fabu01 #18

p34709852 · 2022-10-12T14:56:40+08:00

p34709852 commented

2022-10-12 14:56:40 +08:00

ces1

p34709852 self-assigned this 2022-10-12 14:56:40 +08:00

p34709852 added 156 commits 2022-10-12 14:56:40 +08:00

21656dabb4

Bump d3-color and d3 in /monkey/monkey_island/cc/ui

Bumps [d3-color](https://github.com/d3/d3-color) to 3.1.0 and updates ancestor dependency [d3](https://github.com/d3/d3). These dependencies need to be updated together.


Updates `d3-color` from 1.4.1 to 3.1.0
- [Release notes](https://github.com/d3/d3-color/releases)
- [Commits](https://github.com/d3/d3-color/compare/v1.4.1...v3.1.0)

Updates `d3` from 5.16.0 to 7.6.1
- [Release notes](https://github.com/d3/d3/releases)
- [Changelog](https://github.com/d3/d3/blob/main/CHANGES.md)
- [Commits](https://github.com/d3/d3/compare/v5.16.0...v7.6.1)

---
updated-dependencies:
- dependency-name: d3-color
  dependency-type: indirect
- dependency-name: d3
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

4ace93e417 Merge branch 'consolidate-agent-event-handlers' into develop

PR #2390

bf4fecf464 Agent: Rename event_queue to agent_event_queue in HostExploiter

0b72e4ef9a Agent: Add publish methods to HostExploiter

3e86766aaf Agent: Use default value for exploiter name

a79d40b42e UT: Fix powershell tests

95b3556cd0 Agent: Exploiter name when publishing events to be __class__.__name__

8e161f0fd9 Agent: Accept tuple as tags to HostExploiter publish events methods

b94002a984 Agent: Make publish methods private

116ae90f3d UT: Remove host exploiter tests

ee77eddaab Agent: Fix tuple type hint

bb11ea7857 Common: Add attack tags

dd35bebb3e Common: Add T1203 attack technique tag

8b4af5c349 Common: Fix typo in attack tags

6a100105be Common: Order attack tags alphanumerically

d1a8ce2082 Common: Add T1210 tag

a07eadce60 Common: Add T1570 attack technique

8e6a098a2e Project: Add HostExploiter methods to vulture_allowlist.py

3172433410 Agent: Swap order of _publish_{propagation,exploitation}_event()

Putting _publish_exploitation_event() first puts the methods in both
alphabetical and chronological order.

a691a16625

Merge pull request #2393 from guardicore/2269-update-hostexploiter

2269 update hostexploiter

73fbc22e3d BB: Remove find_monkeys_in_db

e0c9717da9 BB: Update test_compabitiblity to use new api

2bea619786 BB: Removed unused method and endpoint

b713cce893 Island: Remove /api/test/monkey endpoint

6ae7676322 BB: Pass generator instead of list comprehension to all()

This will allow a short-circuit.

bbbb1ac773 Island: Remove disused LogBlackboxEndpoint

fd8ea53e8b Merge branch '2269-remove-find_monkeys_in_db' into develop

PR #2391

e46bb8964d Common: Add T1003 and T1098 attack technique tags

0ed167fb48 Agent: Import attack technique tags from common in Zerologon

491612f9e8 Common: Add T1005 and T1145 attack technique tags

c8aee645fa Agent: Import attack technique tags from common in SSHCollector

19fcf8d053 Agent: Import attack technique tags from common in MimikatzCollector

c7e2b91735 Agent: Rename event_queue to agent_event_queue in

MimikatzCredentialCollector

2ece91b9df Agent: Rename event_queue to agent_event_queue in SSHCredentialCollector

80a095b657 Agent: Use NetworkPort instead of Port

a390c97b70 Island: Add tcp_connections to node

8bf1d1f46f Island, Common: Add services to machine.py

f6ed8a997c Common: Rename NetworkServiceNameEnum -> NetworkService

"Name" and "Enum" are redundant in this case

eb3daf84f1 Common: Use strings for NetworkService Enum values

d8cf5d33dd Common: Extract MutableInfectionMonkeyModelConfig

8799a60f47 Island: Fix serialization/deserialization of Machine.network_services

10e3c97489 Island: Use Tuple[SocketAddress] for tcp_connections

There are serialization issues when using FrozenSet because pydantic
converts the SocketAddress to a dict, which is not hashable. There are
probably ways to work around this, but it's not worth the effort at thsi
time. If performance becomes an issue (doubtful) we can revisit using a
frozenset instead.

