lab updates

Author: RootLUG

README.md

@@ -9,35 +9,23 @@ NOTICE: this repository also contains malware samples, it is possible your AV so
 Instructions & prerequisites:
 -----------------------------
 
-- [docker compose](https://docs.docker.com/compose/)
-- copy of this repository
-- all the commands should be run in the same directory hwere you cloned the repository. docker compose will pick up the configuration file automatically
-- run `docker compose pull` to pull the dependencies
-- run `docker compose build` to build the custom container with preinstalled tools
+- Access to Stratus (stratus.fi.muni.cz)
+  - make sure to configure your SSH key under Settings -> Auth -> Public SSH Key
 
-  - if there are updates, you need to re-run this step, run `docker compose down` first to remove any previous work
+![sshkey.png](sshkey.png)
 
-- run `docker compose up -d` to start the containers. You should see containers `postgres` and `vault` as running in logs.
 
-  - Check that there is no error in those two containers!
-  - run `docker compose down` to shutdown the running containers
 
-    - shutting down all containers will also remove all data, all work/modifications you have done will be reset
-    - you can use this to reset your environment if you misconfigure something
+Installation:
+---
 
-- you are now ready for the exercise!
+Create a Debian12 VM machine with the default options:
 
+![vm_creation.png](vm_creation.png)
 
-Manual installation
--------------------
 
-If there is a problem with the docker compose containers or you wish to not use the docker then the following software is required:
-
-- password protected PostgreSQL instance + postgres client
-- [Hashicorp Vault](https://www.vaultproject.io)
-- python3 with venv, build and pip modules installed
-- [diffoscope & strip-nondeterminism tools](https://reproducible-builds.org/tools/)
-- gcc
-
-You can also refer to the included docker configuration files which basically contains installation instructions of all dependencies into ubuntu
+When the VM boots up, login via ssh and run the following command:
 
+```shell
+curl "https://raw.githubusercontent.com/SourceCode-AI/secure_coding/refs/heads/master/install_debian.sh"|bash
+```

cheat_sheet.md

@@ -1,52 +1,3 @@
-Reproducible builds exercise
-============================
-
-Reproducing a package ~ 20min
-
-```shell
-root@7ccad3d01d39:/# cd /local_data/python_package/
-
-root@7ccad3d01d39:/secure_coding//python_package# ls
-pyproject.toml  secure_coding_demo_package
-
-root@7ccad3d01d39:/secure_coding/python_package# python3 -m build
-...
-Successfully built secure_coding_demo_package-0.0.1.tar.gz and secure_coding_demo_package-0.0.1-py3-none-any.whl
-
-
-root@7ccad3d01d39:/secure_coding/python_package# diffoscope dist/secure_coding_demo_package-0.0.1-py3-none-any.whl /secure_coding/prebuild_package/secure_coding_demo_package-0.0.1-py3-none-any.whl
-
-root@7ccad3d01d39:/secure_coding/python_package# mkdir /secure_coding/html
-root@7ccad3d01d39:/secure_coding/python_package# diffoscope dist/secure_coding_demo_package-0.0.1-py3-none-any.whl /secure_coding/prebuild_package/secure_coding_demo_package-0.0.1-py3-none-any.whl --html-dir /local_data/html
-
-root@7ccad3d01d39:/secure_coding/python_package# strip-nondeterminism dist/secure_coding_demo_package-0.0.1-py3-none-any.whl
-root@7ccad3d01d39:/secure_coding/python_package# diffoscope dist/secure_coding_demo_package-0.0.1-py3-none-any.whl /local_data/prebuild_package/secure_coding_demo_package-0.0.1-py3-none-any.whl
-root@7ccad3d01d39:/secure_coding/python_package# md5sum dist/secure_coding_demo_package-0.0.1-py3-none-any.whl /local_data/prebuild_package/secure_coding_demo_package-0.0.1-py3-none-any.whl
-
-e11a303eef41e70032b4130652e740be  dist/secure_coding_demo_package-0.0.1-py3-none-any.whl
-e11a303eef41e70032b4130652e740be  /secure_coding/prebuild_package/secure_coding_demo_package-0.0.1-py3-none-any.whl
-```
-
-
-compare compiled code ~5 min
-```shell
-root@8157f590f783:/# cd /local_data/
-root@8157f590f783:/local_data# diff hello_world.c malwaretest.c
-4c4
-< 	printf("Hello world\n");
----
-> 	printf("malwaretest\n");
-
-
-gcc hello_world.c -o a.out
-gcc malwaretest.c -o b.out
-
-diffoscope a.out b.out
-
-```
-
-CTX Malware exercise ~ 15 min
-
 
 Vault
 =====
@@ -59,6 +10,7 @@ Vault KV
 ```bash
 # verify creds
 vault status
+# vault operator unseal
 vault login
 
 # Store secret
@@ -91,36 +43,11 @@ curl -H "X-Vault-Request: true" -H "X-Vault-Token: $(vault print token)" http://
 ```
 
 
-
 Vault PostgresQL Integration
 ============================
 
 ~ 20 min
 
-Setup DB
-```shell
-root@debian12:~# sudo -u postgres psql -c "create role vault with login superuser password 'insecure'";
-could not change directory to "/root": Permission denied
-CREATE ROLE
-
-root@debian12:~# psql --user vault --password --host 172.26.7.80 --db secure_db
-Password:
-psql (15.12 (Debian 15.12-0+deb12u2))
-SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, compression: off)
-Type "help" for help.
-
-secure_db=# create table users (name VARCHAR(255));
-CREATE TABLE
-secure_db=# insert into users values ('john doe');
-INSERT 0 1
-secure_db=# select * from users;
-   name
-----------
- john doe
-(1 row)
-
-secure_db=# exit
-```
 
