setc/setc_config_schema.json at main · hackgnar/setc · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://github.com/setc/setc_config_schema.json",
  "title": "SETC Configuration",
  "description": "Schema for SETC (Security Exploit Telemetry Collection) configuration files. Each config is an array of exploit entries targeting vulnerable Docker containers.",
  "type": "array",
  "minItems": 1,
  "items": {
    "type": "object",
    "title": "Exploit Entry",
    "description": "A single exploit entry defining a target and the Metasploit exploit to run against it.",
    "required": ["name", "settings"],
    "additionalProperties": false,
    "properties": {
      "name": {
        "type": "string",
        "title": "CVE / Exploit Name",
        "description": "Unique identifier for this entry, typically a CVE ID (e.g. CVE-2021-42013)."
      },
      "settings": {
        "type": "object",
        "title": "Exploit Settings",
        "description": "Configuration for the target environment and Metasploit exploit.",
        "required": ["description"],
        "additionalProperties": true,
        "properties": {
          "description": {
            "type": "string",
            "title": "Description",
            "description": "Human-readable description of the vulnerability or exploit."
          },
          "exploit": {
            "type": "string",
            "title": "Metasploit Exploit Module",
            "description": "Metasploit module path (e.g. multi/http/struts2_multi_eval_ognl). Omit or leave empty for manual exploit mode."
          },
          "target_image": {
            "type": "string",
            "title": "Target Docker Image",
            "description": "Docker image containing the vulnerable service (single-container mode)."
          },
          "yml_file": {
            "type": "string",
            "title": "Docker Compose File",
            "description": "Path to docker-compose YAML for multi-container targets. Supports $SETC_PATH and $VULN_PATH env vars."
          },
          "target_name": {
            "type": "string",
            "title": "Target Container Name",
            "description": "Name of the target container within the docker-compose environment."
          },
          "exploit_options": {
            "type": "string",
            "title": "Metasploit Options",
            "description": "Additional MSF console commands (e.g. 'set PAYLOAD cmd/unix/reverse_bash;set RPORT 9080;')."
          },
          "exploit_success_pattern": {
            "type": "string",
            "title": "Exploit Success Pattern",
            "description": "Regex pattern to detect successful exploitation in MSF output."
          },
          "target_delay": {
            "type": ["string", "integer"],
            "title": "Target Startup Delay",
            "description": "Seconds to wait after starting the target container before exploitation. Default: 0.",
            "minimum": 0
          },
          "exploit_retries": {
            "type": ["string", "integer"],
            "title": "Exploit Retries",
            "description": "Number of times to retry the exploit before giving up. Default: 4.",
            "minimum": 0
          },
          "exploit_check_delay": {
            "type": ["string", "integer"],
            "title": "Exploit Check Delay",
            "description": "Seconds between status checks during exploit execution. Default: 3.",
            "minimum": 0
          },
          "exploit_check_count": {
            "type": ["string", "integer"],
            "title": "Exploit Check Count",
            "description": "Number of status checks per exploit attempt. Default: 7.",
            "minimum": 0
          },
          "ready_delay": {
            "type": ["string", "integer"],
            "title": "Ready Check Delay",
            "description": "Seconds to wait between target readiness checks. Default: 5.",
            "minimum": 0
          },
          "ready_retries": {
            "type": ["string", "integer"],
            "title": "Ready Check Retries",
            "description": "Number of readiness checks before giving up. Default: 5.",
            "minimum": 0
          },
          "exploit_mode": {
            "type": "string",
            "enum": ["cli", "rpc"],
            "title": "Exploit Mode",
            "description": "How to interact with Metasploit. 'cli' uses msfconsole -x (default). 'rpc' uses the MSGRPC API for structured job/session tracking.",
            "default": "cli"
          }
        },
        "oneOf": [
          {
            "title": "Single Container Target",
            "description": "Use a single Docker image as the vulnerable target.",
            "required": ["target_image"],
            "not": {
              "required": ["yml_file"]
            }
          },
          {
            "title": "Docker Compose Target",
            "description": "Use a docker-compose file to set up a multi-container target environment.",
            "required": ["yml_file", "target_name"],
            "not": {
              "required": ["target_image"]
            }
          }
        ]
      }
    }
  }
}