shiva - An Ansible playbook to provision a host for penetr

项目说明

<p align="center">
<img src=".github/a2f2f32e4696e672e636f6d2f696d616765732fde706e67.png">
</p>

What is Shiva?

Shiva is an Ansible playbook to pro a host to be used for playing CTF games, such as HackTheBox.

Quick start

1. Create a Ubuntu 18.04 server host and ensure you have root access via SSH
2. Install Ansible on your local machine
3. Clone the repository to your local machine: git clone :rastating/shiva.git
4. Replace 127.0.0.1 with the IP address of the host to pro in the ubuntu_bionic section of in.ini
5. Run the playbook: ansible-playbook -i in.ini -u root -l ubuntu_bionic playbook.yml

Why Shiva and not another Hindu deity?

When playing CTFs, I prefer to use cloud pro (such as Digital Ocean) rather than a local machine running Kali. Although Kali is a great system, I find myself using only a small subset of the a tools and frequently find myself spinning up a cloud instance for persistence purposes anyway.

For this reason, I put together Shiva to automate building hosts in the cloud for pentesting / CTF purposes with my preferred en. It's not a replacement for distros such as Kali and Parrot, but a way to build a more concise en for similar purposes.

What operating systems can Shiva be used with?

Currently, Shiva has only been tested against Ubuntu 18.04.

What tools / packages are included?

| Name | Category | Home Page |
|-----------------------|------------------|----------------------------------------------------------|
| binwalk | Binary Analysis | |
| GDB | Binary Analysis | |
| nasm | Binary Analysis | |
| PEDA | Binary Analysis | |
| pwntools | Binary Analysis | |
| Radare2 | Binary Analysis | |
| Ropper | Binary Analysis | |
| FCrackZip | Cracking | |
| hashcat | Cracking | |
| John The Ripper | Cracking | |
| Hash Identifier | Crypto | |
| xortool | Crypto | |
| Go | En | |
| Node.js | En | |
| Oh My ZSH | En | |
| Ruby | En | |
| Empire | Exploitation | |
| Metasploit | Exploitation | |
| PowerSploit | Exploitation | |
| SearchSploit | Exploitation | |
| SuperTTY | Exploitation | |
| Hydra | Password Attacks | |
| Medusa | Password Attacks | |
| Ncrack | Password Attacks | |
| SecLists | Password Attacks | |
| CrackMapExec | Recon | |
| dnmasscan | Recon | |
| DNSRecon | Recon | |
| HostileSubBruteforcer | Recon | |
| LinEnum | Recon | |
| Masscan | Recon | |
| Nmap | Recon | |
| pspy | Recon | |
| Recon-ng | Recon | |
| Responder | Recon | |
| Sherlock | Recon | |
| Snmpcheck | Recon | |
| sslscan | Recon | |
| S3Scanner | Recon | |
| theHar | Recon | |
| tshark | Recon | |
| Apache | Services | |
| PostgreSQL | Services | |
| | Services | |
| MS-SQL CLI | Tools | |
| OpenVPN | Tools | |
| smbclient | Tools | |
| Socat | Tools | |
| Cookie Monster | Web | |
| Dirb | Web | |
| EyeWitness | Web | |
| Gobuster | Web | |
| Magescan | Web | |
| Nikto | Web | |
| Shocker | Web | |
| sqlmap | Web | |
| wafw00f | Web | |
| WhatWeb | Web | |
| wfuzz | Web | |
| WPScan | Web | |
| WPXF | Web | |

Several directories can also be found which include pre-compiled binaries and files to aid with exploitation and post-exploitation:

| Path | Description |
|-------------------------------|------------------------------------------------------------------------|
| /usr/share/linux-binaries | Pre-compiled Linux binaries for post-exploitation (such as pspy) |
| /usr/share/webshells | Web shells written in several languages |
| /usr/share/windows-binaries | Pre-compiled Windows binaries for post-exploitation (such as Mimikatz) |
| /usr/share/wordlists | Wordlists to be used with password attacks / enumeration |

What services does Shi out of the box?

None; other than SSH. Apache, PostgreSQL and are all installed, but the ports are not open to the public by default.

If you want to lock down where SSH is a out of the box, you can run the playbook with the --extra-vars switch to specify the trusted_ssh_ip .

For example, running the playbook with ansible-playbook -i in.ini -u root -l ubuntu_bionic --extra-vars "trusted_ssh_ip=10.8.0.1" playbook.yml would add a firewall rule that would only allow 10.8.0.1 to connect to port 22 and drop traffic from any other IP address.

Be cautious when doing this, a typo could lead to you locking yourself out!

Does Shi any user accounts?

Yes - an account named ftp is created without a default password. This is for use with (see next section on connecting to ) but cannot be used to access the server via SSH.

How do I connect to ?

As the firewall does not expose out of the box, you will need to open the following ports:

21

40000-50000

Only one user is authorised to access the FTP server out of the box (aptly named ftp). Before this user can authenticate, a password must be created for the account by running passwd ftp as root.

Note: the ftp user account is explicitly prohibited from logging into the server via SSH

If you want to allow other local user accounts to authenticate, you must:

Create a directory owned by root at: /srv/ftp/users/$USER

Create a directory owned by the user at /srv/ftp/users/$USER/files

Add the user's name to /etc/.userlist

What aliases are a?

ser

An alias that will serve the current working directory using the Python SimpleHTTPSer

Example:

msfconsole

An alias which will first start the postgresql service prior to launching the standard msfconsole binary; allowing for Metasploit to ha to the database.

Note: the postgresql service is not automatically stopped after msfconsole is stopped

masscan_port_list

Parse the output of masscan into a CSV of unique port numbers.

masscan_ip_list

Parse the output of masscan to generate a list of unique IP addresses.

extract_unique_domains_from_dnsrecon_json

Parse a JSON file created by dnsrecon to extract the unique domain names found.

Example to extract all subdomains found that belong to google.com: extract_unique_domains_from_dnsrecon_json /path/to/dnsrecon.json google.com

Roadmap

There are three things I'd like to push with this going forward:

Increase the tool set (with useful tools, not just pushing up the count with useless stuff)

Setup Travis to add testing against the GitHub repository

Test against systems other than Ubuntu 18.04 and make adjustments to allow for a more robust list of base systems

If you can help with any of these and [more importantly] would like to - please feel free to submit pull requests or open issues with information!

项目信息

开发语言：Python

Star 数：230

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕An Ansible playbook to provision a host for penetration testing and CTF challenges展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。