p15670423
/
monkey
1
0
Fork 5
Code Issues Pull Requests 3 Projects Releases Wiki Activity

Merge pull request #1082 from guardicore/swimm-verify 

Swimm verify
This commit is contained in:
Shreya Malviya 2021-04-08 17:31:31 +05:30 committed by GitHub
parent ccbf4f0117 2f8441f1d5
commit 4d951e2a8a
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
6 changed files with 264 additions and 255 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

156
.swm/AzD8XysWg1BBXCjCDkfq.swm
View File

@ -1,92 +1,86 @@
{ {
"id": "AzD8XysWg1BBXCjCDkfq", "id": "AzD8XysWg1BBXCjCDkfq",
"name": "Add a new configuration setting to the Agent ⚙", "name": "Add a new configuration setting to the Agent ⚙",
"task": {
"dod": "Make the max victim number that Monkey will find before stopping configurable by the user instead of constant.", "dod": "Make the max victim number that Monkey will find before stopping configurable by the user instead of constant.",
"description": "# Make something configurable\n\nIn this unit, you will learn how to add a configuration option to Monkey and how to use it in the Monkey Agent code. \n\n![computer fire](https://media.giphy.com/media/7J4P7cUur2DlErijp3/giphy.gif \"computer fire\")\n\n## Why is this important?\n\nEnabling users to configure the Monkey's behaviour gives them a lot more freedom in how they want to use the Monkey and enables more use cases.\n\n## What is \"Max victims to find\"?\n\nThe Monkey has a function which finds \"victim\" machines on the network for the Monkey to try and exploit. It's called `get_victim_machines`. This function accepts an argument which limits how many machines the Monkey should find.\n\nWe want to make that value editable by the user instead of constant in the code.\n\n## Manual testing\n\n1. After you've performed the required changes, reload the Server and check your value exists in the Internal tab of the config (see image).\n\n![](https://i.imgur.com/e0XAxuV.png)\n\n2. Set the new value to 1, and run Monkey locally (from source). See that the Monkey only scans one machine.",
"summary": "* When changing config schema by adding or deleting keys, you need to update the Blackbox Test configurations as well [here](https://github.com/guardicore/monkey/tree/develop/envs/monkey_zoo/blackbox/island_configs).",
"hunksOrder": [
"monkey/infection_monkey/config.py_0",
"monkey/infection_monkey/monkey.py_0",
"monkey/monkey_island/cc/services/config_schema/internal.py_0"
],
"tests": [], "tests": [],
"hints": [ "hints": [
"Look for `victims_max_exploit` - it's rather similar." "Look for `victims_max_exploit` - it's rather similar."
]
},
"content": [
{
"type": "text",
"text": "# Make something configurable\n\nIn this unit, you will learn how to add a configuration option to Monkey and how to use it in the Monkey Agent code. \n\n![computer fire](https://media.giphy.com/media/7J4P7cUur2DlErijp3/giphy.gif \"computer fire\")\n\n## Why is this important?\n\nEnabling users to configure the Monkey's behaviour gives them a lot more freedom in how they want to use the Monkey and enables more use cases.\n\n## What is \"Max victims to find\"?\n\nThe Monkey has a function which finds \"victim\" machines on the network for the Monkey to try and exploit. It's called `get_victim_machines`. This function accepts an argument which limits how many machines the Monkey should find.\n\nWe want to make that value editable by the user instead of constant in the code.\n\n## Manual testing\n\n1. After you've performed the required changes, reload the Server and check your value exists in the Internal tab of the config (see image).\n\n![](https://i.imgur.com/e0XAxuV.png)\n\n2. Set the new value to 1, and run Monkey locally (from source). See that the Monkey only scans one machine."
},
{
"type": "snippet",
"path": "monkey/infection_monkey/config.py",
"comments": [],
"firstLineNumber": 126,
"lines": [
" exploiter_classes = []",
" system_info_collector_classes = []",
" ",
"* # how many victims to look for in a single scan iteration\r",
"* victims_max_find = 100\r",
" ",
" # how many victims to exploit before stopping",
" victims_max_exploit = 100"
]
},
{
"type": "snippet",
"path": "monkey/infection_monkey/monkey.py",
"comments": [],
"firstLineNumber": 159,
"lines": [
" ",
" if not self._keep_running or not WormConfiguration.alive:",
" break",
"*",
"* machines = self._network.get_victim_machines(",
"* max_find=WormConfiguration.victims_max_find,",
"* stop_callback=ControlClient.check_for_stop,",
"* )",
" is_empty = True",
" for machine in machines:",
" if ControlClient.check_for_stop():"
]
},
{
"type": "snippet",
"path": "monkey/monkey_island/cc/services/config_schema/internal.py",
"comments": [],
"firstLineNumber": 39,
"lines": [
" \"title\": \"Monkey\",",
" \"type\": \"object\",",
" \"properties\": {",
"* \"victims_max_find\": {",
"* \"title\": \"Max victims to find\",",
"* \"type\": \"integer\",",
"* \"default\": 100,",
"* \"description\": \"Determines the maximum number of machines the monkey is allowed to scan\",",
"* },",
" \"victims_max_exploit\": {",
" \"title\": \"Max victims to exploit\",",
" \"type\": \"integer\","
]
},
{
"type": "text",
"text": "* When changing config schema by adding or deleting keys, you need to update the Blackbox Test configurations as well [here](https://github.com/guardicore/monkey/tree/develop/envs/monkey_zoo/blackbox/config_templates)."
