52ff1e894a
Swimm: update exercise Add a new Post Breach Action (PBA) afMu3y3ny5lnrYFWl3EI
2022-03-29 14:28:07 -04:00
2992d91f16
Merge pull request #1817 from guardicore/1801-credentials-store
...
1801 credentials store
2022-03-29 13:54:32 -04:00
6ab7bd2f45
Agent, UT: Remove leftover that cause overwrite in CredentialsStore
...
* Use `add` instead of `update` - `add` doesn't let to have duplicates
* Move TestTelem to conftest in UT telemetry messenger
2022-03-29 19:53:39 +02:00
7e476fb649
UT: Fix failing telemetry/pba tests
2022-03-29 13:38:18 -04:00
2ecfdcfe46
Agent: Remove stale TODO in ZerologonExploiter
2022-03-29 13:02:26 -04:00
9ded75d05d
Agent: Update TODO in bit_manipulators.py
2022-03-29 12:57:31 -04:00
baa9de4087
Agent: Remove stale TODO in AutomatedMaster
2022-03-29 12:44:41 -04:00
a3c5d9dd7a
Agent: Remove stale TODO in monkey.py
2022-03-29 12:40:20 -04:00
763cf578c7
Agent: Move credentials request caching to AggregatingCredentialsStore
...
The ControlChannel shouldn't be concerned with caching. It's mission
should be to service requests. The caching is more appropriately placed
in the AggregatingCredentialsStore.
2022-03-29 12:00:57 -04:00
b49d9d9b9a
Agent, UT: Update credentials store using `setdefault().update`
...
* get_credentials use PropgationCredentials type
* private stored credentials in Aggregating Credentials Store
* initial values in credentials store constructor
* build_puppet accepts ICredentialsStore
* private telemetry_messenger in monkey
2022-03-29 17:56:39 +02:00
def62940af
Agent: Add PropagationCredentials type
2022-03-29 17:36:48 +02:00
e844ecf4e4
Agent: Create credentials store before building the puppet
2022-03-29 17:36:48 +02:00
638658178b
Agent: Create credential attribute even if we don't have credentials
2022-03-29 17:36:48 +02:00
0a5fc84b4e
Agent: Fix timeout in ZeroLogon
...
Timeout should be on DCERPC transport factory.
2022-03-29 17:36:48 +02:00
e7e6201d75
Agent: Use credential intercepting messenger in Zerologon
2022-03-29 17:36:48 +02:00
b8a72a9719
UT: Add credentials intercepting telemetry messenger tests
...
Add __test__ to False to discard pytest warning about __init__
constructors of TestTelem classes
2022-03-29 17:36:48 +02:00
06773ba9d9
UT: Fix AutomatedMaster unit test to include Credentials Store
2022-03-29 17:36:48 +02:00
1b9bbfe752
Agent: Fix ssh string to include proper user and ip
2022-03-29 17:36:48 +02:00
ccb0337aef
Agent: Add return to get credentials method in Credentials Store
2022-03-29 17:36:48 +02:00
d434c20bcb
Agent: Inject credentials store to Automated Master
...
Intercept credentials and update the credentials store using
credentials intercepting telemetry messenger
2022-03-29 17:36:48 +02:00
4de90584c9
Agent: Add Credentials intercepting telemetry messenger
2022-03-29 17:36:48 +02:00
eb6342e2f8
Agent: Add public credentials property to CredentialsTelem
2022-03-29 17:36:48 +02:00
5060ddb5d1
Agent: Fix logic in concrete Credentials Store
2022-03-29 17:36:48 +02:00
162dd0a920
UT: Add Credentials Store tests
2022-03-29 17:36:48 +02:00
b5d2d1d641
Agent: Implement concrete Credentials Store
2022-03-29 17:36:48 +02:00
cafbe97880
Agent: Add interface for Credentials Store
2022-03-29 17:36:48 +02:00
cf211bc46f
Merge pull request #1824 from guardicore/1604-itelemetrymessenger-in-pbas
...
Telemetry messenger in PBAs
2022-03-29 11:31:42 -04:00
dbbdb508e3
Agent: Change PBA constructor to accept telemetry messenger
...
This change allows to run different PBA's with different telemetry messengers
2022-03-29 17:04:48 +03:00
6937b1a5c5
Merge pull request #1825 from guardicore/check-supported-os-for-exploiters
...
Check supported os for exploiters
2022-03-29 09:57:24 -04:00
a2e283e824
UT: Update automated_master_config.json
2022-03-29 09:49:43 -04:00
8737a3df89
Agent: Remove disused HostExploiter._TARGET_OS_TYPE
2022-03-29 09:49:43 -04:00
ddbe5b463f
Agent: Skip exploiter if victim OS is not supported
2022-03-29 09:49:41 -04:00
1c24411b26
Agent: Pass telemetry messenger to PBAs for sending ATT&CK telem
2022-03-29 16:29:24 +03:00
8d4c29fc06
Agent: Fix return types for run_pba in puppets and master
2022-03-29 18:38:25 +05:30
314bc49d1c
Merge pull request #1822 from guardicore/1604-modify-pbas-to-return-postbreachdata
...
Modify PBAs to return PostBreachData
2022-03-29 18:23:50 +05:30
246a72c940
Agent: Modify comment in shell startup PBA to make more sense
2022-03-29 17:16:17 +05:30
70186a40f6
Agent: Remove comment from function in backdoor user PBA since the code is self-explanatory
2022-03-29 17:13:44 +05:30
ba49e4d23e
Agent: Small style improvements in PBA code
2022-03-29 14:20:29 +03:00
1f2867a70a
Project: Add ProcessListCollection to Vulture's allowlist
2022-03-29 14:20:29 +03:00
61ff95b568
Agent: Modify PBAs to return Iterable[PostBreachData]
2022-03-29 14:20:29 +03:00
778f230589
Agent: Modify remaining PBAs to yield PostBreachData
2022-03-29 14:20:29 +03:00
ec2b2beca5
Agent: Modify PBAs to yield PostBreachData instead of returning it
...
This is done mainly because of the hide files PBA which needs to send
telemetry two times. It also makes more sense to do it this way so that
it's easier to send telemetry multiple times in any PBA.
2022-03-29 14:20:28 +03:00
28ff112872
Agent: Modify hide files PBA to return PostBreachData
2022-03-29 14:20:25 +03:00
8418a5ce77
Agent: Modify modify shell startup files PBA to return PostBreachData
2022-03-29 14:18:22 +03:00
29d40f8e9d
Agent: Modify communicates as backdoor user PBA to return PostBreachData
2022-03-29 14:18:22 +03:00
0b2ac96dee
Agent: Modify use signed scripts PBA to return PostBreachData
2022-03-29 14:18:22 +03:00
5a8e8850a5
Agent: Modify schedule jobs PBA to return PostBreachData
2022-03-29 14:18:22 +03:00
24ba5e37da
Agent: Modify collect running processes PBA to return PostBreachData
2022-03-29 14:18:22 +03:00
ee24538407
Agent: Modify clear command history PBA to return PostBreachData
2022-03-29 14:18:22 +03:00
2e48d9ead9
Agent: Return PostBreachData in PBA's run() instead of sending PostBreachTelem
2022-03-29 14:18:22 +03:00
Mike Salvatore
Ilija Lazoroski
vakarisz
Shreya Malviya