.get_node_by_hostname(hostname=\"ST-DMZ-PUB-SRV-WEB\")"
"st_pub_fw: Firewall = network.get_node_by_hostname(hostname=\"ST_PUB-FW\")\n",
"st_dmz_pub_srv_web: Server = network.get_node_by_hostname(hostname=\"ST_DMZ-PUB-SRV-WEB\")"
]
},
{
@@ -408,9 +408,9 @@
"metadata": {},
"outputs": [],
"source": [
"st_intra_prv_rt_cr: Router = network.get_node_by_hostname(hostname=\"ST-INTRA-PRV-RT-CR\")\n",
"st_intra_prv_rt_dr_1: Router = network.get_node_by_hostname(hostname=\"ST-INTRA-PRV-RT-DR-1\")\n",
"st_intra_prv_rt_dr_2: Router = network.get_node_by_hostname(hostname=\"ST-INTRA-PRV-RT-DR-2\")"
"st_intra_prv_rt_cr: Router = network.get_node_by_hostname(hostname=\"ST_INTRA-PRV-RT-CR\")\n",
"st_intra_prv_rt_dr_1: Router = network.get_node_by_hostname(hostname=\"ST_INTRA-PRV-RT-DR-1\")\n",
"st_intra_prv_rt_dr_2: Router = network.get_node_by_hostname(hostname=\"ST_INTRA-PRV-RT-DR-2\")"
]
},
{
@@ -558,9 +558,9 @@
"metadata": {},
"outputs": [],
"source": [
"st_head_office_private_pc_1: Computer = network.get_node_by_hostname(\"ST-HO-PRV-PC-1\")\n",
"st_head_office_private_pc_2: Computer = network.get_node_by_hostname(\"ST-HO-PRV-PC-2\")\n",
"st_head_office_private_pc_3: Computer = network.get_node_by_hostname(\"ST-HO-PRV-PC-3\")"
"st_head_office_private_pc_1: Computer = network.get_node_by_hostname(\"ST_HO-PRV-PC-1\")\n",
"st_head_office_private_pc_2: Computer = network.get_node_by_hostname(\"ST_HO-PRV-PC-2\")\n",
"st_head_office_private_pc_3: Computer = network.get_node_by_hostname(\"ST_HO-PRV-PC-3\")"
]
},
{
@@ -609,9 +609,9 @@
"metadata": {},
"outputs": [],
"source": [
"st_human_resources_private_pc_1: Computer = network.get_node_by_hostname(\"ST-HR-PRV-PC-1\")\n",
"st_human_resources_private_pc_2: Computer = network.get_node_by_hostname(\"ST-HR-PRV-PC-2\")\n",
"st_human_resources_private_pc_3: Computer = network.get_node_by_hostname(\"ST-HR-PRV-PC-3\")"
"st_human_resources_private_pc_1: Computer = network.get_node_by_hostname(\"ST_HR-PRV-PC-1\")\n",
"st_human_resources_private_pc_2: Computer = network.get_node_by_hostname(\"ST_HR-PRV-PC-2\")\n",
"st_human_resources_private_pc_3: Computer = network.get_node_by_hostname(\"ST_HR-PRV-PC-3\")"
]
},
{
@@ -671,8 +671,8 @@
"metadata": {},
"outputs": [],
"source": [
"st_data_private_server_database: Server = network.get_node_by_hostname(\"ST-DATA-PRV-SRV-DB\")\n",
"st_data_private_server_storage: Server = network.get_node_by_hostname(\"ST-DATA-PRV-SRV-STORAGE\")"
"st_data_private_server_database: Server = network.get_node_by_hostname(\"ST_DATA-PRV-SRV-DB\")\n",
"st_data_private_server_storage: Server = network.get_node_by_hostname(\"ST_DATA-PRV-SRV-STORAGE\")"
]
},
{
@@ -710,9 +710,9 @@
"metadata": {},
"outputs": [],
"source": [
"st_project_a_private_pc_1: Computer = network.get_node_by_hostname(\"ST-PROJ-A-PRV-PC-1\")\n",
"st_project_a_private_pc_2: Computer = network.get_node_by_hostname(\"ST-PROJ-A-PRV-PC-2\")\n",
"st_project_a_private_pc_3: Computer = network.get_node_by_hostname(\"ST-PROJ-A-PRV-PC-3\")"
"st_project_a_private_pc_1: Computer = network.get_node_by_hostname(\"ST_PROJ-A-PRV-PC-1\")\n",
"st_project_a_private_pc_2: Computer = network.get_node_by_hostname(\"ST_PROJ-A-PRV-PC-2\")\n",
"st_project_a_private_pc_3: Computer = network.get_node_by_hostname(\"ST_PROJ-A-PRV-PC-3\")"
]
},
{
@@ -754,7 +754,7 @@
"metadata": {},
"outputs": [],
"source": [
"# ST Private Project A PC 1 --> ST-INTRA-PRV-RT-CR\n",
"# ST Private Project A PC 1 --> ST_INTRA-PRV-RT-CR\n",
"\n",
"st_project_a_private_pc_1.ping(st_intra_prv_rt_cr.network_interface[1].ip_address)"
]
@@ -765,7 +765,7 @@
"metadata": {},
"outputs": [],
"source": [
"# ST Private Project A PC 1 --> ST-INTRA-PRV-RT-DR-2\n",
"# ST Private Project A PC 1 --> ST_INTRA-PRV-RT-DR-2\n",
"\n",
"st_project_a_private_pc_1.ping(\"192.168.170.2\")"
]
@@ -783,9 +783,9 @@
"metadata": {},
"outputs": [],
"source": [
"st_project_b_private_pc_1: Computer = network.get_node_by_hostname(\"ST-PROJ-B-PRV-PC-1\")\n",
"st_project_b_private_pc_2: Computer = network.get_node_by_hostname(\"ST-PROJ-B-PRV-PC-2\")\n",
"st_project_b_private_pc_3: Computer = network.get_node_by_hostname(\"ST-PROJ-B-PRV-PC-3\")"
"st_project_b_private_pc_1: Computer = network.get_node_by_hostname(\"ST_PROJ-B-PRV-PC-1\")\n",
"st_project_b_private_pc_2: Computer = network.get_node_by_hostname(\"ST_PROJ-B-PRV-PC-2\")\n",
"st_project_b_private_pc_3: Computer = network.get_node_by_hostname(\"ST_PROJ-B-PRV-PC-3\")"
]
},
{
@@ -834,9 +834,9 @@
"metadata": {},
"outputs": [],
"source": [
"st_project_c_private_pc_1: Computer = network.get_node_by_hostname(\"ST-PROJ-C-PRV-PC-1\")\n",
"st_project_c_private_pc_2: Computer = network.get_node_by_hostname(\"ST-PROJ-C-PRV-PC-2\")\n",
"st_project_c_private_pc_3: Computer = network.get_node_by_hostname(\"ST-PROJ-C-PRV-PC-3\")"
"st_project_c_private_pc_1: Computer = network.get_node_by_hostname(\"ST_PROJ-C-PRV-PC-1\")\n",
"st_project_c_private_pc_2: Computer = network.get_node_by_hostname(\"ST_PROJ-C-PRV-PC-2\")\n",
"st_project_c_private_pc_3: Computer = network.get_node_by_hostname(\"ST_PROJ-C-PRV-PC-3\")"
]
},
{

2
src/primaite/notebooks/_package_data/uc7/uc7_network_detailed_svg.svg
View File

File diff suppressed because one or more lines are too long
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 383 KiB

After

Width:  |  Height:  |  Size: 383 KiB