}
], ],
"play_mode": "all", "symbols": {},
"swimmPatch": { "file_version": "2.0.1",
"monkey/infection_monkey/config.py": { "meta": {
"diffType": "MODIFIED", "app_version": "0.4.1-1",
"fileDiffHeader": "diff --git a/monkey/infection_monkey/config.py b/monkey/infection_monkey/config.py\nindex 1fbcb876..67ed19de 100644\n--- a/monkey/infection_monkey/config.py\n+++ b/monkey/infection_monkey/config.py", "file_blobs": {
"hunks": [ "monkey/infection_monkey/config.py": "7aeaccee2a663d2b69d62d4692acc2aa24e2d1f7",
{ "monkey/infection_monkey/monkey.py": "7123d8b9ef8c02870534bdf0008df1245bb1392a",
"swimmHunkMetadata": { "monkey/monkey_island/cc/services/config_schema/internal.py": "890e74efab70c4610f4a17cc531e09e5afcb5368"
"hunkComments": []
},
"hunkDiffLines": [
"@@ -131,8 +131,6 @@",
" exploiter_classes = []\r",
" system_info_collector_classes = []\r",
" \r",
"- # how many victims to look for in a single scan iteration\r",
"- victims_max_find = 100\r",
" \r",
" # how many victims to exploit before stopping\r",
" victims_max_exploit = 100\r"
]
} }
]
},
"monkey/infection_monkey/monkey.py": {
"diffType": "MODIFIED",
"fileDiffHeader": "diff --git a/monkey/infection_monkey/monkey.py b/monkey/infection_monkey/monkey.py\nindex 444bde45..ff23f671 100644\n--- a/monkey/infection_monkey/monkey.py\n+++ b/monkey/infection_monkey/monkey.py",
"hunks": [
{
"swimmHunkMetadata": {
"hunkComments": []
},
"hunkDiffLines": [
"@@ -159,8 +159,6 @@",
" if not self._keep_running or not WormConfiguration.alive:\r",
" break\r",
" \r",
"- machines = self._network.get_victim_machines(max_find=WormConfiguration.victims_max_find,\r",
"- stop_callback=ControlClient.check_for_stop)\r",
" is_empty = True\r",
" for machine in machines:\r",
" if ControlClient.check_for_stop():\r"
]
} }
]
},
"monkey/monkey_island/cc/services/config_schema/internal.py": {
"diffType": "MODIFIED",
"fileDiffHeader": "diff --git a/monkey/monkey_island/cc/services/config_schema/internal.py b/monkey/monkey_island/cc/services/config_schema/internal.py\nindex bdbae246..d6042d35 100644\n--- a/monkey/monkey_island/cc/services/config_schema/internal.py\n+++ b/monkey/monkey_island/cc/services/config_schema/internal.py",
"hunks": [
{
"swimmHunkMetadata": {
"hunkComments": []
},
"hunkDiffLines": [
"@@ -40,12 +40,6 @@",
" \"title\": \"Monkey\",\r",
" \"type\": \"object\",\r",
" \"properties\": {\r",
"- \"victims_max_find\": {\r",
"- \"title\": \"Max victims to find\",\r",
"- \"type\": \"integer\",\r",
"- \"default\": 100,\r",
"- \"description\": \"Determines the maximum number of machines the monkey is allowed to scan\"\r",
"- },\r",
" \"victims_max_exploit\": {\r",
" \"title\": \"Max victims to exploit\",\r",
" \"type\": \"integer\",\r"
]
}
]
}
},
"app_version": "0.3.5-1",
"file_version": "1.0.4",
"last_commit_sha_for_swimm_patch": "17ee823b086f0b027612e2d1864930d2c5593c3e"
} }

74
.swm/JFXftJml8DpmuCPBA9rL.swm
View File

@ -1,54 +1,52 @@
{ {
"id": "JFXftJml8DpmuCPBA9rL", "id": "JFXftJml8DpmuCPBA9rL",
"name": "Add details about your new PBA", "name": "Add details about your new PBA",
"task": {
"dod": "You should add your new PBA's details to the configuration.", "dod": "You should add your new PBA's details to the configuration.",
"description": "In order to make sure that the new `ScheduleJobs` PBA is shown in the configuration on the Monkey Island, you need to add its details to the configuration file(s). <br><br>\n\nSince this particular PBA is related to the MITRE techniques [T1168](https://attack.mitre.org/techniques/T1168) and [T1053](https://attack.mitre.org/techniques/T1053), make sure to link the PBA with these techniques in the configuration as well. <br><br>\n\nEach part of the configuration has an important role \n- *enum* — contains the relevant PBA's class name(s)\n- *title* — holds the name of the PBA which is displayed in the configuration on the Monkey Island\n- *info* — consists of an elaboration on the PBA's working which is displayed in the configuration on the Monkey Island\n- *attack_techniques* — has the IDs of the MITRE techniques associated with the PBA\n\n## Manual test \nOnce you think you're done...\n- Run the Monkey Island\n- You should be able to see your new PBA under the \"Monkey\" tab in the configuration, along with its information when you click on it\n- Further, when you enable/disable the associated MITRE techniques under the ATT&CK tab in the configuration, the PBA should also be enabled/disabled\n\n<img src=\"https://i.imgur.com/a5VSkL5.gif\" height=400>",
"summary": "- The PBA details in this file are reflected on the Monkey Island in the PBA configuration.\n- PBAs are also linked to the relevant MITRE techniques in this file, whose results can then be seen in the MITRE ATT&CK report on the Monkey Island.",
"hunksOrder": [
"monkey/monkey_island/cc/services/config_schema/definitions/post_breach_actions.py_0"
],
"tests": [], "tests": [],
"hints": [ "hints": [
"Have a look at the details of the other techniques." "Have a look at the details of the other techniques."
