Everything implemented on backend

monkey_island/cc/services/node.py

@@ -292,3 +292,21 @@ class NodeService:
             {'_id': node_id},
             {'$push': {'creds': creds}}
         )
+
+    @staticmethod
+    def get_node_or_monkey_by_ip(ip_address):
+        node = NodeService.get_node_by_ip(ip_address)
+        if node is not None:
+            return node
+        return NodeService.get_monkey_by_ip(ip_address)
+
+    @staticmethod
+    def get_node_or_monkey_by_id(node_id):
+        node = NodeService.get_node_by_id(node_id)
+        if node is not None:
+            return node
+        return NodeService.get_monkey_by_id(node_id)
+
+    @staticmethod
+    def get_node_hostname(node):
+        return node['hostname'] if 'hostname' in node else node['os']['version']

monkey_island/cc/services/report.py

@@ -1,9 +1,9 @@
-import datetime
+import ipaddress
 
 from cc.database import mongo
-from cc.services.config import ConfigService
 from cc.services.edge import EdgeService
 from cc.services.node import NodeService
+from cc.utils import local_ip_addresses, get_subnets
 
 __author__ = "itay.mizeretz"
 
@@ -38,19 +38,14 @@ class ReportService:
         st += "%d minutes and %d seconds" % (minutes, seconds)
         return st
 
-    @staticmethod
-    def get_breach_count():
-        return mongo.db.edge.count({'exploits.result': True})
-
-    @staticmethod
-    def get_successful_exploit_types():
-        exploit_types = mongo.db.command({'distinct': 'edge', 'key': 'exploits.exploiter'})['values']
-        return [exploit for exploit in exploit_types if ReportService.did_exploit_type_succeed(exploit)]
-
     @staticmethod
     def get_tunnels():
         return [
-            (NodeService.get_monkey_label_by_id(tunnel['_id']), NodeService.get_monkey_label_by_id(tunnel['tunnel']))
+            {
+                'type': 'tunnel',
+                'origin': NodeService.get_node_hostname(NodeService.get_node_or_monkey_by_id(tunnel['_id'])),
+                'dest': NodeService.get_node_hostname(NodeService.get_node_or_monkey_by_id(tunnel['tunnel']))
+            }
             for tunnel in mongo.db.monkey.find({'tunnel': {'$exists': True}}, {'tunnel': 1})]
 
     @staticmethod
@@ -73,21 +68,6 @@ class ReportService:
 
         return nodes
 
-    @staticmethod
-    def get_reused_passwords():
-        password_dict = {}
-        password_list = ConfigService.get_config_value(['basic', 'credentials', 'exploit_password_list'])
-        for password in password_list:
-            machines_with_password =\
-                [
-                    NodeService.get_monkey_label_by_id(node['_id'])
-                    for node in mongo.db.monkey.find({'creds.password': password}, {'_id': 1})
-                ]
-            if len(machines_with_password) >= 2:
-                password_dict[password] = machines_with_password
-
-        return password_dict
-
     @staticmethod
     def get_exploited():
         exploited = \
@@ -98,7 +78,7 @@ class ReportService:
 
         exploited = [
             {
-                'label': monkey['hostname'] if 'hostname' in monkey else monkey['os']['version'],
+                'label': NodeService.get_node_hostname(monkey),
                 'ip_addresses': monkey['ip_addresses'],
                 'exploits': [exploit['exploiter'] for exploit in monkey['exploits'] if exploit['result']]
             }
@@ -130,6 +110,146 @@ class ReportService:
                     )
         return creds
 