82217b4094

Merge branch 2267-add-network-services into develop

PR #2398

63f869d296 Project: Add common.tags and HostExploiter publish functions to Vulture

73a8c14397 Merge branch '2269-add-attack-technique-tags' into develop

PR #2394

bbcdc1bef4 Island: Make upsert_node method public

Updating/inserting the node into the repository is required outside of repository itself.

6c913895c5 Island: Add TCP connections to nodes based on TCP scan event

249950d602 Island: Improve tcp handler code and coverage

95b1d9c62d Agent: Remove target from publish methods

12e9aaf42e Agent: Add abstract properties for exploiter tags

254b4e1c6c Agent: Update publish methods to accept timestamp

e2453e481c Agent: Rename variables in HostExploiter

2248bdcd67 Island: Add _get_node_by_id method to mongo_node_repository.py

ddaada1f09 Agent: Revise event publishing in SSHExploiter

5948537d4a Agent: Add tags to SSHExploiter

5d9416c385 Agent: Use common.tags to publish events in SSHExploiter

9dac64b60e Agent: Update ssh exploiter tags

dc8a0ac2ad Agent: Extract method _upload_agent_binary

b31eb885f0 Agent: Extract method _get_victim_os

1cb88e029a Agent: Extract method _exploit

a2534391a6 Agent: Extract method _propagate

0a1901b9a1 Agent: Use error to propagate failure

431d6ae775 Agent: Extract method _get_ssh_port

72378f4e53 Agent: Publish scan event when checking ssh port

79f72dda55 Agent: Stop sending PropagationEvent before attempt

e8f48085a4 Agent: Use the tag properties

aba886624e Agent: Send propagation events sooner

e11bd2c7f2 Agent: Stamp start time prior to running exploit

f0112410c9 Agent: Rename stamp to timestamp in SSHExploiter

dcb08b2881 Agent: Convert IPv4Address to str when connecting to socket

95f1e3cb7b Agent: Modify tags methods to be properties in SSHExploiter

c90044074d Island: Remove storage error when node wasn't modified

Upserting should throw an error when updating or inserting went wrong, not when a node is already up to date.

c5506f98e8 Agent: Publish Propagation and Exploitation events from Log4Shell

ef4a465515 Agent: Add tags to exploitation and propagation events in Log4Shell

c5d5418af4 Agent: Fix typo in t1203 attack technique in Log4Shell

0c4b90beb5 Agent: Fix typo

ac69064dec Agent: Send failed exploitation event

48e6e95271 Agent: Update propagation tags for log4shell

016bf5c795 Agent: Stamp times before the exploit runs

0f3f45e92f Agent: Modify Log4Shell tags to be properties

b0ec035909 Island: Move tcp_connection addition to node repository

8dd196122b Agent: Publish events from MSSQLExploiter

2cd9d0086b Agent: Fix mypy error in http_tools.py

33230e85f7 Agent: Use updated publish methods

183bd1145f Agent: Add tags to MSSQL exploitation events

fa8b721abe Common: Add attack technique T1059

aab965bad7 Common: Add attack technique T1071

8317c03686 Agent: Add tags to MSSQL propagation events

9269c8579c Agent: Remove unneccessary technique

5c6b1e3910 Common: Remove unused technique T1071

e404416363 Agent: Use exploit tag properties

66f8471f24 Agent: Remove "summary" event

15974ff21c Agent: Stamp time before running exploit

3bc2e4876f Island: Handle missing node in add_tcp_connections

47846628e6 Agent: Modify MSSQL tags to be properties

0d246a0479 Island: Rename add_tcp_connections to upsert_tcp_connections

ec617df06a Agent: Fix LocketHTTPServer mypy error in MSSQLExploiter

8503e0f499 UT: Remove unused test data structures

bb6716df18 Common: Add attack technique T1059

3bede2f9d1 Agent: Publish propagation events

7d535c72d9 Agent: Publish powershell exploitation events

3bca02af59 Agent: Fix powershell tests

39bada5bb1 Agent: Move assignment outside of try/except

52380a2513 Agent: Publish exploitation event on unexpected SSH exception

c980bfd915 Agent: Move timestamp closer to ssh.exec_command()

de9b5601d8

Merge branch 2269-publish-events-from-sshexec-exploiter into develop

PR #2395

ac11d159fe Agent: Revise Powershell publishing of events

c4573673ce Agent: Rename timestamp -> execute_agent_timestamp

65dd386603 Agent: Collect timestamp before powershell connect

8e3bf96589 Agent: Convert plaintext to str()

get_plaintext() can return bytes. Convert the output to a str in
PowershellClient to avoid potential issues.