], ]
"play_mode": "all",
"swimmPatch": {
"monkey/monkey_island/cc/services/config_schema/definitions/post_breach_actions.py": {
"diffType": "MODIFIED",
"fileDiffHeader": "diff --git a/monkey/monkey_island/cc/services/config_schema/definitions/post_breach_actions.py b/monkey/monkey_island/cc/services/config_schema/definitions/post_breach_actions.py\nindex f1fe0f6f..b231f96c 100644\n--- a/monkey/monkey_island/cc/services/config_schema/definitions/post_breach_actions.py\n+++ b/monkey/monkey_island/cc/services/config_schema/definitions/post_breach_actions.py",
"hunks": [
{
"swimmHunkMetadata": {
"hunkComments": []
}, },
"hunkDiffLines": [ "content": [
"@@ -68,16 +68,7 @@", {
"type": "text",
"text": "In order to make sure that the new `ScheduleJobs` PBA is shown in the configuration on the Monkey Island, you need to add its details to the configuration file(s). <br><br>\n\nSince this particular PBA is related to the MITRE techniques [T1168](https://attack.mitre.org/techniques/T1168) and [T1053](https://attack.mitre.org/techniques/T1053), make sure to link the PBA with these techniques in the configuration as well. <br><br>\n\nEach part of the configuration has an important role \n- *enum* — contains the relevant PBA's class name(s)\n- *title* — holds the name of the PBA which is displayed in the configuration on the Monkey Island\n- *info* — consists of an elaboration on the PBA's working which is displayed in the configuration on the Monkey Island\n- *attack_techniques* — has the IDs of the MITRE techniques associated with the PBA\n\n## Manual test \nOnce you think you're done...\n- Run the Monkey Island\n- You should be able to see your new PBA under the \"Monkey\" tab in the configuration, along with its information when you click on it\n- Further, when you enable/disable the associated MITRE techniques under the ATT&CK tab in the configuration, the PBA should also be enabled/disabled\n\n<img src=\"https://i.imgur.com/a5VSkL5.gif\" height=400>"
},
{
"type": "snippet",
"path": "monkey/monkey_island/cc/services/config_schema/definitions/post_breach_actions.py",
"comments": [],
"firstLineNumber": 56,
"lines": [
" \"Removes the file afterwards.\",", " \"Removes the file afterwards.\",",
" \"attack_techniques\": [\"T1166\"]", " \"attack_techniques\": [\"T1166\"],",
" },", " },",
"- {", "* {",
"+ # Swimmer: ADD DETAILS HERE!", "+ # Swimmer: ADD DETAILS HERE!",
"- \"type\": \"string\",", "* \"type\": \"string\",",
"- \"enum\": [", "* \"enum\": [\"ScheduleJobs\"],",
"- \"ScheduleJobs\"", "* \"title\": \"Job scheduling\",",
"- ],", "* \"safe\": True,",
"- \"title\": \"Job scheduling\",", "* \"info\": \"Attempts to create a scheduled job on the system and remove it.\",",
"- \"safe\": True,", "* \"attack_techniques\": [\"T1168\", \"T1053\"],",
"- \"info\": \"Attempts to create a scheduled job on the system and remove it.\",", "* },",
"- \"attack_techniques\": [\"T1168\", \"T1053\"]",
"- },",
" {", " {",
" \"type\": \"string\",", " \"type\": \"string\",",
" \"enum\": [" " \"enum\": [\"Timestomping\"],"
] ]
}
]
}
}, },
"app_version": "0.3.5-1", {
"file_version": "1.0.4", "type": "text",
"hunksOrder": [ "text": "- The PBA details in this file are reflected on the Monkey Island in the PBA configuration.\n- PBAs are also linked to the relevant MITRE techniques in this file, whose results can then be seen in the MITRE ATT&CK report on the Monkey Island."