+    @staticmethod
+    def process_general_exploit(exploit):
+        ip_addr = exploit['data']['machine']['ip_addr']
+        return {'machine': NodeService.get_node_hostname(NodeService.get_node_or_monkey_by_ip(ip_addr)),
+                'ip_address': ip_addr}
+
+    @staticmethod
+    def process_general_creds_exploit(exploit):
+        processed_exploit = ReportService.process_general_exploit(exploit)
+
+        for attempt in exploit['data']['attempts']:
+            if attempt['result']:
+                processed_exploit['username'] = attempt['user']
+                if len(attempt['password']) > 0:
+                    processed_exploit['type'] = 'password'
+                else:
+                    processed_exploit['type'] = 'hash'
+                return processed_exploit
+
+    @staticmethod
+    def process_smb_exploit(exploit):
+        processed_exploit = ReportService.process_general_creds_exploit(exploit)
+        if processed_exploit['type'] == 'password':
+            processed_exploit['type'] = 'smb_password'
+        else:
+            processed_exploit['type'] = 'smb_pth'
+        return processed_exploit
+
+    @staticmethod
+    def process_wmi_exploit(exploit):
+        processed_exploit = ReportService.process_general_creds_exploit(exploit)
+        if processed_exploit['type'] == 'password':
+            processed_exploit['type'] = 'wmi_password'
+        else:
+            processed_exploit['type'] = 'wmi_pth'
+        return processed_exploit
+
+    @staticmethod
+    def process_ssh_exploit(exploit):
+        processed_exploit = ReportService.process_general_creds_exploit(exploit)
+        processed_exploit['type'] = 'ssh'
+        return processed_exploit
+
+    @staticmethod
+    def process_rdp_exploit(exploit):
+        processed_exploit = ReportService.process_general_creds_exploit(exploit)
+        processed_exploit['type'] = 'rdp'
+        return processed_exploit
+
+    @staticmethod
+    def process_sambacry_exploit(exploit):
+        processed_exploit = ReportService.process_general_creds_exploit(exploit)
+        processed_exploit['type'] = 'sambacry'
+        return processed_exploit
+
+    @staticmethod
+    def process_elastic_exploit(exploit):
+        processed_exploit = ReportService.process_general_exploit(exploit)
+        processed_exploit['type'] = 'elastic'
+        return processed_exploit
+
+    @staticmethod
+    def process_conficker_exploit(exploit):
+        processed_exploit = ReportService.process_general_exploit(exploit)
+        processed_exploit['type'] = 'conficker'
+        return processed_exploit
+
+    @staticmethod
+    def process_shellshock_exploit(exploit):
+        processed_exploit = ReportService.process_general_exploit(exploit)
+        processed_exploit['type'] = 'shellshock'
+        urls = exploit['data']['info']['vulnerable_urls']
+        processed_exploit['port'] = urls[0].split(':')[2].split('/')[0]
+        processed_exploit['paths'] = ['/' + url.split(':')[2].split('/')[1] for url in urls]
+        return processed_exploit
+
+    @staticmethod
+    def process_exploit(exploit):
+        exploiter_type = exploit['data']['exploiter']
+        if exploiter_type == 'SmbExploiter':
+            return ReportService.process_smb_exploit(exploit)
+        if exploiter_type == 'WmiExploiter':
+            return ReportService.process_wmi_exploit(exploit)
+        if exploiter_type == 'SSHExploiter':
+            return ReportService.process_ssh_exploit(exploit)
+        if exploiter_type == 'RdpExploiter':
+            return ReportService.process_rdp_exploit(exploit)
+        if exploiter_type == 'SambaCryExploiter':
+            return ReportService.process_sambacry_exploit(exploit)
+        if exploiter_type == 'ElasticGroovyExploiter':
+            return ReportService.process_elastic_exploit(exploit)
+        if exploiter_type == 'Ms08_067_Exploiter':
+            return ReportService.process_conficker_exploit(exploit)
+        if exploiter_type == 'ShellShockExploiter':
+            return ReportService.process_shellshock_exploit(exploit)
+
+    @staticmethod
+    def get_exploits():
+        return [ReportService.process_exploit(exploit) for
+                exploit in mongo.db.telemetry.find({'telem_type': 'exploit', 'data.result': True})]
+
+    @staticmethod
+    def get_monkey_subnets(monkey_guid):
+        return \
+            [
