Dynamic file support

Files/Splunk-5-6-7/BlueCoatProxy01.csv → Files/unit5/BlueCoatProxy01.csv

@@ -1,40 +1,40 @@
-timestamp,source_ip,username,dest_ip,dest_url,http_method,user_agent,status_code,bytes_sent,bytes_received,category,action,
-6/4/2023 14:52,192.168.1.3,MKhan,93.184.216.34,http://example.com,GET,Chrome/91.0.4472.124,200,512,2048,General,ALLOW,
-6/4/2023 14:57,192.168.1.7,Jmann,172.217.168.68,http://google.com,GET,Firefox/89.0,200,1024,4096,Search Engines,ALLOW,
-6/4/2023 15:03,192.168.1.2,ACase,204.79.197.200,http://bing.com,GET,Edge/91.0.864.41,200,768,3072,Search Engines,ALLOW,
-6/4/2023 15:07,192.168.1.5,AMays,157.240.20.35,http://facebook.com,GET,Chrome/91.0.4472.124,200,2048,8192,Social Networking,DENY,
-6/4/2023 15:15,192.168.1.6,KHorton,52.30.206.159,http://linkedin.com,GET,Edge/91.0.864.41,200,1024,4096,Social Networking,ALLOW,
-6/4/2023 15:18,192.168.1.10,ABurke,52.94.237.74,http://amazon.com,GET,Firefox/89.0,200,768,3072,E-commerce,ALLOW,
-6/4/2023 15:22,192.168.1.9,SBielert,51.89.178.210,http://freecalendars.com,GET,Chrome/91.0.4472.124,200,512,2048,Organization,ALLOW,
-6/4/2023 15:28,192.168.1.11,JColeman,140.82.121.4,http://github.com,GET,Safari/13.1.1,200,1024,4096,Programming,ALLOW,
-6/4/2023 15:33,192.168.1.12,EFisher,208.80.154.224,http://wikipedia.org,GET,Edge/91.0.864.41,200,2048,8192,Reference,ALLOW,
-6/4/2023 15:37,192.168.1.14,TShah,192.229.163.122,http://yahoo.com,GET,Chrome/91.0.4472.124,200,768,3072,Email,ALLOW,
-6/4/2023 15:42,192.168.1.13,LMccarty,23.52.164.113,http://adobe.com,GET,Firefox/89.0,200,512,2048,Software,ALLOW,
-6/4/2023 15:47,192.168.1.4,DPetersen,216.58.217.46,http://youtube.com,GET,Firefox/89.0,200,1024,4096,Streaming Media,ALLOW,
-6/4/2023 15:50,192.168.1.10,ABurke,69.171.250.35,http://www.microsoft-updateserver.cf,GET,Safari/13.1.1,200,768,3072,Software,ALLOW,ALLOW
-6/4/2023 15:54,192.168.1.3,MKhan,185.60.216.35,http://netflix.com,GET,Chrome/91.0.4472.124,200,2048,8192,Streaming Media,ALLOW,
-6/4/2023 16:01,192.168.1.7,Jmann,184.26.44.19,http://microsoft.com,GET,Firefox/89.0,200,1024,4096,Organization,ALLOW,
-6/4/2023 16:05,192.168.1.2,ACase,151.101.65.140,http://stackoverflow.com,GET,Edge/91.0.864.41,200,768,3072,Programming,ALLOW,
-6/4/2023 16:11,192.168.1.5,AMays,172.217.5.110,http://gmail.com,GET,Chrome/91.0.4472.124,200,512,2048,Email,ALLOW,
-6/4/2023 16:15,192.168.1.6,KHorton,184.72.106.52,http://quora.com,GET,Edge/91.0.864.41,200,1024,4096,Forums,ALLOW,
-6/4/2023 16:20,192.168.1.10,ABurke,69.171.234.21,http://messenger.com,GET,Firefox/89.0,200,2048,8192,Messaging,ALLOW,
-6/4/2023 16:23,192.168.1.9,KKirby,192.0.66.2,http://wordpress.com,GET,Chrome/91.0.4472.124,200,768,3072,Blogging,ALLOW,
-6/4/2023 16:28,192.168.1.11,JColeman,104.244.42.193,http://twitter.com,GET,Safari/13.1.1,200,512,2048,Social Networking,ALLOW,
-6/4/2023 16:33,192.168.1.12,EFisher,13.249.44.129,http://imdb.com,GET,Edge/91.0.864.41,200,1024,4096,Entertainment,ALLOW,
-6/4/2023 16:37,192.168.1.14,TShah,199.232.36.84,http://pinterest.com,GET,Chrome/91.0.4472.124,200,768,3072,Social Networking,ALLOW,
-6/4/2023 16:42,192.168.1.15,JBennett,151.101.1.164,http://news.ycombinator.com,GET,Firefox/89.0,200,2048,8192,News,ALLOW,
-6/4/2023 16:50,192.168.1.15,JBennett,151.101.194.2,http://reddit.com,GET,Firefox/89.0,200,2048,8192,Forums,ALLOW,