 Configure vault
 ```shell
@@ -159,3 +86,77 @@ secure_data=> INSERT INTO users VALUES ('ratata');
 ERROR:  permission denied for table users
 ```
 
+
+
+Reproducible builds exercise
+============================
+
+Reproducing a package ~ 20min
+
+```shell
+root@debian12:/secure_coding# cd /secure_coding/local_data/
+root@debian12:/secure_coding/local_data# tree
+.
+├── hello_world.c
+├── malwaretest.c
+├── prebuild_package
+│   └── secure_coding_demo_package-0.0.1-py3-none-any.whl
+└── python_package
+    ├── pyproject.toml
+    └── secure_coding_demo_package
+        ├── __init__.py
+        └── sneaky_package
+            └── __init__.py
+
+5 directories, 6 files
+
+
+root@debian12:/secure_coding/local_data# cd python_package/
+root@debian12:/secure_coding/local_data/python_package# python3 -m build
+...
+Successfully built secure_coding_demo_package-0.0.1.tar.gz and secure_coding_demo_package-0.0.1-py3-none-any.whl
+
+
+root@debian12:/secure_coding/local_data/python_package# strip-nondeterminism dist/secure_coding_demo_package-0.0.1-py3-none-any.whl
+root@debian12:/secure_coding/local_data/python_package# strip-nondeterminism dist/secure_coding_demo_package-0.0.1-py3-none-any.whl
+root@debian12:/secure_coding/local_data/python_package# diffoscope dist/secure_coding_demo_package-0.0.1-py3-none-any.whl ../prebuild_package/secure_coding_demo_package-0.0.1-py3-none-any.whl
+root@debian12:/secure_coding/local_data/python_package# md5sum dist/secure_coding_demo_package-0.0.1-py3-none-any.whl ../prebuild_package/secure_coding_demo_package-0.0.1-py3-none-any.whl
+81cab8eab03f8255a8c05bb014c40824  dist/secure_coding_demo_package-0.0.1-py3-none-any.whl
+81cab8eab03f8255a8c05bb014c40824  ../prebuild_package/secure_coding_demo_package-0.0.1-py3-none-any.whl
+
+root@7ccad3d01d39:/secure_coding/python_package# mkdir /secure_coding/html
+root@7ccad3d01d39:/secure_coding/python_package# diffoscope dist/secure_coding_demo_package-0.0.1-py3-none-any.whl /secure_coding/prebuild_package/secure_coding_demo_package-0.0.1-py3-none-any.whl --html-dir /local_data/html
+
+
+```
+
+
+compare compiled code ~5 min
+```shell
+root@debian12:/secure_coding/local_data# cd /secure_coding/local_data/
+root@debian12:/secure_coding/local_data# ls
+hello_world.c  malwaretest.c  prebuild_package	python_package
+root@debian12:/secure_coding/local_data# cat hello_world.c
+root@debian12:/secure_coding/local_data# cat malwaretest.c
+
+root@debian12:/secure_coding/local_data# gcc hello_world.c -o a.out
+root@debian12:/secure_coding/local_data# gcc malwaretest.c -o b.out
+root@debian12:/secure_coding/local_data# ls
+a.out  b.out  hello_world.c  malwaretest.c  prebuild_package  python_package
+root@debian12:/secure_coding/local_data# diffoscope a.out b.out
+
+```
+
+CTX Malware exercise ~ 15 min
+---
+
+
+```shell
+root@debian12:/secure_coding/local_data# mkdir /var/www/html/diffoscope
+root@debian12:/secure_coding/local_data# diffoscope a.out wannabe_ransomware --html-dir /var/www/html/diffoscope
+
+root@debian12:/secure_coding# cd /secure_coding/malware/
+root@debian12:/secure_coding/malware# ls
+b40297af54e3f99b02e105f013265fd8d0a1b1e1f7f0b05bcb5dbdc9125b3bb5.gz  ctx-0.1.2.tar.gz
+root@debian12:/secure_coding/malware# diffoscope ctx-0.1.2.tar.gz b40297af54e3f99b02e105f013265fd8d0a1b1e1f7f0b05bcb5dbdc9125b3bb5.gz
+```

install_debian.sh

@@ -1,5 +1,12 @@
 #!/bin/bash
 
+
+if [ "$EUID" -ne 0 ]
+  then echo "Please run as root"
+  exit
+fi
+
+
 cd /
 apt-get update
 apt-get install -y gpg
@@ -8,7 +15,7 @@ wget -O - https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/sh
 echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
 
 apt-get update
-apt-get install -y  nano gcc wget jq screen python3-venv python3-pip strip-nondeterminism tree postgresql postgresql-client vault git python3-pip xxd binutils-multiarch openssl
+apt-get install -y  nano gcc wget jq screen python3-venv python3-pip strip-nondeterminism tree postgresql postgresql-client vault git python3-pip xxd binutils-multiarch openssl nginx
 
 apt-get install -y diffoscope-minimal --no-install-suggests --no-install-recommends
 pip install build==1.2.1 wheel==0.43.0 setuptools==61.0 --break-system-packages
@@ -23,8 +30,8 @@ echo "host    all             all              ::/0                            s
 #PG_PASSWD=$(openssl rand -hex 16)
 sudo -u postgres createdb secure_db
 sudo -u postgres psql -c "create role vault with login superuser password 'not_so_secure_default_password'";
-sudo -u postgres psql -c --db secure_db "create table users (name VARCHAR(255));";
-sudo -u postgres psql -c --db secure_db "insert into users values ('john doe');";
+sudo -u postgres psql --db secure_db -c "create table users (name VARCHAR(255));";
+sudo -u postgres psql --db secure_db -c "insert into users values ('john doe');";
 systemctl restart postgresql
 
 #pip3 install build --break-system-packages