From d9d8c813aa11d42eed2d7742b894902596d75b16 Mon Sep 17 00:00:00 2001 From: Shreya Date: Fri, 3 Jul 2020 22:54:09 +0530 Subject: [PATCH] Code review + other tiny changes --- monkey/common/data/post_breach_consts.py | 2 +- .../post_breach/actions/use_trap_command.py | 2 +- .../{linux/trap_command.py => linux_trap_command.py} | 3 +-- .../post_breach/trap_command/trap_command.py | 2 +- .../cc/services/attack/technique_reports/T1154.py | 6 +++--- 5 files changed, 7 insertions(+), 8 deletions(-) rename monkey/infection_monkey/post_breach/trap_command/{linux/trap_command.py => linux_trap_command.py} (75%) diff --git a/monkey/common/data/post_breach_consts.py b/monkey/common/data/post_breach_consts.py index 408904a33..16d53b746 100644 --- a/monkey/common/data/post_breach_consts.py +++ b/monkey/common/data/post_breach_consts.py @@ -3,4 +3,4 @@ POST_BREACH_BACKDOOR_USER = "Backdoor user" POST_BREACH_FILE_EXECUTION = "File execution" POST_BREACH_SHELL_STARTUP_FILE_MODIFICATION = "Modify shell startup file" POST_BREACH_HIDDEN_FILES = "Hide files and directories" -POST_BREACH_TRAP_COMMAND = "Execute command on signal interrupt" +POST_BREACH_TRAP_COMMAND = "Execute command when a particular signal is received" diff --git a/monkey/infection_monkey/post_breach/actions/use_trap_command.py b/monkey/infection_monkey/post_breach/actions/use_trap_command.py index eb9aed4a0..74ffdcb28 100644 --- a/monkey/infection_monkey/post_breach/actions/use_trap_command.py +++ b/monkey/infection_monkey/post_breach/actions/use_trap_command.py @@ -10,4 +10,4 @@ class TrapCommand(PBA): if not is_windows_os(): linux_cmds = get_trap_commands() super(TrapCommand, self).__init__(POST_BREACH_TRAP_COMMAND, - linux_cmd=' '.join(linux_cmds)) + linux_cmd=linux_cmds) diff --git a/monkey/infection_monkey/post_breach/trap_command/linux/trap_command.py b/monkey/infection_monkey/post_breach/trap_command/linux_trap_command.py similarity index 75% rename from monkey/infection_monkey/post_breach/trap_command/linux/trap_command.py rename to monkey/infection_monkey/post_breach/trap_command/linux_trap_command.py index a042a0432..8a251e258 100644 --- a/monkey/infection_monkey/post_breach/trap_command/linux/trap_command.py +++ b/monkey/infection_monkey/post_breach/trap_command/linux_trap_command.py @@ -1,6 +1,5 @@ def get_linux_trap_commands(): return [ - 'trap \'echo \"Successfully used trap command\"\' INT &&', - 'kill -2 $$ ;', # send SIGINT signal + 'trap \'echo \"Successfully used trap command\"\' INT && kill -2 $$ ;', # trap and send SIGINT signal 'trap - INT' # untrap SIGINT ] diff --git a/monkey/infection_monkey/post_breach/trap_command/trap_command.py b/monkey/infection_monkey/post_breach/trap_command/trap_command.py index d4d2b94cb..208b21eda 100644 --- a/monkey/infection_monkey/post_breach/trap_command/trap_command.py +++ b/monkey/infection_monkey/post_breach/trap_command/trap_command.py @@ -1,4 +1,4 @@ -from infection_monkey.post_breach.trap_command.linux.trap_command import\ +from infection_monkey.post_breach.trap_command.linux_trap_command import\ get_linux_trap_commands diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1154.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1154.py index f23f1bbca..5a1d56503 100644 --- a/monkey/monkey_island/cc/services/attack/technique_reports/T1154.py +++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1154.py @@ -9,9 +9,9 @@ __author__ = "shreyamalviya" class T1154(AttackTechnique): tech_id = "T1154" - unscanned_msg = "Monkey did not use the trap command on the system." - scanned_msg = "Monkey tried using the trap command but failed on the system." - used_msg = "Monkey used the trap command on the system." + unscanned_msg = "Monkey did not use the trap command." + scanned_msg = "Monkey tried using the trap command but failed." + used_msg = "Monkey used the trap command successfully." query = [{'$match': {'telem_category': 'post_breach', 'data.name': POST_BREACH_TRAP_COMMAND}},