"monkey/monkey_island/cc/services/config_schema/definitions/post_breach_actions.py_0" }
], ],
"last_commit_sha_for_swimm_patch": "9d9e8168fb2c23367b9947273aa1a041687b3e2e" "symbols": {},
"file_version": "2.0.1",
"meta": {
"app_version": "0.4.1-1",
"file_blobs": {
"monkey/monkey_island/cc/services/config_schema/definitions/post_breach_actions.py": "ea9b18aba7f71da12c9c82ac39d8a0cf2c472a9c"
}
}
} }

93
.swm/OwcKMnALpn7tuBaJY1US.swm
View File

@ -37,7 +37,7 @@
"firstLineNumber": 1, "firstLineNumber": 1,
"lines": [ "lines": [
" import logging", " import logging",
"*import socket", " import socket",
"*", "*",
"*from common.common_consts.system_info_collectors_names import HOSTNAME_COLLECTOR", "*from common.common_consts.system_info_collectors_names import HOSTNAME_COLLECTOR",
"*from infection_monkey.system_info.system_info_collector import SystemInfoCollector", "*from infection_monkey.system_info.system_info_collector import SystemInfoCollector",
@ -58,38 +58,36 @@
"type": "snippet", "type": "snippet",
"path": "monkey/monkey_island/cc/services/config_schema/definitions/system_info_collector_classes.py", "path": "monkey/monkey_island/cc/services/config_schema/definitions/system_info_collector_classes.py",
"comments": [], "comments": [],
"firstLineNumber": 1, "firstLineNumber": 4,
"lines": [ "lines": [
" from common.common_consts.system_info_collectors_names import (AWS_COLLECTOR, AZURE_CRED_COLLECTOR,\r", " ENVIRONMENT_COLLECTOR,",
"* ENVIRONMENT_COLLECTOR, HOSTNAME_COLLECTOR,\r", "* HOSTNAME_COLLECTOR,",
" MIMIKATZ_COLLECTOR, PROCESS_LIST_COLLECTOR)\r", " MIMIKATZ_COLLECTOR,",
" \r", " PROCESS_LIST_COLLECTOR,",
" SYSTEM_INFO_COLLECTOR_CLASSES = {\r" " )"
] ]
}, },
{ {
"type": "snippet", "type": "snippet",
"path": "monkey/monkey_island/cc/services/config_schema/definitions/system_info_collector_classes.py", "path": "monkey/monkey_island/cc/services/config_schema/definitions/system_info_collector_classes.py",
"comments": [], "comments": [],
"firstLineNumber": 37, "firstLineNumber": 36,
"lines": [ "lines": [
" \"info\": \"If on AWS, collects more information about the AWS instance currently running on.\",", " \"info\": \"If on AWS, collects more information about the AWS instance currently running on.\",",
" \"attack_techniques\": [\"T1082\"]", " \"attack_techniques\": [\"T1082\"],",
" },", " },",
"* {", "* {",
"+ # SWIMMER: Collector config goes here. Tip: Hostname collection relates to the T1082 and T1016 techniques.", "+ # SWIMMER: Collector config goes here. Tip: Hostname collection relates to the T1082 and T1016 techniques.",
"* \"type\": \"string\",", "* \"type\": \"string\",",
"* \"enum\": [", "* \"enum\": [HOSTNAME_COLLECTOR],",
"* HOSTNAME_COLLECTOR",
"* ],",
"* \"title\": \"Hostname collector\",", "* \"title\": \"Hostname collector\",",
"* \"safe\": True,", "* \"safe\": True,",
"* \"info\": \"Collects machine's hostname.\",", "* \"info\": \"Collects machine's hostname.\",",
"* \"attack_techniques\": [\"T1082\", \"T1016\"]", "* \"attack_techniques\": [\"T1082\", \"T1016\"],",
"* },", "* },",
" {", " {",
" \"type\": \"string\",", " \"type\": \"string\",",
" \"enum\": [" " \"enum\": [PROCESS_LIST_COLLECTOR],"
] ]
}, },
{ {
@ -98,20 +96,20 @@
"comments": [], "comments": [],
"firstLineNumber": 1, "firstLineNumber": 1,
"lines": [ "lines": [
" from common.common_consts.system_info_collectors_names import (AWS_COLLECTOR, AZURE_CRED_COLLECTOR,", " from common.common_consts.system_info_collectors_names import (",
" ENVIRONMENT_COLLECTOR, HOSTNAME_COLLECTOR,", " AWS_COLLECTOR,",
" MIMIKATZ_COLLECTOR, PROCESS_LIST_COLLECTOR)", " AZURE_CRED_COLLECTOR,",
"* HOSTNAME_COLLECTOR,", "* HOSTNAME_COLLECTOR,",
" MONKEY = {", " HOSTNAME_COLLECTOR,",
" \"title\": \"Monkey\",", " MIMIKATZ_COLLECTOR,",
" \"type\": \"object\"," " PROCESS_LIST_COLLECTOR,"
] ]
}, },
{ {
"type": "snippet", "type": "snippet",