-6/4/2023 16:55,192.168.1.3,MKhan,192.0.66.2,http://wordpress.org,GET,Chrome/91.0.4472.124,200,768,3072,Blogging,ALLOW,
-6/4/2023 17:00,192.168.1.7,Jmann,51.89.178.210,http://freecalendars.com,GET,Firefox/89.0,200,512,2048,E-commerce,ALLOW,
-6/4/2023 17:05,192.168.1.2,ACase,204.79.197.200,http://bing.com,GET,Edge/91.0.864.41,200,1024,4096,Search Engines,ALLOW,
-6/4/2023 17:10,192.168.1.5,AMays,151.101.1.167,http://flickr.com,GET,Chrome/91.0.4472.124,200,2048,8192,Photo Sharing,ALLOW,
-6/4/2023 17:15,192.168.1.6,KHorton,31.13.71.36,http://facebook.com,GET,Edge/91.0.864.41,200,768,3072,Social Networking,ALLOW,
-6/4/2023 17:20,192.168.1.10,ABurke,216.58.192.206,http://google.com,GET,Firefox/89.0,200,512,2048,Search Engines,ALLOW,
-6/4/2023 17:25,192.168.1.9,KKirby,151.101.129.164,http://vimeo.com,GET,Chrome/91.0.4472.124,200,1024,4096,Streaming Media,ALLOW,
-6/4/2023 17:30,192.168.1.11,JColeman,104.244.42.1,http://tumblr.com,GET,Safari/13.1.1,200,2048,8192,Blogging,ALLOW,
-6/4/2023 17:35,192.168.1.12,EFisher,34.206.39.153,http://stackoverflow.com,GET,Edge/91.0.864.41,200,768,3072,Programming,ALLOW,
-6/4/2023 17:40,192.168.1.14,TShah,185.60.218.35,http://netflix.com,GET,Chrome/91.0.4472.124,200,512,2048,Streaming Media,ALLOW,
-6/4/2023 17:45,192.168.1.1,Echan,104.79.140.7,http://github.com,GET,Firefox/89.0,200,2048,8192,Software Development,ALLOW,
-6/4/2023 17:50,192.168.1.13,LMccarty,209.170.118.61,http://linkedin.com,GET,Firefox/89.0,200,768,3072,Social Networking,ALLOW,
-6/4/2023 17:55,192.168.1.4,SBielert,208.80.154.224,http://www.microsoft-updateserver.cf,GET,Firefox/89.0,200,1024,4096,Software,ALLOW,
-6/4/2023 18:00,192.168.1.8,EChan,23.21.189.88,http://twitch.tv,GET,Safari/13.1.1,200,2048,8192,Streaming Media,DENY,
+timestamp,source_ip,username,dest_ip,dest_url,http_method,user_agent,status_code,bytes_sent,bytes_received,category,action,
+6/4/2023 14:52,192.168.1.3,MKhan,93.184.216.34,http://example.com,GET,Chrome/91.0.4472.124,200,512,2048,General,ALLOW,
+6/4/2023 14:57,192.168.1.7,Jmann,172.217.168.68,http://google.com,GET,Firefox/89.0,200,1024,4096,Search Engines,ALLOW,
+6/4/2023 15:03,192.168.1.2,ACase,204.79.197.200,http://bing.com,GET,Edge/91.0.864.41,200,768,3072,Search Engines,ALLOW,
+6/4/2023 15:07,192.168.1.5,AMays,157.240.20.35,http://facebook.com,GET,Chrome/91.0.4472.124,200,2048,8192,Social Networking,DENY,
+6/4/2023 15:15,192.168.1.6,KHorton,52.30.206.159,http://linkedin.com,GET,Edge/91.0.864.41,200,1024,4096,Social Networking,ALLOW,
+6/4/2023 15:18,192.168.1.10,ABurke,52.94.237.74,http://amazon.com,GET,Firefox/89.0,200,768,3072,E-commerce,ALLOW,
+6/4/2023 15:22,192.168.1.9,SBielert,51.89.178.210,http://freecalendars.com,GET,Chrome/91.0.4472.124,200,512,2048,Organization,ALLOW,
+6/4/2023 15:28,192.168.1.11,JColeman,140.82.121.4,http://github.com,GET,Safari/13.1.1,200,1024,4096,Programming,ALLOW,
+6/4/2023 15:33,192.168.1.12,EFisher,208.80.154.224,http://wikipedia.org,GET,Edge/91.0.864.41,200,2048,8192,Reference,ALLOW,
+6/4/2023 15:37,192.168.1.14,TShah,192.229.163.122,http://yahoo.com,GET,Chrome/91.0.4472.124,200,768,3072,Email,ALLOW,
+6/4/2023 15:42,192.168.1.13,LMccarty,23.52.164.113,http://adobe.com,GET,Firefox/89.0,200,512,2048,Software,ALLOW,
+6/4/2023 15:47,192.168.1.4,DPetersen,216.58.217.46,http://youtube.com,GET,Firefox/89.0,200,1024,4096,Streaming Media,ALLOW,
+6/4/2023 15:50,192.168.1.10,ABurke,69.171.250.35,http://www.microsoft-updateserver.cf,GET,Safari/13.1.1,200,768,3072,Software,ALLOW,ALLOW
+6/4/2023 15:54,192.168.1.3,MKhan,185.60.216.35,http://netflix.com,GET,Chrome/91.0.4472.124,200,2048,8192,Streaming Media,ALLOW,
+6/4/2023 16:01,192.168.1.7,Jmann,184.26.44.19,http://microsoft.com,GET,Firefox/89.0,200,1024,4096,Organization,ALLOW,
+6/4/2023 16:05,192.168.1.2,ACase,151.101.65.140,http://stackoverflow.com,GET,Edge/91.0.864.41,200,768,3072,Programming,ALLOW,
+6/4/2023 16:11,192.168.1.5,AMays,172.217.5.110,http://gmail.com,GET,Chrome/91.0.4472.124,200,512,2048,Email,ALLOW,
+6/4/2023 16:15,192.168.1.6,KHorton,184.72.106.52,http://quora.com,GET,Edge/91.0.864.41,200,1024,4096,Forums,ALLOW,
+6/4/2023 16:20,192.168.1.10,ABurke,69.171.234.21,http://messenger.com,GET,Firefox/89.0,200,2048,8192,Messaging,ALLOW,
+6/4/2023 16:23,192.168.1.9,KKirby,192.0.66.2,http://wordpress.com,GET,Chrome/91.0.4472.124,200,768,3072,Blogging,ALLOW,
+6/4/2023 16:28,192.168.1.11,JColeman,104.244.42.193,http://twitter.com,GET,Safari/13.1.1,200,512,2048,Social Networking,ALLOW,
+6/4/2023 16:33,192.168.1.12,EFisher,13.249.44.129,http://imdb.com,GET,Edge/91.0.864.41,200,1024,4096,Entertainment,ALLOW,
+6/4/2023 16:37,192.168.1.14,TShah,199.232.36.84,http://pinterest.com,GET,Chrome/91.0.4472.124,200,768,3072,Social Networking,ALLOW,
+6/4/2023 16:42,192.168.1.15,JBennett,151.101.1.164,http://news.ycombinator.com,GET,Firefox/89.0,200,2048,8192,News,ALLOW,
+6/4/2023 16:50,192.168.1.15,JBennett,151.101.194.2,http://reddit.com,GET,Firefox/89.0,200,2048,8192,Forums,ALLOW,
+6/4/2023 16:55,192.168.1.3,MKhan,192.0.66.2,http://wordpress.org,GET,Chrome/91.0.4472.124,200,768,3072,Blogging,ALLOW,
+6/4/2023 17:00,192.168.1.7,Jmann,51.89.178.210,http://freecalendars.com,GET,Firefox/89.0,200,512,2048,E-commerce,ALLOW,
+6/4/2023 17:05,192.168.1.2,ACase,204.79.197.200,http://bing.com,GET,Edge/91.0.864.41,200,1024,4096,Search Engines,ALLOW,
+6/4/2023 17:10,192.168.1.5,AMays,151.101.1.167,http://flickr.com,GET,Chrome/91.0.4472.124,200,2048,8192,Photo Sharing,ALLOW,
+6/4/2023 17:15,192.168.1.6,KHorton,31.13.71.36,http://facebook.com,GET,Edge/91.0.864.41,200,768,3072,Social Networking,ALLOW,
+6/4/2023 17:20,192.168.1.10,ABurke,216.58.192.206,http://google.com,GET,Firefox/89.0,200,512,2048,Search Engines,ALLOW,
+6/4/2023 17:25,192.168.1.9,KKirby,151.101.129.164,http://vimeo.com,GET,Chrome/91.0.4472.124,200,1024,4096,Streaming Media,ALLOW,
+6/4/2023 17:30,192.168.1.11,JColeman,104.244.42.1,http://tumblr.com,GET,Safari/13.1.1,200,2048,8192,Blogging,ALLOW,
+6/4/2023 17:35,192.168.1.12,EFisher,34.206.39.153,http://stackoverflow.com,GET,Edge/91.0.864.41,200,768,3072,Programming,ALLOW,
+6/4/2023 17:40,192.168.1.14,TShah,185.60.218.35,http://netflix.com,GET,Chrome/91.0.4472.124,200,512,2048,Streaming Media,ALLOW,
+6/4/2023 17:45,192.168.1.1,Echan,104.79.140.7,http://github.com,GET,Firefox/89.0,200,2048,8192,Software Development,ALLOW,
+6/4/2023 17:50,192.168.1.13,LMccarty,209.170.118.61,http://linkedin.com,GET,Firefox/89.0,200,768,3072,Social Networking,ALLOW,
+6/4/2023 17:55,192.168.1.4,SBielert,208.80.154.224,http://www.microsoft-updateserver.cf,GET,Firefox/89.0,200,1024,4096,Software,ALLOW,
+6/4/2023 18:00,192.168.1.8,EChan,23.21.189.88,http://twitch.tv,GET,Safari/13.1.1,200,2048,8192,Streaming Media,DENY,