+                ipaddress.ip_interface(unicode(network['addr'] + '/' + network['netmask'])).network
+                for network in
+                mongo.db.telemetry.find_one(
+                    {'telem_type': 'system_info_collection', 'monkey_guid': monkey_guid},
+                    {'data.network_info.networks': 1}
+                )['data']['network_info']['networks']
+            ]
+
+    @staticmethod
+    def get_cross_segment_issues():
+        issues = []
+        island_ips = local_ip_addresses()
+        for monkey in mongo.db.monkey.find({'tunnel': {'$exists': False}}, {'tunnel': 1, 'guid': 1, 'hostname': 1}):
+            found_good_ip = False
+            monkey_subnets = ReportService.get_monkey_subnets(monkey['guid'])
+            for subnet in monkey_subnets:
+                for ip in island_ips:
+                    if ipaddress.ip_address(unicode(ip)) in subnet:
+                        found_good_ip = True
+                        break
+                if found_good_ip:
+                    break
+            if not found_good_ip:
+                issues.append(
+                    {'type': 'cross_segment', 'machine': monkey['hostname'],
+                     'networks': [str(subnet) for subnet in monkey_subnets],
+                     'server_networks': [str(subnet) for subnet in get_subnets()]}
+                )
+
+        return issues
+
+    @staticmethod
+    def get_issues():
+        return ReportService.get_exploits() + ReportService.get_tunnels() + ReportService.get_cross_segment_issues()
+
     @staticmethod
     def get_report():
         return \
@@ -149,42 +269,9 @@ class ReportService:
                     },
                 'recommendations':
                     {
-                        'issues':
+                        'issues': ReportService.get_issues()
-                            [
-                                {'type': 'smb_password', 'machine': 'Monkey-SMB',
-                                 'ip_addresses': ['192.168.0.1', '10.0.0.18'], 'username': 'Administrator'},
-                                {'type': 'smb_pth', 'machine': 'Monkey-SMB2', 'ip_addresses': ['192.168.0.1', '10.0.0.18'],
-                                 'username': 'Administrator'},
-                                {'type': 'wmi_password', 'machine': 'Monkey-WMI',
-                                 'ip_addresses': ['192.168.0.1', '10.0.0.18'], 'username': 'Administrator'},
-                                {'type': 'wmi_pth', 'machine': 'Monkey-WMI2', 'ip_addresses': ['192.168.0.1', '10.0.0.18'],
-                                 'username': 'Administrator'},
-                                {'type': 'ssh', 'machine': 'Monkey-SMB', 'ip_addresses': ['192.168.0.1', '10.0.0.18'],
-                                 'username': 'Administrator'},
-                                {'type': 'rdp', 'machine': 'Monkey-SMB', 'ip_addresses': ['192.168.0.1', '10.0.0.18'],
-                                 'username': 'Administrator'},
-                                {'type': 'sambacry', 'machine': 'Monkey-SMB', 'ip_addresses': ['192.168.0.1', '10.0.0.18'],
-                                 'username': 'Administrator'},
-                                {'type': 'elastic', 'machine': 'Monkey-SMB', 'ip_addresses': ['192.168.0.1', '10.0.0.18']},
-                                {'type': 'shellshock', 'machine': 'Monkey-SMB', 'ip_addresses': ['192.168.0.1', '10.0.0.18'],
-                                 'port': 8080, 'paths': ['/cgi/backserver.cgi', '/cgi/login.cgi']},
-                                {'type': 'conficker', 'machine': 'Monkey-SMB', 'ip_addresses': ['192.168.0.1', '10.0.0.18']},
-                                {'type': 'cross_segment', 'machine': 'Monkey-SMB', 'network': '192.168.0.0/24',
-                                 'server_network': '172.168.0.0/24'},
-                                {'type': 'tunnel', 'origin': 'Monkey-SSH', 'dest': 'Monkey-SambaCry'}
-                            ]
                     }
             }
-        # TODO: put implementation in template
-        """
-        return \
-            {
-                'breach_count': ReportService.get_breach_count(),
-                'successful_exploit_types': ReportService.get_successful_exploit_types(),
-                'tunnels': ReportService.get_tunnels(),
-                'reused_passwords': ReportService.get_reused_passwords()
-            }
-        """
 
