Code review + other tiny changes

This commit is contained in:
Shreya 2020-07-03 22:54:09 +05:30
parent a74f2a5ead
commit d9d8c813aa
5 changed files with 7 additions and 8 deletions

View File

@ -3,4 +3,4 @@ POST_BREACH_BACKDOOR_USER = "Backdoor user"
POST_BREACH_FILE_EXECUTION = "File execution"
POST_BREACH_SHELL_STARTUP_FILE_MODIFICATION = "Modify shell startup file"
POST_BREACH_HIDDEN_FILES = "Hide files and directories"
POST_BREACH_TRAP_COMMAND = "Execute command on signal interrupt"
POST_BREACH_TRAP_COMMAND = "Execute command when a particular signal is received"

View File

@ -10,4 +10,4 @@ class TrapCommand(PBA):
if not is_windows_os():
linux_cmds = get_trap_commands()
super(TrapCommand, self).__init__(POST_BREACH_TRAP_COMMAND,
linux_cmd=' '.join(linux_cmds))
linux_cmd=linux_cmds)

View File

@ -1,6 +1,5 @@
def get_linux_trap_commands():
return [
'trap \'echo \"Successfully used trap command\"\' INT &&',
'kill -2 $$ ;', # send SIGINT signal
'trap \'echo \"Successfully used trap command\"\' INT && kill -2 $$ ;', # trap and send SIGINT signal
'trap - INT' # untrap SIGINT
]

View File

@ -1,4 +1,4 @@
from infection_monkey.post_breach.trap_command.linux.trap_command import\
from infection_monkey.post_breach.trap_command.linux_trap_command import\
get_linux_trap_commands

View File

@ -9,9 +9,9 @@ __author__ = "shreyamalviya"
class T1154(AttackTechnique):
tech_id = "T1154"
unscanned_msg = "Monkey did not use the trap command on the system."
scanned_msg = "Monkey tried using the trap command but failed on the system."
used_msg = "Monkey used the trap command on the system."
unscanned_msg = "Monkey did not use the trap command."
scanned_msg = "Monkey tried using the trap command but failed."
used_msg = "Monkey used the trap command successfully."
query = [{'$match': {'telem_category': 'post_breach',
'data.name': POST_BREACH_TRAP_COMMAND}},