README.md

@@ -1,21 +1,19 @@
 # Machine Set-Up
 
-## The Easy Way
+## The Easy Way (`install_tool.sh`)
 
-- **Get a fresh linux VM with the following specs:**
+- **Get a fresh linux VM with the following minimum specs:**
   - Ubuntu Server 20.04 LTS
   - 2 cores
   - 4GB RAM
   - 128GB Standard SSD
 
-- **Download this Repo, extract into `~` so that `~/Scripts` and `~/Files` are valid paths**
-- **From the `~` directory, run script: `./Scripts/setup.sh`**
-  - This will install all the tools and place all the files needed for the course
+- **Download and run the `install_tool.sh` script**
+  - This script will install all the tools and place all the files needed for the course
   - This might take a while (est 30-45m), so open Youtube or something
-  - You will need to press `enter` between each script -- this is so if you need to stop, you can!
-    - The script **is** safe to run multiple times if you need to stop and start again
+  - You will be able to choose between installing all units or just one unit at a time
 
-## The Hard Way
+## The Hard Way (Manual Set-Up)
 
 ### RDP Setup
 
@@ -37,17 +35,11 @@
 
 ### Unit 2: Lab
 
-- N/A - Students install their account-specific Wazuh agents during lab
+- N/A - Students download files during lab
 
 ### Unit 2: Project
 
-- Run script: `~/scripts/unit2_project.sh`
-- Tool(s) installed: N/A - Same as lab
-- Files placed:
-  - `/etc/wazuh/static.txt`
-  - `/etc/wazuh/thisisit.txt`
-  - `attack-part1`
-  - `attack-part2`
+- N/A - Students download files during project
 