"path": "monkey/monkey_island/cc/services/config_schema/monkey.py", "path": "monkey/monkey_island/cc/services/config_schema/monkey.py",
"comments": [], "comments": [],
"firstLineNumber": 85, "firstLineNumber": 92,
"lines": [ "lines": [
" \"default\": [", " \"default\": [",
" ENVIRONMENT_COLLECTOR,", " ENVIRONMENT_COLLECTOR,",
@ -119,7 +117,7 @@
"* HOSTNAME_COLLECTOR,", "* HOSTNAME_COLLECTOR,",
" PROCESS_LIST_COLLECTOR,", " PROCESS_LIST_COLLECTOR,",
" MIMIKATZ_COLLECTOR,", " MIMIKATZ_COLLECTOR,",
" AZURE_CRED_COLLECTOR" " AZURE_CRED_COLLECTOR,"
] ]
}, },
{ {
@ -148,26 +146,26 @@
"comments": [], "comments": [],
"firstLineNumber": 1, "firstLineNumber": 1,
"lines": [ "lines": [
" import logging\r", " import logging",
" import typing\r", " import typing",
" \r", " ",
"*from common.common_consts.system_info_collectors_names import (AWS_COLLECTOR, ENVIRONMENT_COLLECTOR, HOSTNAME_COLLECTOR,\r", " from common.common_consts.system_info_collectors_names import (",
" PROCESS_LIST_COLLECTOR)\r", " AWS_COLLECTOR,",
" from monkey_island.cc.services.telemetry.processing.system_info_collectors.aws import process_aws_telemetry\r", " ENVIRONMENT_COLLECTOR,",
" from monkey_island.cc.services.telemetry.processing.system_info_collectors.environment import \\\r" "* HOSTNAME_COLLECTOR,"
] ]
}, },
{ {
"type": "snippet", "type": "snippet",
"path": "monkey/monkey_island/cc/services/telemetry/processing/system_info_collectors/system_info_telemetry_dispatcher.py", "path": "monkey/monkey_island/cc/services/telemetry/processing/system_info_collectors/system_info_telemetry_dispatcher.py",
"comments": [], "comments": [],
"firstLineNumber": 14, "firstLineNumber": 25,
"lines": [ "lines": [
" SYSTEM_INFO_COLLECTOR_TO_TELEMETRY_PROCESSORS = {", " SYSTEM_INFO_COLLECTOR_TO_TELEMETRY_PROCESSORS = {",
" AWS_COLLECTOR: [process_aws_telemetry],", " AWS_COLLECTOR: [process_aws_telemetry],",
" ENVIRONMENT_COLLECTOR: [process_environment_telemetry],", " ENVIRONMENT_COLLECTOR: [process_environment_telemetry],",
"* HOSTNAME_COLLECTOR: [process_hostname_telemetry],", "* HOSTNAME_COLLECTOR: [process_hostname_telemetry],",
" PROCESS_LIST_COLLECTOR: [check_antivirus_existence]", " PROCESS_LIST_COLLECTOR: [check_antivirus_existence],",
" }", " }",
" " " "
] ]
@ -175,15 +173,18 @@
{ {
"type": "snippet", "type": "snippet",
"lines": [ "lines": [
" from monkey_island.cc.services.telemetry.processing.system_info_collectors.aws import process_aws_telemetry\r", " )",
" from monkey_island.cc.services.telemetry.processing.system_info_collectors.environment import \\\r", " from monkey_island.cc.services.telemetry.processing.system_info_collectors.environment import (",
" process_environment_telemetry\r", " process_environment_telemetry,",
"*from monkey_island.cc.services.telemetry.processing.system_info_collectors.hostname import process_hostname_telemetry\r", " )",
" from monkey_island.cc.services.telemetry.zero_trust_checks.antivirus_existence import check_antivirus_existence\r", "*from monkey_island.cc.services.telemetry.processing.system_info_collectors.hostname import (",
" \r", "* process_hostname_telemetry,",
" logger = logging.getLogger(__name__)\r" "*)",
" from monkey_island.cc.services.telemetry.zero_trust_checks.antivirus_existence import (",
" check_antivirus_existence,",
" )"
], ],
"firstLineNumber": 6, "firstLineNumber": 12,
"path": "monkey/monkey_island/cc/services/telemetry/processing/system_info_collectors/system_info_telemetry_dispatcher.py", "path": "monkey/monkey_island/cc/services/telemetry/processing/system_info_collectors/system_info_telemetry_dispatcher.py",
"comments": [] "comments": []
}, },
@ -192,9 +193,17 @@
"text": "System info collectors are useful to get more data for various things, such as ZT tests or MITRE techniques. Take a look at some other techniques!" "text": "System info collectors are useful to get more data for various things, such as ZT tests or MITRE techniques. Take a look at some other techniques!"