     @staticmethod
     def did_exploit_type_succeed(exploit_type):

monkey_island/cc/ui/src/components/pages/ReportPage.js

@@ -65,8 +65,8 @@ class ReportPageComponent extends React.Component {
       });
   }
 
-  generateIpListBadges(ip_addresses) {
+  generateInfoBadges(data_array) {
-    return ip_addresses.map(ip_address => <span className="label label-info" style={{margin: '2px'}}>{ip_address}</span>);
+    return data_array.map(badge_data => <span className="label label-info" style={{margin: '2px'}}>{badge_data}</span>);
   }
 
   generateShellshockPathListBadges(paths) {
@@ -76,7 +76,7 @@ class ReportPageComponent extends React.Component {
   generateSmbPasswordIssue(issue) {
     return (
       <div>
-        The machine <span className="label label-primary">{issue.machine}</span> with the following IP addresses {this.generateIpListBadges(issue.ip_addresses)} was vulnerable to a <span className="label label-danger">SMB</span> attack.
+        The machine <span className="label label-primary">{issue.machine}</span> with the following IP address <span className="label label-info" style={{margin: '2px'}}>{issue.ip_address}</span> was vulnerable to a <span className="label label-danger">SMB</span> attack.
         <br />
         The attack succeeded by authenticating over SMB protocol with user <span className="label label-success">{issue.username}</span> and its password.
         <br />
@@ -91,7 +91,7 @@ class ReportPageComponent extends React.Component {
   generateSmbPthIssue(issue) {
     return (
       <div>
-        The machine <span className="label label-primary">{issue.machine}</span> with the following IP addresses {this.generateIpListBadges(issue.ip_addresses)} was vulnerable to a <span className="label label-danger">SMB</span> attack.
+        The machine <span className="label label-primary">{issue.machine}</span> with the following IP address <span className="label label-info" style={{margin: '2px'}}>{issue.ip_address}</span> was vulnerable to a <span className="label label-danger">SMB</span> attack.
         <br />
         The attack succeeded by using a pass-the-hash attack over SMB protocol with user <span className="label label-success">{issue.username}</span>.
         <br />
@@ -106,7 +106,7 @@ class ReportPageComponent extends React.Component {
   generateWmiPasswordIssue(issue) {
     return (
       <div>
-        The machine <span className="label label-primary">{issue.machine}</span> with the following IP addresses {this.generateIpListBadges(issue.ip_addresses)} was vulnerable to a <span className="label label-danger">WMI</span> attack.
+        The machine <span className="label label-primary">{issue.machine}</span> with the following IP address <span className="label label-info" style={{margin: '2px'}}>{issue.ip_address}</span> was vulnerable to a <span className="label label-danger">WMI</span> attack.
         <br />
         The attack succeeded by authenticating over WMI protocol with user <span className="label label-success">{issue.username}</span> and its password.
         <br />
@@ -121,7 +121,7 @@ class ReportPageComponent extends React.Component {
   generateWmiPthIssue(issue) {
     return (
       <div>
-        The machine <span className="label label-primary">{issue.machine}</span> with the following IP addresses {this.generateIpListBadges(issue.ip_addresses)} was vulnerable to a <span className="label label-danger">WMI</span> attack.
+        The machine <span className="label label-primary">{issue.machine}</span> with the following IP address <span className="label label-info" style={{margin: '2px'}}>{issue.ip_address}</span> was vulnerable to a <span className="label label-danger">WMI</span> attack.
         <br />
         The attack succeeded by using a pass-the-hash attack over WMI protocol with user <span className="label label-success">{issue.username}</span>.
         <br />
@@ -136,7 +136,7 @@ class ReportPageComponent extends React.Component {
   generateSshIssue(issue) {
     return (
       <div>
-        The machine <span className="label label-primary">{issue.machine}</span> with the following IP addresses {this.generateIpListBadges(issue.ip_addresses)} was vulnerable to a <span className="label label-danger">SSH</span> attack.
+        The machine <span className="label label-primary">{issue.machine}</span> with the following IP address <span className="label label-info" style={{margin: '2px'}}>{issue.ip_address}</span> was vulnerable to a <span className="label label-danger">SSH</span> attack.
         <br />
         The attack succeeded by authenticating over SSH protocol with user <span className="label label-success">{issue.username}</span> and its password.
         <br />
@@ -151,7 +151,7 @@ class ReportPageComponent extends React.Component {
   generateRdpIssue(issue) {
     return (
       <div>
-        The machine <span className="label label-primary">{issue.machine}</span> with the following IP addresses {this.generateIpListBadges(issue.ip_addresses)} was vulnerable to a <span className="label label-danger">RDP</span> attack.
+        The machine <span className="label label-primary">{issue.machine}</span> with the following IP address <span className="label label-info" style={{margin: '2px'}}>{issue.ip_address}</span> was vulnerable to a <span className="label label-danger">RDP</span> attack.
