Merge pull request #366 from VakarisZ/attack_file_deletion

T1107 File Deletion
2019-07-31 11:43:07 +03:00 · 2019-07-31 11:43:07 +03:00 · bbff9b95e3
parent ef4372cf34 81fd512296
commit bbff9b95e3
17 changed files with 168 additions and 33 deletions
--- a/monkey/infection_monkey/monkey.py
+++ b/monkey/infection_monkey/monkey.py
@ -16,6 +16,7 @@ from infection_monkey.network.network_scanner import NetworkScanner
 from infection_monkey.system_info import SystemInfoCollector
 from infection_monkey.system_singleton import SystemSingleton
 from infection_monkey.telemetry.attack.victim_host_telem import VictimHostTelem
+from infection_monkey.telemetry.attack.t1107_telem import T1107Telem
 from infection_monkey.telemetry.scan_telem import ScanTelem
 from infection_monkey.telemetry.state_telem import StateTelem
 from infection_monkey.telemetry.system_info_telem import SystemInfoTelem
@ -236,7 +237,6 @@ class InfectionMonkey(object):
                self.send_log()
            self._singleton.unlock()

-        utils.remove_monkey_dir()
        InfectionMonkey.self_delete()
        LOG.info("Monkey is shutting down")

@ -249,9 +249,13 @@ class InfectionMonkey(object):

    @staticmethod
    def self_delete():
+        status = ScanStatus.USED if utils.remove_monkey_dir() else ScanStatus.SCANNED
+        T1107Telem(status, utils.get_monkey_dir_path()).send()
+
        if WormConfiguration.self_delete_in_cleanup \
                and -1 == sys.executable.find('python'):
            try:
+                status = None
                if "win32" == sys.platform:
                    from _subprocess import SW_HIDE, STARTF_USESHOWWINDOW, CREATE_NEW_CONSOLE
                    startupinfo = subprocess.STARTUPINFO()
@ -262,8 +266,12 @@ class InfectionMonkey(object):
                                     close_fds=True, startupinfo=startupinfo)
                else:
                    os.remove(sys.executable)
+                    status = ScanStatus.USED
            except Exception as exc:
                LOG.error("Exception in self delete: %s", exc)
+                status = ScanStatus.SCANNED
+            if status:
+                T1107Telem(status, sys.executable).send()

    def send_log(self):
        monkey_log_path = utils.get_monkey_log_path()
--- a/monkey/infection_monkey/telemetry/attack/t1107_telem.py
+++ b/monkey/infection_monkey/telemetry/attack/t1107_telem.py
@ -0,0 +1,19 @@
+from infection_monkey.telemetry.attack.attack_telem import AttackTelem
+
+
+class T1107Telem(AttackTelem):
+    def __init__(self, status, path):
+        """
+        T1107 telemetry.
+        :param status: ScanStatus of technique
+        :param path: Path of deleted dir/file
+        """
+        super(T1107Telem, self).__init__('T1107', status)
+        self.path = path
+
+    def get_data(self):
+        data = super(T1107Telem, self).get_data()
+        data.update({
+            'path': self.path
+        })
+        return data
--- a/monkey/infection_monkey/utils.py
+++ b/monkey/infection_monkey/utils.py
@ -49,8 +49,13 @@ def create_monkey_dir():
 def remove_monkey_dir():
    """
    Removes monkey's root directory
+    :return True if removed without errors and False otherwise
    """
-    shutil.rmtree(get_monkey_dir_path(), ignore_errors=True)
+    try:
+        shutil.rmtree(get_monkey_dir_path())
+        return True
+    except Exception:
+        return False


 def get_monkey_dir_path():
--- a/monkey/monkey_island/cc/services/attack/attack_report.py
+++ b/monkey/monkey_island/cc/services/attack/attack_report.py
@ -1,7 +1,7 @@
 import logging
 from monkey_island.cc.models import Monkey
-from monkey_island.cc.services.attack.technique_reports \
-    import T1210, T1197, T1110, T1075, T1003, T1059, T1086, T1082, T1145, T1065
+from monkey_island.cc.services.attack.technique_reports import T1210, T1197, T1110, T1075, T1003, T1059, T1086, T1082
+from monkey_island.cc.services.attack.technique_reports import T1145, T1107, T1065
 from monkey_island.cc.services.attack.attack_config import AttackConfig
 from monkey_island.cc.database import mongo

@ -19,6 +19,7 @@ TECHNIQUES = {'T1210': T1210.T1210,
              'T1086': T1086.T1086,
              'T1082': T1082.T1082,
              'T1145': T1145.T1145,
+              'T1107': T1107.T1107,
              'T1065': T1065.T1065}