} }
], ],
"file_version": "2.0.0", "symbols": {},
"file_version": "2.0.1",
"meta": { "meta": {
"app_version": "0.3.7-0", "app_version": "0.4.1-1",
"file_blobs": {} "file_blobs": {
"monkey/common/common_consts/system_info_collectors_names.py": "c93cb2537ca94c9e46980d0cd06cc86a0ab34e29",
"monkey/infection_monkey/system_info/collectors/hostname_collector.py": "0aeecd9fb7bde83cccd4501ec03e0da199ec5fc3",
"monkey/monkey_island/cc/services/config_schema/definitions/system_info_collector_classes.py": "487166ec6f6d0559abd07e04d72fe55f230fc518",
"monkey/monkey_island/cc/services/config_schema/monkey.py": "0d69c5aa4fee48943f7847048942d257d27c2472",
"monkey/monkey_island/cc/services/telemetry/processing/system_info_collectors/hostname.py": "e2de4519cbd71bba70e81cf3ff61817437d95a21",
"monkey/monkey_island/cc/services/telemetry/processing/system_info_collectors/system_info_telemetry_dispatcher.py": "894bdce75f0ae2b892bd5b3c6c70949be52b36e7"
}
} }
} }

71
.swm/VW4rf3AxRslfT7lwaug7.swm
View File

@ -1,51 +1,54 @@
{ {
"id": "VW4rf3AxRslfT7lwaug7", "id": "VW4rf3AxRslfT7lwaug7",
"name": "Implement a new PBA — `ScheduleJobs`", "name": "Implement a new PBA — `ScheduleJobs`",
"task": {
"dod": "You should implement a new PBA in Monkey which schedules jobs on the machine.", "dod": "You should implement a new PBA in Monkey which schedules jobs on the machine.",
"description": "You need to implement the `ScheduleJobs` PBA which creates scheduled jobs on the machine. <br><br>\n<img src=\"https://media.giphy.com/media/l0K4mVE5b5WZ1sctW/giphy.gif\" height=175><br><br>\nThe commands that add scheduled jobs for Windows and Linux can be retrieved from `get_commands_to_schedule_jobs` — make sure you understand how to use this function correctly.\n\n## Manual test \nOnce you think you're done...\n- Run the Monkey Island\n- Make sure the \"Job scheduling\" PBA is enabled in the \"Monkey\" tab in the configuration — for this test, disable network scanning, exploiting, and all other PBAs\n- Run the Monkey\n- Make sure you see the PBA with its results in the Security report as well as in the ATT&CK report under the relevant MITRE technique\n\n<img src=\"https://firebasestorage.googleapis.com/v0/b/swimmio-content/o/repositories%2F6Nlb99NtY5Fc3bSd8suH%2Fimg%2Ff0e53e6c-9dbe-41d8-9454-2b5761c3f53a.png?alt=media&token=21aa4bb8-7ebe-4dab-a739-c77e059144dd\" height=400>\n<br><br>\n<img src=\"https://firebasestorage.googleapis.com/v0/b/swimmio-content/o/repositories%2F6Nlb99NtY5Fc3bSd8suH%2Fimg%2F528389a0-35c8-4380-b6e2-353068ed01e4.png?alt=media&token=08767f55-86e2-4f51-8ecf-13fd6cc25ad5\" height=400>",
"summary": "Many other PBAs are as simple as this one, using shell commands or scripts — see `Timestomping` and `AccountDiscovery`. <br><br>\n\nHowever, for less straightforward ones, you can override functions and implement new classes depending on what is required — see `SignedScriptProxyExecution` and `ModifyShellStartupFiles`.<br><br>\n\nThis PBA, along with all the other PBAs, will run on a system after it has been breached. The purpose of this code is to test whether target systems allow attackers to schedule jobs, which they could use to run malicious code at some specified date and time.",
"hunksOrder": [
"monkey/infection_monkey/post_breach/actions/schedule_jobs.py_0"
],
"tests": [], "tests": [],
"hints": [ "hints": [
"Check out the `Timestomping` PBA to get an idea about the implementation.", "Check out the `Timestomping` PBA to get an idea about the implementation.",
"Don't forget to add code to remove the scheduled jobs!" "Don't forget to add code to remove the scheduled jobs!"
