Merge pull request #1396 from guardicore/docs-contribute-exploits

Add 'Adding Exploits' page to docs

docs/content/development/_index.md

@@ -24,7 +24,7 @@ You can take a look at [our roadmap](https://github.com/guardicore/monkey/projec
 
 ### More exploits! 💥
 
-The best way to find weak spots in a network is by attacking it. The [exploit template](https://github.com/guardicore/monkey/wiki/Exploit-templates) page will help you add exploits.
+The best way to find weak spots in a network is by attacking it. The [*Adding Exploits*](./adding-exploits/) page will help you add exploits.
 
 It's important to note that the Infection Monkey must be absolutely reliable. Otherwise, no one will use it, so avoid memory corruption exploits unless they're rock solid and focus on the logical vulns such as Shellshock.
 

docs/content/development/adding-exploits.md

@@ -1,7 +1,110 @@
 ---
 title: "Adding Exploits"
 date: 2020-06-08T19:53:00+03:00
-draft: true
+draft: false
 tags: ["contribute"]
 weight: 50
 ---
+
+## What does this guide cover?
+
+This guide will show you how to add a new _Exploit_ to the Infection Monkey.
+
+An exploit is a sequence of commands that takes advantage of a security vulnerability to gain unauthorized access to a system on your network. If successful, an Infection Monkey agent is released on the exploited system. The result of an attempted exploit is sent back to the Monkey Island as part of the telemetry.
+
+### Do I need a new Exploit?
+
+If all you want to do is execute a shell command, configure the required commands in the Monkey Island's post-breach action (PBA) configuration section or [add a new PBA](../adding-post-breach-actions/). If you would like the Infection Monkey agent to collect specific information, [add a new System Info Collector](../adding-system-info-collectors/).
+
+However, if you have your eye on an interesting CVE that you would like the Infection Monkey to support, you must add a new exploit. Keep reading to learn how to add a new exploit.
+
+
+## How to add a new Exploit
+
+### Modify the Infection Monkey Agent
+
+The Infection Monkey exploiters are all built in a similar way. Each exploiter class inherits from the [`HostExploiter`](https://github.com/guardicore/monkey/blob/develop/monkey/infection_monkey/exploit/HostExploiter.py) class, which exposes two interface functions:
+
+* `is_os_supported` - Returns a boolean value denoting whether the victim machine is supported by the exploiter (for example, returns `False` on Windows victim machines for the `SSHExploiter`). This can be used to thoroughly inspect a potential victim machine and decide whether to attempt the exploit on that particular machine (for example, by checking for open services matching specific versions).
+* `exploit_host` - Exploits the host and returns a boolean value indicating whether or not the exploit was successful.
+
+#### Adding a new exploiter
+
+In the [Infection Monkey's exploit directory](https://github.com/guardicore/monkey/tree/develop/monkey/infection_monkey/exploit), add the **exploit's logic** by defining a new class that inherits from [`HostExploiter`](https://github.com/guardicore/monkey/blob/develop/monkey/infection_monkey/exploit/HostExploiter.py). If your new exploit is a web RCE (remote code execution) exploit, inherit from [`WebRCE`](https://github.com/guardicore/monkey/blob/develop/monkey/infection_monkey/exploit/web_rce.py).
+
+```py
+from infection_monkey.exploit.HostExploiter import HostExploiter
+
+class MyNewExploiter(HostExploiter):
+    ...
+```
+
+A good example of an exploiter class is the [`SSHExploiter`](https://github.com/guardicore/monkey/blob/develop/monkey/infection_monkey/exploit/sshexec.py). The [Drupal exploiter is a recently added web RCE exploit](https://github.com/guardicore/monkey/pull/808) that is a good reference as well.
+
+
+### Modify the Monkey Island
+
+#### Configuration
+
+1. Add your **exploiter's description** to the [configuration schema](https://github.com/guardicore/monkey/blob/develop/monkey/monkey_island/cc/services/config_schema/definitions/exploiter_classes.py).
+
+```py
+...
+    {
+        "type": "string",
+        "enum": ["SmbExploiter"],
+        "title": "SMB Exploiter",
+        "safe": True,
+        "attack_techniques": ["T1110", "T1075", "T1035"],
+        "info": "Brute forces using credentials provided by user and hashes gathered by mimikatz.",
+        "link": "https://www.guardicore.com/infectionmonkey/docs/reference/exploiters/smbexec/",
+    },
+    {
+        "type": "string",                                                           <=================================
+        "enum": ["MyNewExploiter"],                                                 <=================================
+        "title": "My New Exploiter",                                                <=================================
+        "safe": True,                                                               <=================================
+        "attack_techniques": [],                                                    <=================================
+        "info": "Information about your new exploiter.",                            <=================================
+        "link": "Link to the documentation page explaining your new exploiter.",    <=================================
+    },
+...
+```
+
+2. Update the default **list of exploiters** in the [configuration schema](https://github.com/guardicore/monkey/blob/develop/monkey/monkey_island/cc/services/config_schema/basic.py) by adding your new exploiter's class name.
+
+```py
+...
+    "exploiter_classes": {
+        "title": "Exploiters",
+        "type": "array",
+        "uniqueItems": True,
+        "items": {"$ref": "#/definitions/exploiter_classes"},
+        "default": [
+            "SmbExploiter",
+            ...
+            "DrupalExploiter",
+            "MyNewExploiter",    <=================================
+        ],
+    }
+...
+```
+
+#### Reporting
+
+1. In the [report generation pipeline](https://github.com/guardicore/monkey/blob/develop/monkey/monkey_island/cc/services/reporting/issue_processing/exploit_processing/exploiter_descriptor_enum.py), define how your **exploiter's data** should be processed and displayed in the report. Use the default `ExploitProcessor` or create a custom exploit processor if needed.
+
+```py
+class ExploiterDescriptorEnum(Enum):
+    SMB = ExploiterDescriptor("SmbExploiter", "SMB Exploiter", CredExploitProcessor)
+    ...
+    ZEROLOGON = ExploiterDescriptor("ZerologonExploiter", "Zerologon Exploiter", ZerologonExploitProcessor)
+    MYNEWEXPLOITER = ExploitDescriptor("MyNewExploiter", "My New Eexploiter", ExploitProcessor)    <=================================
+```
+
+2. Describe how the Monkey Island should **display your exploiter's results** by defining the UI contents in the [security report](https://github.com/guardicore/monkey/blob/develop/monkey/monkey_island/cc/ui/src/components/report-components/SecurityReport.js).
+
+
+### Documentation
+
+**Update the documentation** to explain what your exploiter does in the [documentation framework](https://github.com/guardicore/monkey/blob/develop/docs/content/reference/exploiters/).

