From 86d6cdfba3e783627e0f5efde3e1d64efb8f1418 Mon Sep 17 00:00:00 2001 From: Daniel Goldberg Date: Mon, 25 Sep 2017 15:13:36 +0300 Subject: [PATCH 1/6] Add elasticsearch fingerprinting. --- chaos_monkey/config.py | 37 +++++++++++++++------ chaos_monkey/example.conf | 4 ++- chaos_monkey/network/__init__.py | 1 + chaos_monkey/network/elasticfinger.py | 48 +++++++++++++++++++++++++++ 4 files changed, 78 insertions(+), 12 deletions(-) create mode 100644 chaos_monkey/network/elasticfinger.py diff --git a/chaos_monkey/config.py b/chaos_monkey/config.py index cfda27913..7e5165cc8 100644 --- a/chaos_monkey/config.py +++ b/chaos_monkey/config.py @@ -1,13 +1,14 @@ import os import sys -from network.range import FixedRange, RelativeRange, ClassCRange -from exploit import WmiExploiter, Ms08_067_Exploiter, SmbExploiter, RdpExploiter, SSHExploiter, ShellShockExploiter,\ - SambaCryExploiter -from network import TcpScanner, PingScanner, SMBFinger, SSHFinger, HTTPFinger +import types +import uuid from abc import ABCMeta from itertools import product -import uuid -import types + +from exploit import WmiExploiter, Ms08_067_Exploiter, SmbExploiter, RdpExploiter, SSHExploiter, ShellShockExploiter, \ + SambaCryExploiter +from network import TcpScanner, PingScanner, SMBFinger, SSHFinger, HTTPFinger, ElasticFinger +from network.range import FixedRange __author__ = 'itamar' @@ -15,6 +16,7 @@ GUID = str(uuid.getnode()) EXTERNAL_CONFIG_FILE = os.path.join(os.path.abspath(os.path.dirname(sys.argv[0])), 'monkey.bin') + def _cast_by_example(value, example): """ a method that casts a value to the type of the parameter given as example @@ -142,7 +144,8 @@ class Configuration(object): scanner_class = TcpScanner finger_classes = [SMBFinger, SSHFinger, PingScanner, HTTPFinger] exploiter_classes = [SmbExploiter, WmiExploiter, RdpExploiter, Ms08_067_Exploiter, # Windows exploits - SSHExploiter, ShellShockExploiter, SambaCryExploiter # Linux + SSHExploiter, ShellShockExploiter, SambaCryExploiter, # Linux + ElasticFinger, ] # how many victims to look for in a single scan iteration @@ -178,7 +181,7 @@ class Configuration(object): range_class = FixedRange range_size = 1 - range_fixed = ['',] + range_fixed = ['', ] blocked_ips = ['', ] @@ -186,7 +189,15 @@ class Configuration(object): HTTP_PORTS = [80, 8080, 443, 8008, # HTTP alternate ] - tcp_target_ports = [22, 2222, 445, 135, 3389] + tcp_target_ports = [22, + 445, + 135, + 3389, + 80, + 8080, + 443, + 8008, + 9200] tcp_target_ports.extend(HTTP_PORTS) tcp_scan_timeout = 3000 # 3000 Milliseconds tcp_scan_interval = 200 @@ -211,13 +222,17 @@ class Configuration(object): # User and password dictionaries for exploits. def get_exploit_user_password_pairs(self): + """ + Returns all combinations of the configurations users and passwords + :return: + """ return product(self.exploit_user_list, self.exploit_password_list) exploit_user_list = ['Administrator', 'root', 'user'] exploit_password_list = ["Password1!", "1234", "password", "12345678"] # smb/wmi exploiter - smb_download_timeout = 300 # timeout in seconds + smb_download_timeout = 300 # timeout in seconds smb_service_name = "InfectionMonkey" # Timeout (in seconds) for sambacry's trigger to yield results. @@ -243,7 +258,6 @@ class Configuration(object): # Monkey copy filename on share (64 bit) sambacry_monkey_copy_filename_64 = "monkey64_2" - # system info collection collect_system_info = True @@ -253,4 +267,5 @@ class Configuration(object): mimikatz_dll_name = "mk.dll" + WormConfiguration = Configuration() diff --git a/chaos_monkey/example.conf b/chaos_monkey/example.conf index 4396cae34..982482cdf 100644 --- a/chaos_monkey/example.conf +++ b/chaos_monkey/example.conf @@ -39,6 +39,7 @@ "SSHFinger", "PingScanner", "HTTPFinger", + "ElasticFinger", "SMBFinger" ], "max_iterations": 3, @@ -83,7 +84,8 @@ 80, 8080, 443, - 8008 + 8008, + 9200 ], "timeout_between_iterations": 10, "use_file_logging": true, diff --git a/chaos_monkey/network/__init__.py b/chaos_monkey/network/__init__.py index 850159342..8e31d3f11 100644 --- a/chaos_monkey/network/__init__.py +++ b/chaos_monkey/network/__init__.py @@ -23,5 +23,6 @@ from tcp_scanner import TcpScanner from smbfinger import SMBFinger from sshfinger import SSHFinger from httpfinger import HTTPFinger +from elasticfinger import ElasticFinger from info import local_ips from info