], ]
"play_mode": "all",
"swimmPatch": {
"monkey/infection_monkey/post_breach/actions/schedule_jobs.py": {
"diffType": "MODIFIED",
"fileDiffHeader": "diff --git a/monkey/infection_monkey/post_breach/actions/schedule_jobs.py b/monkey/infection_monkey/post_breach/actions/schedule_jobs.py\nindex f7d8d805..06839463 100644\n--- a/monkey/infection_monkey/post_breach/actions/schedule_jobs.py\n+++ b/monkey/infection_monkey/post_breach/actions/schedule_jobs.py",
"hunks": [
{
"swimmHunkMetadata": {
"hunkComments": []
}, },
"hunkDiffLines": [ "content": [
"@@ -10,11 +10,5 @@", {
"type": "text",
"text": "You need to implement the `ScheduleJobs` PBA which creates scheduled jobs on the machine. <br><br>\n<img src=\"https://media.giphy.com/media/l0K4mVE5b5WZ1sctW/giphy.gif\" height=175><br><br>\nThe commands that add scheduled jobs for Windows and Linux can be retrieved from `get_commands_to_schedule_jobs` — make sure you understand how to use this function correctly.\n\n## Manual test \nOnce you think you're done...\n- Run the Monkey Island\n- Make sure the \"Job scheduling\" PBA is enabled in the \"Monkey\" tab in the configuration — for this test, disable network scanning, exploiting, and all other PBAs\n- Run the Monkey\n- Make sure you see the PBA with its results in the Security report as well as in the ATT&CK report under the relevant MITRE technique\n\n<img src=\"https://firebasestorage.googleapis.com/v0/b/swimmio-content/o/repositories%2F6Nlb99NtY5Fc3bSd8suH%2Fimg%2Ff0e53e6c-9dbe-41d8-9454-2b5761c3f53a.png?alt=media&token=21aa4bb8-7ebe-4dab-a739-c77e059144dd\" height=400>\n<br><br>\n<img src=\"https://firebasestorage.googleapis.com/v0/b/swimmio-content/o/repositories%2F6Nlb99NtY5Fc3bSd8suH%2Fimg%2F528389a0-35c8-4380-b6e2-353068ed01e4.png?alt=media&token=08767f55-86e2-4f51-8ecf-13fd6cc25ad5\" height=400>"
},
{
"type": "snippet",
"path": "monkey/infection_monkey/post_breach/actions/schedule_jobs.py",
"comments": [],
"firstLineNumber": 12,
"lines": [
" \"\"\"", " \"\"\"",
" ", " ",
" def __init__(self):", " def __init__(self):",
"- linux_cmds, windows_cmds = get_commands_to_schedule_jobs()", "* linux_cmds, windows_cmds = get_commands_to_schedule_jobs()",
"+ pass", "+ pass",
"-", "*",
"+ # Swimmer: IMPLEMENT HERE!", "+ # Swimmer: IMPLEMENT HERE!",
"- super(ScheduleJobs, self).__init__(name=POST_BREACH_JOB_SCHEDULING,", "* super(ScheduleJobs, self).__init__(",
"- linux_cmd=' '.join(linux_cmds),", "* name=POST_BREACH_JOB_SCHEDULING,",
"- windows_cmd=windows_cmds)", "* linux_cmd=\" \".join(linux_cmds),",
"- ", "* windows_cmd=windows_cmds,",
"- def run(self):", "* )",
"- super(ScheduleJobs, self).run()" "*",
"* def run(self):",
"* super(ScheduleJobs, self).run()",
"* remove_scheduled_jobs()"
] ]
}
]
}
}, },
"app_version": "0.3.5-1", {
"file_version": "1.0.4", "type": "text",
"hunksOrder": [ "text": "Many other PBAs are as simple as this one, using shell commands or scripts — see `Timestomping` and `AccountDiscovery`. <br><br>\n\nHowever, for less straightforward ones, you can override functions and implement new classes depending on what is required — see `SignedScriptProxyExecution` and `ModifyShellStartupFiles`.<br><br>\n\nThis PBA, along with all the other PBAs, will run on a system after it has been breached. The purpose of this code is to test whether target systems allow attackers to schedule jobs, which they could use to run malicious code at some specified date and time."
"monkey/infection_monkey/post_breach/actions/schedule_jobs.py_0" }
], ],
"last_commit_sha_for_swimm_patch": "44fd1ab69cfbab33cec638dcbbaa8831992a9a9f" "symbols": {},
"file_version": "2.0.1",
"meta": {
"app_version": "0.4.1-1",
"file_blobs": {
"monkey/infection_monkey/post_breach/actions/schedule_jobs.py": "e7845968a0c27d2eba71a8889645fe88491cb2a8"
}
}
} }

52
.swm/tbxb2cGgUiJQ8Btma0fp.swm
View File

@ -37,20 +37,19 @@
"lines": [ "lines": [
"*from common.common_consts.post_breach_consts import POST_BREACH_BACKDOOR_USER", "*from common.common_consts.post_breach_consts import POST_BREACH_BACKDOOR_USER",
"*from infection_monkey.config import WormConfiguration", "*from infection_monkey.config import WormConfiguration",
" from infection_monkey.post_breach.pba import PBA", "*from infection_monkey.post_breach.pba import PBA",
" from infection_monkey.utils.users import get_commands_to_add_user", "*from infection_monkey.utils.users import get_commands_to_add_user",
" ", "*",
" ", "*",
" class BackdoorUser(PBA):", "*class BackdoorUser(PBA):",
" def __init__(self):", "* def __init__(self):",
"* linux_cmds, windows_cmds = get_commands_to_add_user(", "* linux_cmds, windows_cmds = get_commands_to_add_user(",
"+ pass # Swimmer: Impl here!", "* WormConfiguration.user_to_add, WormConfiguration.remote_user_pass",
"* WormConfiguration.user_to_add,", "* )",
"* WormConfiguration.remote_user_pass)",
