Deploy Tier 3 + Tier 4 on elliott-thinkpad (msfrpcd, Metasploitable2, optional bridge) #16
Loading…
Add table
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Context
This lab host has shipped Tier-2 episodes only —
meta.exploit.module_nameand
meta.sample.sha256are null in 100% of episodes from this host(verified on the receiver Pi). The orchestrator and fleet runner have
no bug; both auto-detect Tier-3 readiness via the
_msfrpcd_available()probe and switch automatically. What's missing is operator-side
deployment of the prerequisites.
Steps (one-time, ~20 min)
Follow AGENTS.md → "Tier 3 + Tier 4 deploy". The short version:
sudo /opt/cis490/scripts/install-msfrpcd.sh— installsmetasploit-framework + drops cis490-msfrpcd.service. ~1 GiB
download the first time.
sudo systemctl enable --now cis490-msfrpcd.serviceand confirmsystemctl is-active cis490-msfrpcd.serviceprintsactive.registration (the URL is registration-walled; the script supports
any working mirror as long as the sha256 matches). Then:
sudo /opt/cis490/scripts/setup_bridge.sh.Verify
If this prints
module loaded: vsftpd_234_backdoor (exploit/unix/ftp/vsftpd_234_backdoor)and
episode_id = 01...at the end, Tier 3 is live on elliott-thinkpad.Tier 4 (optional, follow-up)
Once Tier 3 is up, sign up for a free MalwareBazaar API key
(https://bazaar.abuse.ch/), pick one sample sha256 per family, run
fetch_sample.py, and add the sha256 + source + url fields tosamples/manifest.toml. Restart cis490-orchestrator. Thedeterministic selector will start picking real binaries automatically.
Reference
scripts/install-msfrpcd.sh,scripts/fetch-metasploitable2.shtools/run_tier3_demo.py,tools/fetch_sample.pyDon't shortcut
the orchestrator probe expects the systemd unit + the password file
at /etc/cis490/msfrpc.env.
gitignored.
hash-verifies on download.
Updated in
683bfe9— fully automated. The deploy is now ONE command:No operator URL/sha needed for Metasploitable2 (SourceForge mirror baked in, TOFU sha256 pinning), no manual metasploit-framework install (Rapid7 omnibus auto-runs), no manual manifest edits for Tier 4 (auto_fetch_samples.py walks each family if MALWAREBAZAAR_API_KEY is set). install-lab-host.sh now calls this automatically after the mTLS cert lands, so a fresh host gets Tier 3 zero-touch from the second pass.
If you've already done the install-lab-host.sh dance on this host, just pull main + run:
The script ends with a status block; paste that here and we're done.
Tier 4 is now mandatory (
5d0e8e3). install-tier-3-4.sh hard-fails if zero real binaries land. The MB API key is auto-distributed from the Pi's bootstrap.wg endpoint — operator runs scripts/set-malwarebazaar-key.sh ONCE on the Pi, lab hosts pull the key automatically.When ready on this host:
If the Pi-side key isn't provisioned yet, the script will tell you. Don't try to bypass with SKIP_TIER4 — that defeats the point of the project.
Updated again (
265f3ad). Tier 4 now uses theZoo — public security-research repo, no auth, no signup, no operator step. Zero-touch end-to-end:The deploy clones theZoo (~500MB, one-time per host, cached at /var/lib/cis490/theZoo), walks each manifest family, extracts the password-protected zip ('infected'), stages real binaries at /opt/cis490/samples/store/, and rewrites manifest.toml. Hard-fails if zero binaries land — no silent mimic-only fallback.
Safety note: theZoo contains live malware. Lab hosts run it inside the VM only (chunked upload via msfrpcd → in-session execute on Metasploitable2 → snapshot revert at episode end). It NEVER touches the lab host directly.
Ignore the earlier MalwareBazaar / bootstrap.wg secret instructions — that whole code path was removed.
Receiver now enforces a code-commit allow-list (
cc0c969). Every PUT must carry X-Cis490-Code-Commit and that commit must be in the receiver's window of recent commits to spectral/CIS490@main. The allow-list auto-refreshes from Forgejo every 5 seconds — when new code is pushed, the new hash is acceptable instantly with no service restart.What this means for this lab host:
cd /opt/cis490 && sudo -u cis490 git pull origin mainIf you ship under stale code, the receiver returns 412 with a remediation block printed verbatim into your shipper journal — exact commands to run. Don't try to bypass; the gate exists so buggy pre-fix episodes don't pollute the training set.
The 1067 episodes already collected (without code_version stamps) are unaffected — the gate only runs on new PUTs. Existing index rows stay valid; new rows gain a 'commit' field for trainer-side filtering.
The deploy steps in this issue are out of date —
install-lab-host.shandscripts/install-tier-3-4.shnow do everything end-to-end with zero operator interaction, including no Rapid7 registration:br-malware: auto-comes-up if the kernel supports it.vsftpd_234_backdoor) runs and the script returns non-zero if no episode landed.Just pull and re-run the installer:
That now also (a) drains pre-stamp episodes via
tools/quarantine_unstamped.py, and (b) restartscis490-shipper+cis490-orchestratorso the new code reaches the live daemon. See AGENTS.md → "Tier 3 + Tier 4 deploy" and "Shipper says 400/412".I'll close this issue once Tier-3 episodes start landing in the receiver index.