import get_free_tcp_port diff --git a/chaos_monkey/network/elasticfinger.py b/chaos_monkey/network/elasticfinger.py new file mode 100644 index 000000000..ea7bec14c --- /dev/null +++ b/chaos_monkey/network/elasticfinger.py @@ -0,0 +1,48 @@ +import json +import logging +from contextlib import closing + +import requests +from requests.exceptions import Timeout, ConnectionError + +from model.host import VictimHost +from network import HostFinger + +ES_PORT = 9200 +ES_SERVICE = 'es-3306' + +LOG = logging.getLogger(__name__) +__author__ = 'danielg' + + +class ElasticFinger(HostFinger): + """ + Fingerprints mysql databases, only on port 3306 + """ + + def __init__(self): + self._config = __import__('config').WormConfiguration + + def get_host_fingerprint(self, host): + """ + Returns elasticsearch metadata + :param host: + :return: Success/failure, data is saved in the host struct + """ + assert isinstance(host, VictimHost) + try: + url = 'http://%s:%s/' % (host.ip_addr, ES_PORT) + with closing(requests.get(url, timeout=1)) as req: + data = json.loads(req.text) + host.services[ES_SERVICE] = {} + host.services[ES_SERVICE]['name'] = 'ElasticSearch' + host.services[ES_SERVICE]['cluster_name'] = data['name'] + host.services[ES_SERVICE]['version'] = data['version']['number'] + return True + except Timeout: + LOG.debug("Got timeout while trying to read header information") + except ConnectionError: # Someone doesn't like us + LOG.debug("Unknown connection error") + except KeyError: + LOG.debug("Failed parsing the ElasticSearch JSOn response") + return False From 5ed6e37959263976bbba1107c43973646f6c6898 Mon Sep 17 00:00:00 2001 From: Daniel Goldberg Date: Mon, 25 Sep 2017 15:32:01 +0300 Subject: [PATCH 2/6] Bug fix --- chaos_monkey/config.py | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/chaos_monkey/config.py b/chaos_monkey/config.py index 7e5165cc8..81e583096 100644 --- a/chaos_monkey/config.py +++ b/chaos_monkey/config.py @@ -142,10 +142,9 @@ class Configuration(object): max_iterations = 1 scanner_class = TcpScanner - finger_classes = [SMBFinger, SSHFinger, PingScanner, HTTPFinger] + finger_classes = [SMBFinger, SSHFinger, PingScanner, HTTPFinger, ElasticFinger, ] exploiter_classes = [SmbExploiter, WmiExploiter, RdpExploiter, Ms08_067_Exploiter, # Windows exploits SSHExploiter, ShellShockExploiter, SambaCryExploiter, # Linux - ElasticFinger, ] # how many victims to look for in a single scan iteration From d5f6812a080f5a792f05654635770c567c2a37fd Mon Sep 17 00:00:00 2001 From: Daniel Goldberg Date: Mon, 25 Sep 2017 15:32:13 +0300 Subject: [PATCH 3/6] Fix permission bug to work in non admin contexts. --- chaos_monkey/system_info/__init__.py | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/chaos_monkey/system_info/__init__.py b/chaos_monkey/system_info/__init__.py index b9a16d459..c95caa444 100644 --- a/chaos_monkey/system_info/__init__.py +++ b/chaos_monkey/system_info/__init__.py @@ -78,7 +78,19 @@ class InfoCollector(object): "cmdline": "ACCESS DENIED", "full_image_path": "null", } - pass + continue + except WindowsError: + # we may be running as non root + # and some processes are impossible to acquire in Windows/Linux + # in this case we'll just add what we can + processes[process.pid] = {"name": "null", + "pid": process.pid, + "ppid": process.ppid(), + "cmdline": "ACCESS DENIED", + "full_image_path": "null", + } + continue + self.info['process_list'] = processes def get_network_info(self): From f3a172fc4af308389be75fa26a6a453d74ce7e8d Mon Sep 17 00:00:00 2001 From: Daniel Goldberg Date: Mon, 25 Sep 2017 18:02:21 +0300 Subject: [PATCH 4/6] Fixed CR notes https://github.com/guardicore/monkey/pull/48#pullrequestreview-64914540 --- chaos_monkey/config.py | 1 + chaos_monkey/network/elasticfinger.py | 11 ++++++----- chaos_monkey/system_info/__init__.py | 19 +++++-------------- 3 files changed, 12 insertions(+), 19 deletions(-) diff --git a/chaos_monkey/config.py b/chaos_monkey/config.py index 81e583096..e5a7d736a 100644 --- a/chaos_monkey/config.py +++ b/chaos_monkey/config.py @@ -189,6 +189,7 @@ class Configuration(object): 8008, # HTTP alternate ] tcp_target_ports = [22, + 2222, 445, 135, 3389, diff --git a/chaos_monkey/network/elasticfinger.py b/chaos_monkey/network/elasticfinger.py index ea7bec14c..8c21887ee 100644 --- a/chaos_monkey/network/elasticfinger.py +++ b/chaos_monkey/network/elasticfinger.py @@ -9,15 +9,15 @@ from model.host import VictimHost from network import HostFinger ES_PORT = 9200 -ES_SERVICE = 'es-3306' - +ES_SERVICE = 'elastic-seach-3306' +ES_HTTP_TIMEOUT = 5 LOG = logging.getLogger(__name__) __author__ = 'danielg' class ElasticFinger(HostFinger): """ - Fingerprints mysql databases, only on port 3306 + Fingerprints elastic search clusters, only on port 3306 """ def __init__(self): @@ -32,11 +32,12 @@ class ElasticFinger(HostFinger): assert isinstance(host, VictimHost) try: url = 'http://%s:%s/' % (host.ip_addr, ES_PORT) - with closing(requests.get(url, timeout=1)) as req: + with closing(requests.get(url, timeout=ES_HTTP_TIMEOUT)) as req: data = json.loads(req.text) host.services[ES_SERVICE] = {} host.services[ES_SERVICE]['name'] = 'ElasticSearch' - host.services[ES_SERVICE]['cluster_name'] = data['name'] + host.services[ES_SERVICE]['cluster_name'] = data['cluster_name'] + host.services[ES_SERVICE]['name'] = data['name'] host.services[ES_SERVICE]['version'] = data['version']['number'] return True except Timeout: diff --git a/chaos_monkey/system_info/__init__.py b/chaos_monkey/system_info/__init__.py index c95caa444..ddf13d885 100644 --- a/chaos_monkey/system_info/__init__.py +++ b/chaos_monkey/system_info/__init__.py @@ -1,8 +1,10 @@ -import sys import socket +import sys + import psutil from enum import IntEnum -from network.info import get_host_subnets, local_ips + +from network.info import get_host_subnets __author__ = 'uri' @@ -68,18 +70,7 @@ class InfoCollector(object): "cmdline": " ".join(process.cmdline()), "full_image_path": process.exe(), } - except psutil.AccessDenied: - # we may be running as non root - # and some processes are impossible to acquire in Windows/Linux - # in this case we'll just add what we can - processes[process.pid] = {"name": "null", - "pid": process.pid, - "ppid": process.ppid(), - "cmdline": "ACCESS DENIED", - "full_image_path": "null", - } - continue - except WindowsError: + except (psutil.AccessDenied, WindowsError): # we may be running as non root # and some processes are impossible to acquire in Windows/Linux # in this case we'll just add what we can From bd279446fed65ac28480e6c4e492598e7a49d96b Mon Sep 17 00:00:00 2001 From: itaymmguardicore <30774653+itaymmguardicore@users.noreply.github.com> Date: Mon, 25 Sep 2017 18:15:14 +0300 Subject: [PATCH 5/6] Update elasticfinger.py --- chaos_monkey/network/elasticfinger.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/chaos_monkey/network/elasticfinger.py b/chaos_monkey/network/elasticfinger.py index 8c21887ee..28710ca80 100644 --- a/chaos_monkey/network/elasticfinger.py +++ b/chaos_monkey/network/elasticfinger.py @@ -9,7 +9,7 @@ from model.host import VictimHost from network import HostFinger ES_PORT = 9200 -ES_SERVICE = 'elastic-seach-3306' +ES_SERVICE = 'elastic-search-3306' ES_HTTP_TIMEOUT = 5 LOG = logging.getLogger(__name__) __author__ = 'danielg' From 192c24f6d4205e92c03c28c108cfed7fc815004f Mon Sep 17 00:00:00 2001 From: itaymmguardicore <30774653+itaymmguardicore@users.noreply.github.com> Date: Mon, 25 Sep 2017 18:17:51 +0300 Subject: [PATCH 6/6] Update elasticfinger.py --- chaos_monkey/network/elasticfinger.py | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/chaos_monkey/network/elasticfinger.py b/chaos_monkey/network/elasticfinger.py index 28710ca80..730decf4f 100644 --- a/chaos_monkey/network/elasticfinger.py +++ b/chaos_monkey/network/elasticfinger.py @@ -9,7 +9,7 @@ from model.host import VictimHost from network import HostFinger ES_PORT = 9200 -ES_SERVICE = 'elastic-search-3306' +ES_SERVICE = 'elastic-search-9200' ES_HTTP_TIMEOUT = 5 LOG = logging.getLogger(__name__) __author__ = 'danielg' @@ -17,7 +17,7 @@ __author__ = 'danielg' class ElasticFinger(HostFinger): """ - Fingerprints elastic search clusters, only on port 3306 + Fingerprints elastic search clusters, only on port 9200 """ def __init__(self): @@ -35,7 +35,6 @@ class ElasticFinger(HostFinger): with closing(requests.get(url, timeout=ES_HTTP_TIMEOUT)) as req: data = json.loads(req.text) host.services[ES_SERVICE] = {} - host.services[ES_SERVICE]['name'] = 'ElasticSearch' host.services[ES_SERVICE]['cluster_name'] = data['cluster_name'] host.services[ES_SERVICE]['name'] = data['name'] host.services[ES_SERVICE]['version'] = data['version']['number']