"* super(BackdoorUser, self).__init__(", "* super(BackdoorUser, self).__init__(",
"* POST_BREACH_BACKDOOR_USER,", "* POST_BREACH_BACKDOOR_USER, linux_cmd=\" \".join(linux_cmds), windows_cmd=windows_cmds",
"* linux_cmd=' '.join(linux_cmds),", "* )",
"* windows_cmd=windows_cmds)" "*"
] ]
}, },
{ {
@ -59,17 +58,17 @@
"comments": [], "comments": [],
"firstLineNumber": 1, "firstLineNumber": 1,
"lines": [ "lines": [
"*from common.common_consts.post_breach_consts import POST_BREACH_BACKDOOR_USER, POST_BREACH_COMMUNICATE_AS_NEW_USER\r", " from common.common_consts.post_breach_consts import (",
" from monkey_island.cc.services.attack.technique_reports.pba_technique import PostBreachTechnique\r", "* POST_BREACH_BACKDOOR_USER,",
" \r", " POST_BREACH_COMMUNICATE_AS_NEW_USER,",
" __author__ = \"shreyamalviya\"\r" " )"
] ]
}, },
{ {
"type": "snippet", "type": "snippet",
"path": "monkey/monkey_island/cc/services/attack/technique_reports/T1136.py", "path": "monkey/monkey_island/cc/services/attack/technique_reports/T1136.py",
"comments": [], "comments": [],
"firstLineNumber": 9, "firstLineNumber": 12,
"lines": [ "lines": [
" unscanned_msg = \"Monkey didn't try creating a new user on the network's systems.\"", " unscanned_msg = \"Monkey didn't try creating a new user on the network's systems.\"",
" scanned_msg = \"Monkey tried creating a new user on the network's systems, but failed.\"", " scanned_msg = \"Monkey tried creating a new user on the network's systems, but failed.\"",
@ -90,17 +89,15 @@
"* {", "* {",
"+ # Swimmer: Add new PBA here to config!", "+ # Swimmer: Add new PBA here to config!",
"* \"type\": \"string\",", "* \"type\": \"string\",",
"* \"enum\": [", "* \"enum\": [\"BackdoorUser\"],",
"* \"BackdoorUser\"",
"* ],",
"* \"title\": \"Back door user\",", "* \"title\": \"Back door user\",",
"* \"safe\": True,", "* \"safe\": True,",
"* \"info\": \"Attempts to create a new user on the system and delete it afterwards.\",", "* \"info\": \"Attempts to create a new user on the system and delete it afterwards.\",",
"* \"attack_techniques\": [\"T1136\"]", "* \"attack_techniques\": [\"T1136\"],",
"* },", "* },",
" {", " {",
" \"type\": \"string\",", " \"type\": \"string\",",
" \"enum\": [" " \"enum\": [\"CommunicateAsNewUser\"],"
] ]
}, },
{ {
@ -108,14 +105,15 @@
"text": "Take a look at the configuration of the island again - see the \"command to run after breach\" option we offer the user? It's implemented exactly like you did right now but each user can do it for themselves. \n\nHowever, what if the PBA needs to do stuff which is more complex than just running a few commands? In that case... " "text": "Take a look at the configuration of the island again - see the \"command to run after breach\" option we offer the user? It's implemented exactly like you did right now but each user can do it for themselves. \n\nHowever, what if the PBA needs to do stuff which is more complex than just running a few commands? In that case... "
} }
], ],
"file_version": "2.0.0", "symbols": {},
"file_version": "2.0.1",
"meta": { "meta": {
"app_version": "0.3.7-0", "app_version": "0.4.1-1",
"file_blobs": { "file_blobs": {
"monkey/common/common_consts/post_breach_consts.py": "25e6679cb1623aae1a732deb05cc011a452743e3", "monkey/common/common_consts/post_breach_consts.py": "25e6679cb1623aae1a732deb05cc011a452743e3",
"monkey/infection_monkey/post_breach/actions/add_user.py": "a85845840d9cb37529ad367e159cd9001929e759", "monkey/infection_monkey/post_breach/actions/add_user.py": "cae5a2428fa01b333a2e70365c9da1e189e31bc4",
"monkey/monkey_island/cc/services/attack/technique_reports/T1136.py": "d9d86e08ea4aeb0a6bee3f483e4fea50ee6cd200", "monkey/monkey_island/cc/services/attack/technique_reports/T1136.py": "dfc5945a362b88c1135f4476526c6c82977b02ee",
"monkey/monkey_island/cc/services/config_schema/definitions/post_breach_actions.py": "857e80da477ab31dbc00ed0a3f1cd49b69b505fa" "monkey/monkey_island/cc/services/config_schema/definitions/post_breach_actions.py": "ea9b18aba7f71da12c9c82ac39d8a0cf2c472a9c"
} }
} }
} }

7
.travis.yml
View File

@ -78,6 +78,13 @@ script:
- cd $TRAVIS_BUILD_DIR/docs - cd $TRAVIS_BUILD_DIR/docs
- hugo --verbose --environment staging - hugo --verbose --environment staging
# verify swimm
- cd $TRAVIS_BUILD_DIR
- curl -s https://api.github.com/repos/swimmio/SwimmReleases/releases/latest | grep 'browser_download_url.*swimm-cli' | cut -d '"' -f 4 | wget -O swimm_cli -qi -
- chmod +x swimm_cli
- node swimm_cli --version
- node swimm_cli verify
after_success: after_success:
# Upload code coverage results to codecov.io, see https://github.com/codecov/codecov-bash for more information # Upload code coverage results to codecov.io, see https://github.com/codecov/codecov-bash for more information
- bash <(curl -s https://codecov.io/bash) - bash <(curl -s https://codecov.io/bash)