 ### Unit 3: Lab
 
@@ -120,21 +112,11 @@ ftp_project
 
 ### Unit 7: Lab
 
-- Run script: `~/scripts/unit7_lab.sh`
-- Tool(s) installed: `MISP`
-- Files placed: None
-
-#### 🚨 Manual Steps
-
-- Login to 127.0.0.1 on the local machine (No port needed) 
-- Change the user/password from `[email protected]/admin` to `[email protected]/Codepath123!`
-- Click on `Sync Actions` > `Load Default Feed Metadata` > `Fetch and Store all feed data`
-- Check all the options and select `Cache All Feeds`
-  - (Note: This is NOT the blue button that says `Fetch and store all feed Data`!)
+- N/A - Students download files during lab
 
 ### Unit 7: Project
 
-- N/A - Same as Lab
+- N/A - Students download files during project
 
 ### Unit 8+
 

Scripts/setup.sh

@@ -1,5 +1,11 @@
 #!/bin/bash
 
+# Check if wget is installed
+if ! command -v wget &> /dev/null; then
+    echo -e "Installing wget..."
+    sudo apt install -y wget
+fi
+
 # Call the rdp_setup.sh script
 ./Scripts/rdp_setup.sh
 

Scripts/unit1_lab.sh

@@ -3,43 +3,60 @@ red='\033[0;31m'
 green='\033[0;32m'
 none='\033[0m'
 
+scripts_repo="https://raw.githubusercontent.com/codepath/cyb102-vm-setup/${1:-"main"}/Files/"
+
 echo "[UNIT 1 LAB] Starting script..."
 
-# Check if the script needs to run
+# Check if the Wireshark needs to be installed
 if command -v wireshark >/dev/null 2>&1 ; then
     echo -e "${green}[UNIT 1 LAB]${none} Wireshark is already installed."
-    exit 0
-fi
-echo "[UNIT 1 LAB] Installing Wireshark..."
+else
+    echo "[UNIT 1 LAB] Installing Wireshark..."
 
-# Pre-set the answer for the wireshark-common package
-echo "wireshark-common wireshark-common/install-setuid boolean true" | sudo debconf-set-selections
+    # Pre-set the answer for the wireshark-common package
+    echo "wireshark-common wireshark-common/install-setuid boolean true" | sudo debconf-set-selections
 
-# Add the Wireshark PPA
-sudo add-apt-repository -y ppa:wireshark-dev/stable
+    # Add the Wireshark PPA
+    sudo add-apt-repository -y ppa:wireshark-dev/stable
 
-# Update the package list
-sudo apt-get update
+    # Update the package list
+    sudo apt-get update
 
-# Install Wireshark in non-interactive mode
-sudo DEBIAN_FRONTEND=noninteractive apt-get install -y wireshark
+    # Install Wireshark in non-interactive mode
+    sudo DEBIAN_FRONTEND=noninteractive apt-get install -y wireshark
 
-# Print output based on whether or not Wireshark is installed
-if command -v wireshark >/dev/null 2>&1 ; then
-    echo -e "${green}[UNIT 1 LAB]${none} Wireshark installed successfully."
-else
-    echo -e "${red}[UNIT 1 LAB]${none} ERROR: Wireshark was not installed correctly!"
-    exit 1
+    # Print output based on whether or not Wireshark is installed
+    if command -v wireshark >/dev/null 2>&1 ; then
+        echo -e "${green}[UNIT 1 LAB]${none} Wireshark installed successfully."
+    else
+        echo -e "${red}[UNIT 1 LAB]${none} ERROR: Wireshark was not installed correctly!"
+        exit 1
+    fi
+fi
+
+# Ensure the lab_1 directory exists
+if [ ! -d "$HOME/lab_1" ]; then
+    mkdir -p "$HOME/lab_1"
 fi
 
