Executed cmds info variable refactored
This commit is contained in:
VakarisZ
parent
e38410a232
commit
f9bf3ef9f0
|
|
@ -25,7 +25,7 @@ class HostExploiter(object):
|
|||
'finished': '',
|
||||
'vulnerable_urls': [],
|
||||
'vulnerable_ports': [],
|
||||
'executed_cmds': {}}
|
||||
'executed_cmds': []}
|
||||
self._exploit_attempts = []
|
||||
self.host = host
|
||||
|
||||
|
|
@ -59,8 +59,13 @@ class HostExploiter(object):
|
|||
def add_vuln_port(self, port):
|
||||
self._exploit_info['vulnerable_ports'].append(port)
|
||||
|
||||
def set_example_cmd(self, cmd):
|
||||
self._exploit_info['executed_cmds']['example'] = cmd
|
||||
def add_executed_cmd(self, cmd):
|
||||
"""
|
||||
Appends command to exploiter's info.
|
||||
:param cmd: String of executed command. e.g. 'echo Example'
|
||||
"""
|
||||
command = {'cmd': cmd}
|
||||
self._exploit_info['executed_cmds'].append(command)
|
||||
|
||||
|
||||
from infection_monkey.exploit.win_ms08_067 import Ms08_067_Exploiter
|
||||
|
|
|
|||
|
|
@ -49,7 +49,7 @@ class HadoopExploiter(WebRCE):
|
|||
return False
|
||||
http_thread.join(self.DOWNLOAD_TIMEOUT)
|
||||
http_thread.stop()
|
||||
self.set_example_cmd(command)
|
||||
self.add_executed_cmd(command)
|
||||
return True
|
||||
|
||||
def exploit(self, url, command):
|
||||
|
|
|
|||
|
|
@ -77,7 +77,7 @@ class MSSQLExploiter(HostExploiter):
|
|||
commands.extend(monkey_args)
|
||||
MSSQLExploiter.execute_command(cursor, commands)
|
||||
MSSQLExploiter.run_file(cursor, tmp_file_path)
|
||||
self.set_example_cmd(commands[-1])
|
||||
self.add_executed_cmd(commands[-1])
|
||||
return True
|
||||
|
||||
@staticmethod
|
||||
|
|
|
|||
|
|
@ -343,5 +343,5 @@ class RdpExploiter(HostExploiter):
|
|||
|
||||
LOG.info("Executed monkey '%s' on remote victim %r",
|
||||
os.path.basename(src_path), self.host)
|
||||
self.set_example_cmd(command)
|
||||
self.add_executed_cmd(command)
|
||||
return True
|
||||
|
|
|
|||
|
|
@ -144,7 +144,7 @@ class ShellShockExploiter(HostExploiter):
|
|||
if not (self.check_remote_file_exists(url, header, exploit, self._config.monkey_log_path_linux)):
|
||||
LOG.info("Log file does not exist, monkey might not have run")
|
||||
continue
|
||||
self.set_example_cmd(cmdline)
|
||||
self.add_executed_cmd(cmdline)
|
||||
return True
|
||||
|
||||
return False
|
||||
|
|
|
|||
|
|
@ -178,7 +178,7 @@ class SSHExploiter(HostExploiter):
|
|||
self._config.dropper_target_path_linux, self.host, cmdline)
|
||||
|
||||
ssh.close()
|
||||
self.set_example_cmd(cmdline)
|
||||
self.add_executed_cmd(cmdline)
|
||||
return True
|
||||
|
||||
except Exception as exc:
|
||||
|
|
|
|||
|
|
@ -138,7 +138,7 @@ class VSFTPDExploiter(HostExploiter):
|
|||
if backdoor_socket.send(run_monkey):
|
||||
LOG.info("Executed monkey '%s' on remote victim %r (cmdline=%r)", self._config.dropper_target_path_linux,
|
||||
self.host, run_monkey)
|
||||
self.set_example_cmd(run_monkey)
|
||||
self.add_executed_cmd(run_monkey)
|
||||
return True
|
||||
else:
|
||||
return False
|
||||
|
|
|
|||
|
|
@ -408,7 +408,7 @@ class WebRCE(HostExploiter):
|
|||
# If exploiter returns True / False
|
||||
if type(resp) is bool:
|
||||
LOG.info("Execution attempt successfully finished")
|
||||
self.set_example_cmd(command)
|
||||
self.add_executed_cmd(command)
|
||||
return resp
|
||||
# If exploiter returns command output, we can check for execution errors
|
||||
if 'is not recognized' in resp or 'command not found' in resp:
|
||||
|
|
@ -422,7 +422,7 @@ class WebRCE(HostExploiter):
|
|||
return False
|
||||
LOG.info("Execution attempt finished")
|
||||
|
||||
self.set_example_cmd(command)
|
||||
self.add_executed_cmd(command)
|
||||
return resp
|
||||
|
||||
def get_monkey_upload_path(self, url_to_monkey):
|
||||
|
|
|
|||
|
|
@ -114,7 +114,7 @@ class WmiExploiter(HostExploiter):
|
|||
|
||||
result.RemRelease()
|
||||
wmi_connection.close()
|
||||
self.set_example_cmd(cmdline)
|
||||
self.add_executed_cmd(cmdline)
|
||||
return success
|
||||
|
||||
return False
|
||||
|
|
|
|||
|
|
@ -1,6 +1,5 @@
|
|||
import logging
|
||||
from monkey_island.cc.services.attack.technique_reports import T1210, T1197, T1110, T1075, T1003, T1059
|
||||
from monkey_island.cc.services.attack.attack_telem import AttackTelemService
|
||||
from monkey_island.cc.services.attack.attack_config import AttackConfig
|
||||
from monkey_island.cc.database import mongo
|
||||
|
||||
|
|
|
|||
|
|
@ -13,6 +13,7 @@ class T1003(AttackTechnique):
|
|||
used_msg = "Monkey successfully obtained some credentials from systems on the network."
|
||||
|
||||
query = {'telem_type': 'system_info_collection', '$and': [{'data.credentials': {'$exists': True}},
|
||||
# $gt: {} checks if field is not an empty object
|
||||
{'data.credentials': {'$gt': {}}}]}
|
||||
|
||||
@staticmethod
|
||||
|
|
|
|||
|
|
@ -13,7 +13,7 @@ class T1059(AttackTechnique):
|
|||
used_msg = "Monkey successfully ran commands on exploited machines in the network."
|
||||
|
||||
query = [{'$match': {'telem_type': 'exploit',
|
||||
'data.info.executed_cmds.example': {'$exists': True}}},
|
||||
'data.info.executed_cmds': {'$exists': True, '$ne': []}}},
|
||||
{'$project': {'_id': 0,
|
||||
'machine': '$data.machine',
|
||||
'info': '$data.info'}},
|
||||
|
|
|
|||
|
|
@ -16,7 +16,7 @@ class T1059 extends React.Component {
|
|||
columns: [
|
||||
{Header: 'Machine', id: 'machine', accessor: x => RenderMachine(x.data[0].machine), style: { 'whiteSpace': 'unset'}, width: 160 },
|
||||
{Header: 'Approx. Time', id: 'time', accessor: x => x.data[0].info.finished, style: { 'whiteSpace': 'unset' }},
|
||||
{Header: 'Command', id: 'command', accessor: x => x.data[0].info.executed_cmds.example, style: { 'whiteSpace': 'unset' }},
|
||||
{Header: 'Command', id: 'command', accessor: x => x.data[0].info.executed_cmds[0].cmd, style: { 'whiteSpace': 'unset' }},
|
||||
]
|
||||
}])};
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue