2af3878e81
common: Pick up version details from deployment.json in common/version.py
2021-09-10 16:36:26 +05:30
2b9b755177
island: Extract deployment type and version number into deployment.json
2021-09-10 16:29:31 +05:30
c46c02507f
build_scripts: Extract deployment field from server configs to separate files for appimage and docker
2021-09-10 15:21:34 +05:30
dec2fc43c2
Merge pull request #1449 from guardicore/powershell-exploiter-ntlm-hashes
...
Use LM and NT hashes in powershell exploiter
2021-09-09 11:56:02 +03:00
1ba10d7059
UT: Fix powershell copy_file tests
2021-09-09 10:35:24 +02:00
cc1c049ee9
Refactor test_login_attemps_correctly_reported in test_powershell.py to address the changes in the flow of powershell and powershell client
2021-09-09 11:34:38 +03:00
e44e8f503e
Refactor powershell client to not perform actions on init and clean up powershell exploiter a bit
2021-09-07 12:18:34 +03:00
eefd7a69e8
Merge pull request #1453 from guardicore/bugfix-expanded-report-reset
...
Don't collapse PBA table in security report on data change
2021-09-07 13:09:00 +05:30
f917258979
CHANGELOG: Add entry for bugfix (table collapse on reset)
2021-09-06 18:33:23 +05:30
114758978b
cc: Set `collapseOnDataChange` to false in PBA table in security report
2021-09-06 18:31:35 +05:30
d27194c568
Zoo: Fix powershell bb config for ntlm hash
2021-09-06 13:50:24 +02:00
6740812f4b
Merge pull request #1439 from guardicore/remove-standard-environment
...
Remove standard environment (insecure access feature)
2021-09-06 13:18:27 +05:30
57908b94eb
Merge pull request #1452 from guardicore/1418/bb-to-use-credentials
...
Zoo: Change island to use credentials
2021-09-06 10:28:39 +03:00
1e5d49024d
Zoo: Change island to use credentials
2021-09-06 09:17:15 +02:00
17bc9e3f75
Merge pull request #1451 from guardicore/logo_overlap_bugfix
...
Fix the Guardicore logo overlap
2021-09-03 15:33:08 +03:00
f2739f426c
Add a CHANGELOG.md entry about the fixed Guardicore logo overlapping
2021-09-03 15:30:50 +03:00
4dbd7b41f5
Fix the Guardicore logo which is overlaping the landing page buttons on smaller screens
2021-09-03 15:27:04 +03:00
65c9be90d3
Docs: Add NTLM hash details to PowerShell exploiter docs
2021-09-02 14:29:07 -04:00
71c4e4d8dc
Agent: Fix incorrect host arch identification in PowerShellClient
2021-09-02 14:06:36 -04:00
1a1a130716
Agent: Format NT/LM hashes for use with pypsrp in PowerShellClient
2021-09-02 13:26:24 -04:00
9cc488d36a
Agent: Remove powershell_utils/utils.py
...
Move single function that was previously in
powershell_utils/utils.py to powershell.py
2021-09-02 13:26:24 -04:00
501fc162b4
Agent: Attempt login with LM and NT hashes in PowerShellExploiter
2021-09-02 13:26:23 -04:00
a2e6b0bfbd
Agent: Add LM and NT hashes to PowerShell Credentials
...
Adds two list parameters to get_credentials() that contain LM and NT
hashes respectively. Adds a "secret_type" field to Credentials so that
the user of the Credentials object can distinguish between using cached
credentials (on windows), passwords, and NT or LM hashes.
2021-09-02 12:29:49 -04:00
3a6f725cc4
Agent: Rename Credentials.password to Credentials.secret
...
The PowerShell Credentials dataclass will hold more than just passwords.
It will also hold NT and LM hashes. "secret" is, therefore, a more
accurate name than "password".
2021-09-02 12:02:30 -04:00
0ecbfdea38
Merge pull request #1446 from guardicore/powershell-exploiter-refactor
...
Powershell exploiter refactor
2021-09-02 11:58:01 -04:00
023d6a2d04
Tests: Add more tests for PowerShellExploiter
2021-09-02 11:54:22 -04:00
936074605f
Agent: Ensure temp file is removed by PowerShellExploiter
2021-09-02 11:53:13 -04:00
be5d354c06
Merge pull request #1447 from guardicore/add-machine-to-powershell-bb
...
Zoo: Add new machine for powershell exploiter
2021-09-02 18:27:17 +03:00
18c21513af
Zoo: Add new machine for powershell exploiter
2021-09-02 17:06:22 +02:00
8144a3334e
Tests: Add HTTP vs HTPS unit tests for PowerShellExploiter
2021-09-02 10:05:08 -04:00
cd9d5b4c5e
Agent: Change trap command signal to TERM
2021-09-02 07:55:47 -04:00
a5af16e44e
Agent: Extract PowerShellClient from PowerShellExploiter
2021-09-01 19:59:02 -04:00
c9e54412c0
Agent: Use dummy username and password when testing PowerShell HTTP
...
The exploit_user_list and exploit_password_list are not guaranteed to
have at least one entry. If either list is empty the exploiter will
fail. Use constant strings for the username and password to avoid
potentially crashing the exploiter.
2021-09-01 13:55:18 -04:00
61c6bf2567
Agent: Reduce code duplication in _try_http(s)() methods
2021-09-01 13:52:55 -04:00
d30a8b007a
Agent: Add comment explaining user/password == None in PowerShell
2021-09-01 13:48:13 -04:00
e6399de860
Agent: Move get_credentials() to credentials.py
2021-09-01 13:39:46 -04:00
a060313d09
Agent: Move get_auth_options() to auth_options.py
2021-09-01 13:39:46 -04:00
da3475c645
Agent: Move Powershell auth and encryption selection to AuthOptions
2021-09-01 13:39:40 -04:00
892aa83b39
Agent: Separate AuthOptions from Credentials
2021-09-01 13:03:33 -04:00
b3436d660f
Tests: Move PowerShell get_credentials() tests
...
Move the tests for the PowerShell exploiter's get_credentials() function
to test_credential_generators.py, since get_credentials() is now
contained in credential_generators.py
2021-09-01 12:06:58 -04:00
19c1d5c1ae
Agent: Rename credential_generation -> credential_generators
2021-09-01 12:05:08 -04:00
473fe36ba7
Merge pull request #1438 from guardicore/powershell_http
...
Adds the capability to exploit powershell remoting via HTTP
2021-09-01 11:59:41 -04:00
47393b2d55
Fix powershell credential generation tests to use AuthOptions class
2021-09-01 17:33:27 +03:00
aedc666e8f
Remove IP address from AuthOptions in powershell
2021-09-01 16:35:27 +03:00
b82f4e157a
Add logging to powershell exploiter in the case where powershell remoting seems to be disabled
2021-09-01 16:35:27 +03:00
b2e1b28059
Add the capability to exploit powershell remoting over HTTP and improve the code style
2021-09-01 16:35:27 +03:00
b4e861cdd6
Island: Remove disused set_server_config.py
2021-09-01 08:54:54 -04:00
f6561fb1ab
docs: Modify docs based on changes removing no auth option
2021-09-01 18:14:18 +05:30
ffd421bed6
cc: Remove authentication code related to standard environment
2021-09-01 18:14:12 +05:30
8ef07bdca0
CHANGELOG: Update with insecure access removal
2021-09-01 16:52:48 +05:30
Shreya Malviya
VakarisZ
Ilija Lazoroski
VakarisZ
Mike Salvatore