 REPORT_NAME = 'new_report'
--- a/monkey/monkey_island/cc/services/attack/attack_schema.py
+++ b/monkey/monkey_island/cc/services/attack/attack_schema.py
@ -91,6 +91,15 @@ SCHEMA = {
                    "necessary": True,
                    "description": "Adversaries may abuse BITS to download, execute, "
                                   "and even clean up after running malicious code."
+                },
+                "T1107": {
+                    "title": "T1107 File Deletion",
+                    "type": "bool",
+                    "value": True,
+                    "necessary": True,
+                    "description": "Adversaries may remove files over the course of an intrusion "
+                                   "to keep their footprint low or remove them at the end as part "
+                                   "of the post-intrusion cleanup process."
                }
            }
        },
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1107.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1107.py
@ -0,0 +1,32 @@
+from monkey_island.cc.database import mongo
+from monkey_island.cc.services.attack.technique_reports import AttackTechnique
+
+__author__ = "VakarisZ"
+
+
+class T1107(AttackTechnique):
+    tech_id = "T1107"
+    unscanned_msg = ""
+    scanned_msg = "Monkey tried to delete files on systems in the network, but failed."
+    used_msg = "Monkey successfully deleted files on systems in the network."
+
+    query = [{'$match': {'telem_category': 'attack',
+                         'data.technique': 'T1107'}},
+             {'$lookup': {'from': 'monkey',
+                          'localField': 'monkey_guid',
+                          'foreignField': 'guid',
+                          'as': 'monkey'}},
+             {'$project': {'monkey': {'$arrayElemAt': ['$monkey', 0]},
+                           'status': '$data.status',
+                           'path': '$data.path'}},
+             {'$addFields': {'_id': 0,
+                             'machine': {'hostname': '$monkey.hostname', 'ips': '$monkey.ip_addresses'},
+                             'monkey': 0}},
+             {'$group': {'_id': {'machine': '$machine', 'status': '$status', 'path': '$path'}}}]
+
+    @staticmethod
+    def get_report_data():
+        data = T1107.get_tech_base_data()
+        deleted_files = list(mongo.db.telemetry.aggregate(T1107.query))
+        data.update({'deleted_files': deleted_files})
+        return data
--- a/monkey/monkey_island/cc/services/attack/technique_reports/init.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/init.py
@ -50,18 +50,18 @@ class AttackTechnique(object):
    def technique_status(cls):
        """
        Gets the status of a certain attack technique.
-        :return: ScanStatus Enum object
+        :return: ScanStatus numeric value
        """
-        if mongo.db.attack_results.find_one({'telem_category': 'attack',
-                                             'status': ScanStatus.USED.value,
-                                             'technique': cls.tech_id}):
-            return ScanStatus.USED
-        elif mongo.db.attack_results.find_one({'telem_category': 'attack',
-                                               'status': ScanStatus.SCANNED.value,
-                                               'technique': cls.tech_id}):
-            return ScanStatus.SCANNED
+        if mongo.db.telemetry.find_one({'telem_category': 'attack',
+                                        'data.status': ScanStatus.USED.value,
+                                        'data.technique': cls.tech_id}):
+            return ScanStatus.USED.value
+        elif mongo.db.telemetry.find_one({'telem_category': 'attack',
+                                          'data.status': ScanStatus.SCANNED.value,
+                                          'data.technique': cls.tech_id}):
+            return ScanStatus.SCANNED.value
        else:
-            return ScanStatus.UNSCANNED
+            return ScanStatus.UNSCANNED.value

    @classmethod
    def get_message_and_status(cls, status):
@ -70,7 +70,7 @@ class AttackTechnique(object):
        :param status: Enum type value from common/attack_utils.py
        :return: Dict with message and status
        """
-        return {'message': cls.get_message_by_status(status), 'status': status.name}
+        return {'message': cls.get_message_by_status(status), 'status': status.value}

    @classmethod
    def get_message_by_status(cls, status):
@ -97,12 +97,12 @@ class AttackTechnique(object):
    def get_tech_base_data(cls):
        """
        Gathers basic attack technique data into a dict.
-        :return: dict E.g. {'message': 'Brute force used', 'status': 'Used', 'title': 'T1110 Brute force'}
+        :return: dict E.g. {'message': 'Brute force used', 'status': 2, 'title': 'T1110 Brute force'}
        """
        data = {}
        status = cls.technique_status()
        title = cls.technique_title()
-        data.update({'status': status.name,
+        data.update({'status': status,
                     'title': title,
                     'message': cls.get_message_by_status(status)})
        return data
--- a/monkey/monkey_island/cc/ui/src/components/attack/techniques/Helpers.js
+++ b/monkey/monkey_island/cc/ui/src/components/attack/techniques/Helpers.js
@ -11,7 +11,17 @@ export function renderMachine(val){
 export function renderMachineFromSystemData(data) {
    let machineStr = data['hostname'] + " ( ";
    data['ips'].forEach(function(ipInfo){
-      machineStr += ipInfo['addr'] + " ";
+      if(typeof ipInfo === "object"){
+        machineStr += ipInfo['addr'] + " ";
+      } else {
+         machineStr += ipInfo + " ";
+      }
    });
    return machineStr + ")"
 }
+
+export const ScanStatus = {
+    UNSCANNED: 0,
+    SCANNED: 1,
+    USED: 2
+};
--- a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1003.js
+++ b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1003.js
@ -2,6 +2,7 @@ import React from 'react';
 import '../../../styles/Collapse.scss'
 import '../../report-components/StolenPasswords'
 import StolenPasswordsComponent from "../../report-components/StolenPasswords";
+import {ScanStatus} from "./Helpers"


 class T1003 extends React.Component {
@ -15,7 +16,7 @@ class T1003 extends React.Component {
      <div>
        <div>{this.props.data.message}</div>
        <br/>
-        {this.props.data.status === 'USED' ?
+        {this.props.data.status === ScanStatus.USED ?
          <StolenPasswordsComponent data={this.props.reportData.glance.stolen_creds.concat(this.props.reportData.glance.ssh_keys)}/>
          : ""}
      </div>
--- a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1059.js
+++ b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1059.js
@ -1,7 +1,7 @@
 import React from 'react';
 import '../../../styles/Collapse.scss'
 import ReactTable from "react-table";
-import { renderMachine } from "./Helpers"
+import { renderMachine, ScanStatus } from "./Helpers"


 class T1059 extends React.Component {
@ -25,7 +25,7 @@ class T1059 extends React.Component {
      <div>
        <div>{this.props.data.message}</div>
        <br/>
-        {this.props.data.status === 'USED' ?
+        {this.props.data.status === ScanStatus.USED ?
          <ReactTable
              columns={T1059.getCommandColumns()}
              data={this.props.data.cmds}
--- a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1075.js
+++ b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1075.js
@ -1,7 +1,7 @@
 import React from 'react';
 import '../../../styles/Collapse.scss'
 import ReactTable from "react-table";
-import { renderMachine } from "./Helpers"
+import { renderMachine, ScanStatus } from "./Helpers"


 class T1075 extends React.Component {
@ -34,7 +34,7 @@ class T1075 extends React.Component {
      <div>
        <div>{this.props.data.message}</div>
        <br/>
-        {this.props.data.status === 'USED' ?
+        {this.props.data.status === ScanStatus.USED ?
          <ReactTable
              columns={T1075.getHashColumns()}
              data={this.props.data.successful_logins}
--- a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1082.js
+++ b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1082.js
@ -1,7 +1,7 @@
 import React from 'react';
 import '../../../styles/Collapse.scss'
 import ReactTable from "react-table";
-import { renderMachineFromSystemData } from "./Helpers"
+import { renderMachineFromSystemData, ScanStatus } from "./Helpers"


 class T1082 extends React.Component {
@ -33,7 +33,7 @@ class T1082 extends React.Component {
      <div>
        <div>{this.props.data.message}</div>
        <br/>
-        {this.props.data.status === 'USED' ?
+        {this.props.data.status === ScanStatus.USED ?
          <ReactTable
              columns={T1082.getSystemInfoColumns()}
              data={this.props.data.system_info}
--- a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1086.js
+++ b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1086.js
@ -1,7 +1,7 @@
 import React from 'react';
 import '../../../styles/Collapse.scss'
 import ReactTable from "react-table";
-import { renderMachine } from "./Helpers"
+import { renderMachine, ScanStatus } from "./Helpers"


 class T1086 extends React.Component {
@ -25,7 +25,7 @@ class T1086 extends React.Component {
      <div>
        <div>{this.props.data.message}</div>
        <br/>
-        {this.props.data.status === 'USED' ?
+        {this.props.data.status === ScanStatus.USED ?
          <ReactTable
              columns={T1086.getPowershellColumns()}
              data={this.props.data.cmds}
--- a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1107.js
+++ b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1107.js
@ -0,0 +1,47 @@
+import React from 'react';
+import '../../../styles/Collapse.scss'
+import ReactTable from "react-table";
+import { renderMachineFromSystemData, ScanStatus } from "./Helpers"
+
+
+class T1107 extends React.Component {
+
+  constructor(props) {
+    super(props);
+  }
+
+  static renderDelete(status){
+    if(status === ScanStatus.USED){
+      return <span>Yes</span>
+    } else {
+      return <span>No</span>
+    }
+  }
+
+  static getDeletedFileColumns() {
+    return ([{
+      columns: [
+        {Header: 'Machine', id: 'machine', accessor: x => renderMachineFromSystemData(x._id.machine), style: { 'whiteSpace': 'unset' }},
+        {Header: 'Path', id: 'path', accessor: x => x._id.path, style: { 'whiteSpace': 'unset' }},
+        {Header: 'Deleted?', id: 'deleted', accessor: x => this.renderDelete(x._id.status),
+          style: { 'whiteSpace': 'unset' }, width: 160}]
+    }])};
+
+  render() {
+    return (
+      <div>
+        <div>{this.props.data.message}</div>
+        <br/>
+        {this.props.data.deleted_files.length !== 0 ?
+          <ReactTable
+              columns={T1107.getDeletedFileColumns()}
+              data={this.props.data.deleted_files}
+              showPagination={false}
+              defaultPageSize={this.props.data.deleted_files.length}
+          /> : ""}
+      </div>
+    );
+  }
+}
+
+export default T1107;
--- a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1110.js
+++ b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1110.js
@ -1,7 +1,7 @@
 import React from 'react';
 import '../../../styles/Collapse.scss'
 import ReactTable from "react-table";
-import { renderMachine } from "./Helpers"
+import { renderMachine, ScanStatus } from "./Helpers"


 class T1110 extends React.Component {
@ -32,7 +32,7 @@ class T1110 extends React.Component {
      <div>
        <div>{this.props.data.message}</div>
        <br/>
-        {(this.props.data.status === 'SCANNED' || this.props.data.status === 'USED') ?
+        {this.props.data.status !== ScanStatus.UNSCANNED ?
          <ReactTable
            columns={T1110.getServiceColumns()}
            data={this.props.data.services}
--- a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1145.js
+++ b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1145.js
@ -1,7 +1,7 @@
 import React from 'react';
 import '../../../styles/Collapse.scss'
 import ReactTable from "react-table";
-import { renderMachineFromSystemData } from "./Helpers"
+import { renderMachineFromSystemData, ScanStatus } from "./Helpers"


 class T1145 extends React.Component {
@ -38,7 +38,7 @@ class T1145 extends React.Component {
      <div>
        <div>{this.props.data.message}</div>
        <br/>
-        {this.props.data.status === 'USED' ?
+        {this.props.data.status === ScanStatus.USED ?
          <ReactTable
              columns={T1145.getKeysInfoColumns()}
              data={this.props.data.ssh_info}
--- a/monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js
+++ b/monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js
@ -4,6 +4,7 @@ import {ReactiveGraph} from 'components/reactive-graph/ReactiveGraph';
 import {edgeGroupToColor, options} from 'components/map/MapOptions';
 import '../../styles/Collapse.scss';
 import AuthComponent from '../AuthComponent';
+import {ScanStatus} from "../attack/techniques/Helpers";
 import Collapse from '@kunukn/react-collapse';
 import T1210 from '../attack/techniques/T1210';
 import T1197 from '../attack/techniques/T1197';
@ -14,6 +15,7 @@ import T1059 from "../attack/techniques/T1059";
 import T1086 from "../attack/techniques/T1086";
 import T1082 from "../attack/techniques/T1082";
 import T1145 from "../attack/techniques/T1145";
+import T1107 from "../attack/techniques/T1107";
 import T1065 from "../attack/techniques/T1065";

 const tech_components = {
@ -26,6 +28,7 @@ const tech_components = {
  'T1086': T1086,
  'T1082': T1082,
  'T1145': T1145,
+  'T1107': T1107,
  'T1065': T1065
 };

@ -77,9 +80,9 @@ class AttackReportPageComponent extends AuthComponent {

  getComponentClass(tech_id){
    switch (this.state.report[tech_id].status) {
-      case 'SCANNED':
+      case ScanStatus.SCANNED:
        return 'collapse-info';
-      case 'USED':
+      case ScanStatus.USED:
        return 'collapse-danger';
      default:
        return 'collapse-default';