-# Move everything in ../Files/lab-1 to ~ and rename it to lab_1
-if [ -e ~/lab_1 ]; then
-    echo -e "${green}[UNIT 1 LAB]${none} lab_1 already exists."
+# Download the required files into the lab_1 directory
+if [ -e "$HOME/lab_1/SMTP.pcap" ]; then
+    echo -e "${green}[UNIT 1 LAB]${none} Files already found at ~/lab_1."
 else
-    if [ -e ~/Files/lab-1 ]; then
-        sudo mv ~/Files/lab-1 ~/lab_1 && echo -e "${green}[UNIT 1 PROJECT]${none} Moved lab 1 files to ~/lab_1"
-    else
-        echo -e "${red}[UNIT 1 LAB]${none} Error: Directory ~/Files/lab-1 does not exist."
+    # Initialize a flag to indicate success
+    all_success=true
+
+    # Download the files
+    wget "${scripts_repo}unit1/DHCP.txt" -O "$HOME/lab_1/DHCP.txt" || all_success=false
+    wget "${scripts_repo}unit1/Security_log.rtf" -O "$HOME/lab_1/Security_log.rtf" || all_success=false
+    wget "${scripts_repo}unit1/SMTP.pcap" -O "$HOME/lab_1/SMTP.pcap" || all_success=false
+
+    # Verify download was successful
+    if [ "$all_success" = false ]; then
+        echo -e "${red}[UNIT 1 LAB]${none} Error: Could not download files to $HOME/lab_1 folder"
+        echo -e "${red}[UNIT 1 LAB]${none} Try downloading manually from ${scripts_repo}unit1 and placing in ~/lab_1."
         exit 1
+    else
+        echo -e "${green}[UNIT 1 LAB]${none} Files downloaded successfully."
     fi
 fi

Scripts/unit3_lab.sh

@@ -10,6 +10,16 @@ if command -v /usr/local/bin/snort >/dev/null 2>&1 ; then
     echo -e "${green}[UNIT 3 LAB]${none} Snort is already installed."
     exit 0
 fi
+
+echo -e "${yellow}WARNING: Installing Snort takes 30-60 minutes.${none}"
+echo -e "${yellow}During that time, you will need to leave your machine on and connected to the internet.${none}"
+read -p "Do you want to continue with the installation? (y/n) " -n 1 -r 
+echo
+if [[ ! $REPLY =~ ^[Yy]$ ]]; then
+    echo "Exiting the program. Goodbye!"
+    exit 1
+fi
+
 echo "[UNIT 3 LAB] Installing Snort..."
 
 # Set timezone to Eastern Time

Scripts/unit3_project.sh

@@ -2,6 +2,7 @@
 red='\033[0;31m'
 green='\033[0;32m'
 none='\033[0m'
+scripts_repo="https://raw.githubusercontent.com/codepath/cyb102-vm-setup/${1:-"main"}/Files/"
 
 echo "[UNIT 3 PROJECT] Starting script..."
 
@@ -30,14 +31,20 @@ else
     fi
 fi
 
-# Move everything in ../Files/ftp-3 to ~ and rename it to ftp_folder
+# Download the required files into the lab_1 directory
 if [ -e ~/ftp_folder ]; then
     echo -e "${green}[UNIT 3 PROJECT]${none} ftp_folder already exists."
 else
-    if [ -e ~/Files/ftp-3 ]; then
-        sudo mv ~/Files/ftp-3 ~/ftp_folder && echo -e "${green}[UNIT 3 PROJECT]${none} Moved ftp-3 files to ~/ftp_folder"
-    else
-        echo -e "${red}[UNIT 3 PROJECT]${none} Error: File ~/Files/ftp-3 does not exist."
+    # Download the files
+    wget "${scripts_repo}unit3/ftp_folder.zip" -O "$HOME/ftp_folder.zip"
+    unzip ~/ftp_folder.zip -d ~/
+
+    # Verify download was successful
+    if ! [ "$HOME/ftp_folder" ]; then
+        echo -e "${red}[UNIT 3 PROJECT]${none} Error: Could not download files to $HOME/ftp_folder"
+        echo -e "${red}[UNIT 3 PROJECT]${none} Try downloading manually from ${scripts_repo}unit3/ftp_folder.zip and placing in $HOME."
         exit 1
+    else
+        echo -e "${green}[UNIT 3 PROJECT]${none} Files downloaded successfully."
     fi
-fi
+fi