Multi-hop proxy attack technique finished

monkey/monkey_island/cc/models/monkey.py

@@ -68,6 +68,10 @@ class Monkey(Document):
             os = "windows"
         return os
 
+    @staticmethod
+    def get_tunneled_monkeys():
+        return Monkey.objects(tunnel__exists=True)
+    
 
 class MonkeyNotFoundError(Exception):
     pass

monkey/monkey_island/cc/services/attack/technique_reports/T1188.py

@@ -1,5 +1,6 @@
 from monkey_island.cc.services.attack.technique_reports import AttackTechnique
 from monkey_island.cc.models.monkey import Monkey
+from common.utils.attack_utils import ScanStatus
 
 __author__ = "VakarisZ"
 
@@ -11,29 +12,28 @@ class T1188(AttackTechnique):
     scanned_msg = ""
     used_msg = "Monkey used multi-hop proxy."
 
-    query = [{'$match': {'telem_category': 'exploit',
-                         'data.info.executed_cmds': {'$exists': True, '$ne': []}}},
-             {'$unwind': '$data.info.executed_cmds'},
-             {'$sort': {'data.info.executed_cmds.powershell': 1}},
-             {'$project': {'_id': 0,
-                           'machine': '$data.machine',
-                           'info': '$data.info'}},
-             {'$group': {'_id': '$machine', 'data': {'$push': '$$ROOT'}}},
-             {'$project': {'_id': 0, 'data': {'$arrayElemAt': ['$data', 0]}}}]
-
     @staticmethod
     def get_report_data():
-        monkeys = T1188.get_tunneled_monkeys()
+        monkeys = Monkey.get_tunneled_monkeys()
+        hops = []
         for monkey in monkeys:
-            proxy_chain = 0
+            proxy_count = 0
-            proxy = Monkey.objects(id=monkey.tunnel)
+            proxy = initial = monkey
-            while proxy:
+            while proxy.tunnel:
-                proxy_chain += 1
+                proxy_count += 1
-                proxy = Monkey.objects(id=monkey.tunnel)
+                proxy = proxy.tunnel
-
+            if proxy_count > 1:
-        data = {'title': T1188.technique_title()}
+                hops.append({'from': T1188.get_network_info(initial),
+                             'to': T1188.get_network_info(proxy),
+                             'count': proxy_count})
+        if hops:
+            status = ScanStatus.USED.value
+        else:
+            status = ScanStatus.UNSCANNED.value
+        data = T1188.get_base_data_by_status(status)
+        data.update({'hops': hops})
         return data
 
     @staticmethod
-    def get_tunneled_monkeys():
+    def get_network_info(monkey):
-        return Monkey.objects(tunnel__exists=True)
+        return {'ips': monkey.ip_addresses, 'hostname': monkey.hostname}

monkey/monkey_island/cc/ui/src/components/attack/techniques/T1188.js

@@ -0,0 +1,49 @@
+import React from 'react';
+import '../../../styles/Collapse.scss'
+import ReactTable from "react-table";
+import { renderMachineFromSystemData, scanStatus } from "./Helpers"
+
+
+class T1188 extends React.Component {
+
+  constructor(props) {
+    super(props);
+  }
+
+  static getHopColumns() {
+    return ([{
+      Header: "Communications trough multi-hop proxies",
+      columns: [
+        {Header: 'From',
+          id: 'from',
+          accessor: x => renderMachineFromSystemData(x.from),
+          style: { 'whiteSpace': 'unset' }},
+        {Header: 'To',
+          id: 'to',
+          accessor: x => renderMachineFromSystemData(x.to),
+          style: { 'whiteSpace': 'unset' }},
+        {Header: 'Hops',
+          id: 'hops',
+          accessor: x => x.count,
+          style: { 'whiteSpace': 'unset' }},
+        ]
+    }])};
+
+  render() {
+    return (
+      <div>
+        <div>{this.props.data.message}</div>
+        <br/>
+        {this.props.data.status === scanStatus.USED ?
+          <ReactTable
+              columns={T1188.getHopColumns()}
+              data={this.props.data.hops}
+              showPagination={false}
+              defaultPageSize={this.props.data.hops.length}
+          /> : ""}
+      </div>
+    );
+  }
+}
+
+export default T1188;

monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js

@@ -21,6 +21,7 @@ import T1065 from "../attack/techniques/T1065";
 import T1035 from "../attack/techniques/T1035";
 import T1129 from "../attack/techniques/T1129";
 import T1106 from "../attack/techniques/T1106";
+import T1188 from "../attack/techniques/T1188";
 
 const tech_components = {
   'T1210': T1210,
@@ -37,7 +38,8 @@ const tech_components = {
   'T1035': T1035,
   'T1129': T1129,
   'T1106': T1106,
-  'T1107': T1107
+  'T1107': T1107,
+  'T1188': T1188
 };
 
 const classNames = require('classnames');