b2c5b22128 Merge branch '2269-publish-events-from-powershell-exploiter' into develop

PR #2402

d8fca72f28 Agent: Publish all prop/exploit events from _wait_for_victim()

6bd7042444 Agent: Add VICTIM_WAIT_SLEEP_TIME_SEC constant in log4shell exlpoiter

7bc9993c6f Agent: Reduce VICTIM_WAIT_SLEEP_TIME_SEC to 0.050 seconds

1 second is a long time to wait, and we want our event timestamps to be
more accurate. 0.050 is 10 x sys.getswitchinterval(). It's reasonably
accurate but will also share the CPU nicely.

eac3076828 Agent: Change typehint for build_monkey_commandline's location

The function can handle str, PurePath, or None. This typehint change
reflects that capability

03c6c5ea4b Agent: Remove unnecessary Path -> str in Log4ShellExploiter

ead979c6ca Agent: Add T1110 to Log4Shell exploiter tags

9c2cdf15e2 Agent: Add TODO in Log4ShellExploiter

77d37bdb21 Merge branch '2269-publish-events-from-log4shell-exploiter' into develop

PR #2397

be4ecccdcd Island: Refactor get_node_by_id to raise UnknownRecordError

4709ae771b

Merge pull request #2400 from guardicore/2267-add-tcp-connections

2267 add tcp connections

fe864792f3 Agent: Publish Propagation and Exploitation events from Hadoop

9c185a3a78 Agent: Add tags and error messages in Hadoop

57af640317 Agent: Use correct publish method names

bee1047024 Agent: Update hadoop failed event publishing

c31aed94ea Agent: Move successful explotiation event publish

54b551b728 Agent: Update tags for hadoop events

76ae57281d Agent: Use EXPLOIT_TAGS for exploitation event

4a0a24dde2 Agent: Update hadoop exploiter tags T1570 -> T1105

3e592cfa69 Agent: Use exploiter tag properties

de5d365bb0 Agent: Publish events sooner

76a3cb0ba0 Agent: Stamp time before exploit executes

8f6df12d9c Agent: Modify HadoopExploiter tags to be properties

8bdb30dcfb Agent: Rename stamp to timestamp in Hadoop

c02d43556a Agent: Make Hadoop tags uppercase

25073be9f3 Agent: Remove adding vulnerable urls in Hadoop

Adding vulnerable ulrs causes check to see if the target is exploitable
which calls self.exploit

4c026241ea Island: Change method order in ScanEventHandler

0965b97d45 Island: Use ScanEvent for typehint in ScanEventHandler

`event` gets passed to `_get_source_machine()`, which expects
`ScanEvent`, not `AbstractAgentEvent`

79e8ce5f79 Island: Pass tuple, not set to upsert_tcp_connections()

pydantic can probably handle the set -> tuple conversion itself, but
mypy complains.

3b225a9c7d

Merge pull request #2376 from guardicore/dependabot/npm_and_yarn/monkey/monkey_island/cc/ui/d3-color-and-d3-3.1.0

Bump d3-color and d3 in /monkey/monkey_island/cc/ui

66f5d7a86a Agent: Remove errant exploitation event from hadoop

If no potential URLs are found, then no exploit is attempted, so there's
no reason to publish an ExploitationEvent.

a558948c5d Agent: Remove unnecessary `pass` from MSSQLExploiter

6d60e33c1e Merge branch '2269-publish-events-for-mssql-exploiter' into develop

PR #2401

7a664218bd Agent: Check all potential urls in Hadoop

04fec93c39 Merge branch '2269-publish-events-from-hadoop-exploiter' into develop

PR #2396

0382831701 测试：提交代码

f5bfdc430c 测试：提交代码

4505399049 测试：重复提交代码

9071fc90aa Add test_dumps

de18b55417 Add test_dumps.py

09b3b42dc5 ADD file via upload

df13715203 ADD file via upload

7e0f92802a ADD file via upload

628d21c68b Add requirements.txt

59e5daecd8 Update test_dumps03.py

69e5b7d088 ADD file via upload

p15670423 merged commit bbbc6aca58 into consolidate-agent-event-handlers

2022-10-14 15:51:03 +08:00

Sign in to join this conversation.

No reviewers

No Label

No Milestone

No project

No Assignees

1 Participants

Notifications

Due Date

The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: p15670423/monkey#18