Target design, draft 1

You have gotten a brief intro to some common Linux and web vulnerabilities plus the mechanics of setting up a VM. Now it's time to start building your project.

Terms to search for

• [Linux] privilege escalation
• [Linux] lateral movement
• Linux vulnerabilities
• ...?

What to do

First, I want you to spend some serious time brainstorming, searching online for ideas, imagining your fictional organization in charge of your target machine, etc. This is the time to envision what you wish your final project would be like. How tough do you want to be on attackers? How foolish do you want your fictional defenders to be? Which topics would you most like to understand beyond script-kiddie level? etc.

For this assignment, make a folder named draft1 in your git repo, and create a file draft1/design.[txt/md]. In this file:

• Make a list of vulnerability types you might be interested in including. Make this list as long as you can, and annotate it with links as appropriate.
• Pick several of these vulnerabilities that you could install into your VM so that an attacker could chain them together to go from "nmap from the outside" to "shell with whoami==root". Write this chain of vulnerabilities as a concise, step-by-step description of actions the attacker should take to get a root shell.
• Write a brief description of the fictional person/people/organization your machine will be owned by. This will help you refine your design later to make its vulnerabilities realistic in context.