# Cyber Attack and Defense Emulation Agents
## 4 Red Team Agent
### Red Team Agent's State  
The state represents the information of the red team agent performing attacks. Each state corresponds to a single node (system) under the current attack. Table 1 depicts the fields (keys) of the state.  
* 'Address' is an address of the target node. The address has a form of 'x.x.x.x.'
* 'Protocol' is a protocol to access the target node. The most common protocol is IPv4.
* 'OS' represents the operating system installed on the target node. The red team agent executes an attack technique by inputting its 'Commands' field. Because commands to be sent are different according to the operating system. Thus, identifying the target system's OS is essential. Using the identified OS information, the red team agent can list up the possibly exploitable vulnerabilities in advance.
* 'Ports' is a list of port numbers. These ports will be the access point to the target node by the red team agent. The list contains the opened-port numbers, and the list can have one or more open ports if the target server runs one or more services. This field is valid only if 'Protocol' is IPv4 or IPv6.
* 'Shell' indicates the state of shells. Each shell can have one of three values: 'TEMPORAL', 'DOWNLOADED', and 'PERMANENT'. 'TEMPORAL' is the state that the red team agent temporally takes the current shell. If the connected process is terminated, the red team agent loses the shell. 'DOWNLOADED' is the state that the red team agent has sent a binary such as RAT to the target node to acquire the shell permanently. 'PERMANENT' is the state that the red team agent has acquired the permanent shell after DOWNLOADED state is over. Even if binaries like RAT are terminated, they would be consistently rebooted to make the red team agent secure the shell to access the target node. For instance, using 'cron', a job scheduler in Unix-like OS, it is possible to set the installed binaries to be rebooted periodically in case they get terminated.
* 'Privilege' is a level of acquired authority over the target node. There are two types of privilege. One is an administrative authority (superuser) which is the highest level of granted permission. The other type is a regular authority (regular user). If the red team agent gained only the regular authority, the behavior is restricted in the target node.
* 'Binaries' is a list of binaries (executable programs) installed on the target node. It can be further used after the red team agent has successfully intruded into the target node.
* 'CWD' is a current working directory of the shell. Based on this information, the red team agent can know an absolute path and a relative path of the file system on the target node.
* 'Misudo' is an array of exploitable sudo configurations. For instance,'sudofind' can be an element of this array, because it makes 'find' command be executed without the root password. The red team agent can determine if the target node has any sudo related misconfiguration.  
The state is used to verify the pre-conditions of each attack technique. The red team agent can identify what attack techniques it can use. The red team agent updates the state after using each attack technique referring to their post-conditions. After the attack successfully works, the red team agent acquires the higher authority. Then the 'Privilege' field of the state changes from the regular user to the superuser.  
The state is also used to judge the red team agent's goal against the target node. Let us assume that the objective of the red team agent is \"obtaining a permanent shell and an administrative authority\". Then, the red team agent attacks the target node until the following statement of the state is fulfilled: _Shell == PERMANENT && Privilege == ADMINISTRATIVE && Address == Target_Node's_Address._