         <br />
         The attack succeeded by authenticating over RDP protocol with user <span className="label label-success">{issue.username}</span> and its password.
         <br />
@@ -166,7 +166,7 @@ class ReportPageComponent extends React.Component {
   generateSambaCryIssue(issue) {
     return (
       <div>
-        The machine <span className="label label-primary">{issue.machine}</span> with the following IP addresses {this.generateIpListBadges(issue.ip_addresses)} was vulnerable to a <span className="label label-danger">SambaCry</span> attack.
+        The machine <span className="label label-primary">{issue.machine}</span> with the following IP address <span className="label label-info" style={{margin: '2px'}}>{issue.ip_address}</span> was vulnerable to a <span className="label label-danger">SambaCry</span> attack.
         <br />
         The attack succeeded by authenticating over SMB protocol with user <span className="label label-success">{issue.username}</span> and its password, and by using the SambaCry vulnerability.
         <br />
@@ -182,7 +182,7 @@ class ReportPageComponent extends React.Component {
   generateElasticIssue(issue) {
     return (
       <div>
-        The machine <span className="label label-primary">{issue.machine}</span> with the following IP addresses {this.generateIpListBadges(issue.ip_addresses)} was vulnerable to an <span className="label label-danger">Elastic Groovy</span> attack.
+        The machine <span className="label label-primary">{issue.machine}</span> with the following IP address <span className="label label-info" style={{margin: '2px'}}>{issue.ip_address}</span> was vulnerable to an <span className="label label-danger">Elastic Groovy</span> attack.
         <br />
         The attack succeeded because the Elastic Search server was not parched against CVE-2015-1427.
         <br />
@@ -197,7 +197,7 @@ class ReportPageComponent extends React.Component {
   generateShellshockIssue(issue) {
     return (
       <div>
-        The machine <span className="label label-primary">{issue.machine}</span> with the following IP addresses {this.generateIpListBadges(issue.ip_addresses)} was vulnerable to a <span className="label label-danger">ShellShock</span> attack.
+        The machine <span className="label label-primary">{issue.machine}</span> with the following IP address <span className="label label-info" style={{margin: '2px'}}>{issue.ip_address}</span> was vulnerable to a <span className="label label-danger">ShellShock</span> attack.
         <br />
         The attack succeeded because the HTTP server running on port <span className="label label-info">{issue.port}</span> was vulnerable to a shell injection attack on the paths: {this.generateShellshockPathListBadges(issue.paths)}.
         <br />
@@ -212,7 +212,7 @@ class ReportPageComponent extends React.Component {
   generateConfickerIssue(issue) {
     return (
       <div>
-        The machine <span className="label label-primary">{issue.machine}</span> with the following IP addresses {this.generateIpListBadges(issue.ip_addresses)} was vulnerable to a <span className="label label-danger">Conficker</span> attack.
+        The machine <span className="label label-primary">{issue.machine}</span> with the following address <span className="label label-info" style={{margin: '2px'}}>{issue.ip_address}</span> was vulnerable to a <span className="label label-danger">Conficker</span> attack.
         <br />
         The attack succeeded because the target machine uses an outdated and unpatched operating system vulnerable to Conficker.
         <br />
@@ -227,7 +227,7 @@ class ReportPageComponent extends React.Component {
   generateCrossSegmentIssue(issue) {
     return (
       <div>
-        The network can probably be segmented. A monkey instance on <span className="label label-primary">{issue.machine}</span> in the <span className="label label-info">{issue.network}</span> network could directly access the Monkey Island C&C server in the <span className="label label-info">{issue.server_network}</span> network.
+        The network can probably be segmented. A monkey instance on <span className="label label-primary">{issue.machine}</span> in the networks {this.generateInfoBadges(issue.networks)} could directly access the Monkey Island C&C server in the networks {this.generateInfoBadges(issue.server_networks)}.
         <br />
         In order to protect the network, the following steps should be performed:
         <ul className="report">

monkey_island/cc/utils.py

@@ -4,6 +4,7 @@ import sys
 import array
 
 import struct
+import ipaddress
 from netifaces import interfaces, ifaddresses, AF_INET
 
 from cc.database import mongo
@@ -56,3 +57,11 @@ def local_ip_addresses():
         addresses = ifaddresses(interface).get(AF_INET, [])
         ip_list.extend([link['addr'] for link in addresses if link['addr'] != '127.0.0.1'])
     return ip_list
+
+
+def get_subnets():
+    subnets = []
+    for interface in interfaces():
+        addresses = ifaddresses(interface).get(AF_INET, [])
+        subnets.extend([ipaddress.ip_interface(link['addr'] + '/' + link['netmask']).network for link in addresses if link['addr'] != '127.0.0.1'])
+    return subnets

monkey_island/requirements.txt

@@ -10,3 +10,4 @@ Flask-Pymongo
 Flask-Restful
 jsonschema
 netifaces
+ipaddress