For this project, I customized the exploit by editing the original Python code to allow user input at runtime and implementing error handling to make the script more interactive and robust. Below are the steps I followed to implement and execute the exploit on the vulnerable VM:

1. Allow User Input: I edited the code to allow for runtime input, so the user could easily enter the endpoint and credentials.
2. Implement Error Handling: I added error handling to manage potential issues, such as incorrect file paths or network failures. The code now provides useful feedback to the user in case of errors.

3. Running the Exploit: I saved my python code under 'attack3.py', in which I then executed by running 'python3 attack3.py in the Ubuntu terminal. After running the script, I was able to access the specified file , which was'/etc/passwd'.

Securing the Virtual Machine

In order to secure the VM, I updated to the latest Gitlab patch version, which was 17.5.1. Here are some steps I took in order to do so:

1. Verify current version:
gitlab-rake gitlab:env:info
2. Backup Gitlab data:
sudo gitlab-backup create
3. Install latest Gitlab version:
sudo apt-get update sudo apt-get install gitlab-ee
4. Restart Gitlab:
sudo gitlab-ctl restart
5. Verify the update:
gitlab-rake gitlab:env:info

Administering the Machine:

To administer the VM effectively, I implemented several measures to ensure secure and efficient management. These included restricting administrative access, applying regular updates, and following best practices for system administration:

Conclusion and Reflections

This project was an incredible learning experience that allowed me to delve deep into the lifecycle of a virtual machine—from building and exploiting vulnerabilities to securing and administering it. By exploiting CVE-2022-2825, I gained valuable insights into identifying and mitigating real-world security threats. The process of securing the VM reinforced the importance of proactive system maintenance and staying updated with the latest patches and best practices.

Through this mentorship program, I honed my skills in:

• Setting up and configuring virtual machines.
• Researching and implementing security patches for known vulnerabilities.
• Adapting existing exploits and integrating user input for testing purposes.
• Administering and hardening systems against potential threats.

Overall, this experience has strengthened my technical abilities and deepened my understanding of cybersecurity. It has also underscored the critical role of vigilance and continuous learning in protecting systems against evolving threats.

I am grateful for the guidance provided by the MassCyberCenter mentorship program and look forward to applying these skills to future challenges in cybersecurity.