docs/content/development/adding-post-breach-actions.md

@@ -16,7 +16,7 @@ If all you want to do is execute shell commands, then there's no need to add a n
 
 ## How to add a new PBA
 
-### From the Infection Monkey Side
+### Modify the Infection Monkey Agent
 
 #### Framework
 
@@ -43,7 +43,7 @@ If your PBA consists only of simple shell commands, you can reuse the generic PB
 
 Otherwise, you'll need to override the `run` method with your own implementation. See the `communicate_as_new_user.py` PBA for reference. Make sure to send the relevant PostBreachTelem upon success/failure. You can log during the PBA as well.
 
-### From the Monkey Island Side
+### Modify the Monkey Island
 
 #### Configuration
 

docs/content/development/adding-system-info-collectors.md

@@ -14,9 +14,9 @@ This guide will show you how to create a new _System Info Collector_ for the Inf
 
 If all you want to do is execute a shell command, then there's no need to add a new System Info Collector - just configure the required commands in the Monkey Island's post-breach action (PBA) section! Also, if there is a relevant System Info Collector and you only need to add more information to it, simply expand the existing one. Otherwise, you must add a new System Info Collector.
 
-## How to add a new System Info Collector 
+## How to add a new System Info Collector
 
-### From the Monkey Island Side
+### Modify the Infection Monkey Agent
 
 #### Framework
 
@@ -41,7 +41,7 @@ class MyNewCollector(SystemInfoCollector):
 
 Override the `collect` method with your own implementation. See the `EnvironmentCollector.py` System Info Collector for reference. You can log during collection as well.
 
-### From the Monkey Island Side
+### Modify the Monkey Island
 
 #### Configuration
 

docs/content/development/setup-development-environment.md

@@ -10,7 +10,7 @@ tags: ["contribute"]
 
 To set up a development environment using scripts, look at the readme under [`/deployment_scripts`](https://github.com/guardicore/monkey/blob/develop/deployment_scripts). If you want to set it up manually or run into problems, keep reading.
 
-## Agent
+## The Infection Monkey Agent
 
 The agent (which we sometimes refer to as the Infection Monkey) is a single Python project under the [`infection_monkey`](https://github.com/guardicore/monkey/blob/master/monkey/infection_monkey) folder. The Infection Monkey agent was built for Python 3.7. You can get it up and running by setting up a [virtual environment](https://docs.python-guide.org/dev/virtualenvs/) and installing the requirements listed in the [`requirements.txt`](https://github.com/guardicore/monkey/blob/master/monkey/infection_monkey/requirements.txt) inside it.