diff --git a/monkey/infection_monkey/exploit/__init__.py b/monkey/infection_monkey/exploit/__init__.py index f2decb590..7353d77bc 100644 --- a/monkey/infection_monkey/exploit/__init__.py +++ b/monkey/infection_monkey/exploit/__init__.py @@ -1,6 +1,7 @@ from abc import ABCMeta, abstractmethod, abstractproperty import infection_monkey.config from common.utils.exploit_enum import ExploitType +from datetime import datetime __author__ = 'itamar' @@ -20,11 +21,19 @@ class HostExploiter(object): def __init__(self, host): self._config = infection_monkey.config.WormConfiguration self._exploit_info = {'display_name': self._EXPLOITED_SERVICE, + 'started': '', + 'finished': '', 'vulnerable_urls': [], 'vulnerable_ports': []} self._exploit_attempts = [] self.host = host + def set_start_time(self): + self._exploit_info['started'] = datetime.now().isoformat() + + def set_finish_time(self): + self._exploit_info['finished'] = datetime.now().isoformat() + def is_os_supported(self): return self.host.os.get('type') in self._TARGET_OS_TYPE diff --git a/monkey/infection_monkey/exploit/mssqlexec.py b/monkey/infection_monkey/exploit/mssqlexec.py index 3d3f199f5..ff9cefa60 100644 --- a/monkey/infection_monkey/exploit/mssqlexec.py +++ b/monkey/infection_monkey/exploit/mssqlexec.py @@ -125,10 +125,12 @@ class MSSQLExploiter(HostExploiter): conn = pymssql.connect(host, user, password, port=port, login_timeout=self.LOGIN_TIMEOUT) LOG.info('Successfully connected to host: {0}, ' 'using user: {1}, password: {2}'.format(host, user, password)) + self.add_vuln_port(MSSQLExploiter.SQL_DEFAULT_TCP_PORT) self.report_login_attempt(True, user, password) cursor = conn.cursor() return cursor except pymssql.OperationalError: + self.report_login_attempt(False, user, password) # Combo didn't work, hopping to the next one pass diff --git a/monkey/infection_monkey/monkey.py b/monkey/infection_monkey/monkey.py index ff35be3d9..b152e58be 100644 --- a/monkey/infection_monkey/monkey.py +++ b/monkey/infection_monkey/monkey.py @@ -283,7 +283,9 @@ class InfectionMonkey(object): result = False try: + exploiter.set_start_time() result = exploiter.exploit_host() + exploiter.set_finish_time() if result: self.successfully_exploited(machine, exploiter) return True diff --git a/monkey/infection_monkey/post_breach/actions/add_user.py b/monkey/infection_monkey/post_breach/actions/add_user.py index 650f37b2f..ff7ae3a50 100644 --- a/monkey/infection_monkey/post_breach/actions/add_user.py +++ b/monkey/infection_monkey/post_breach/actions/add_user.py @@ -16,4 +16,6 @@ WINDOWS_COMMANDS = ['net', 'user', WormConfiguration.user_to_add, class BackdoorUser(PBA): def __init__(self): - super(BackdoorUser, self).__init__("Backdoor user", linux_cmd=LINUX_COMMANDS, windows_cmd=WINDOWS_COMMANDS) + super(BackdoorUser, self).__init__("Backdoor user", + linux_cmd=' '.join(LINUX_COMMANDS), + windows_cmd=WINDOWS_COMMANDS) diff --git a/monkey/monkey_island/cc/resources/telemetry.py b/monkey/monkey_island/cc/resources/telemetry.py index 04a6ddbd1..5d63a96ca 100644 --- a/monkey/monkey_island/cc/resources/telemetry.py +++ b/monkey/monkey_island/cc/resources/telemetry.py @@ -119,6 +119,8 @@ class Telemetry(flask_restful.Resource): def process_exploit_telemetry(telemetry_json): edge = Telemetry.get_edge_by_scan_or_exploit_telemetry(telemetry_json) Telemetry.encrypt_exploit_creds(telemetry_json) + telemetry_json['data']['info']['started'] = dateutil.parser.parse(telemetry_json['data']['info']['started']) + telemetry_json['data']['info']['finished'] = dateutil.parser.parse(telemetry_json['data']['info']['finished']) new_exploit = copy.deepcopy(telemetry_json['data']) diff --git a/monkey/monkey_island/cc/services/attack/attack_report.py b/monkey/monkey_island/cc/services/attack/attack_report.py index c70d3d56d..6801bcd64 100644 --- a/monkey/monkey_island/cc/services/attack/attack_report.py +++ b/monkey/monkey_island/cc/services/attack/attack_report.py @@ -1,5 +1,5 @@ import logging -from monkey_island.cc.services.attack.technique_reports import T1210, T1197 +from monkey_island.cc.services.attack.technique_reports import T1210, T1197, T1110 from monkey_island.cc.services.attack.attack_telem import AttackTelemService from monkey_island.cc.services.attack.attack_config import AttackConfig from monkey_island.cc.database import mongo @@ -10,7 +10,8 @@ __author__ = "VakarisZ" LOG = logging.getLogger(__name__) TECHNIQUES = {'T1210': T1210.T1210, - 'T1197': T1197.T1197} + 'T1197': T1197.T1197, + 'T1110': T1110.T1110} REPORT_NAME = 'new_report' diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1110.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1110.py new file mode 100644 index 000000000..7fe5ac90f --- /dev/null +++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1110.py @@ -0,0 +1,93 @@ +from monkey_island.cc.database import mongo +from monkey_island.cc.services.attack.technique_reports import AttackTechnique +from common.utils.attack_utils import ScanStatus +from monkey_island.cc.encryptor import encryptor + +__author__ = "VakarisZ" + + +class T1110(AttackTechnique): + tech_id = "T1110" + unscanned_msg = "Monkey didn't try to brute force any services." + scanned_msg = "Monkey tried to brute force some services, but failed." + used_msg = "Monkey successfully used brute force in the network." + + # Gets data about brute force attempts + query = [{'$match': {'telem_type': 'exploit', + 'data.attempts': {'$not': {'$size': 0}}}}, + {'$project': {'_id': 0, + 'machine': '$data.machine', + 'info': '$data.info', + 'attempt_cnt': {'$size': '$data.attempts'}, + 'attempts': {'$filter': {'input': '$data.attempts', + 'as': 'attempt', + 'cond': {'$eq': ['$$attempt.result', True]}}}}}] + + @staticmethod + def get_report_data(): + attempts = list(mongo.db.telemetry.aggregate(T1110.query)) + succeeded = False + + for result in attempts: + result['successful_creds'] = [] + for attempt in result['attempts']: + succeeded = True + result['successful_creds'].append(T1110.parse_creds(attempt)) + + if succeeded: + data = T1110.get_message_and_status(T1110, ScanStatus.USED) + elif attempts: + data = T1110.get_message_and_status(T1110, ScanStatus.SCANNED) + else: + data = T1110.get_message_and_status(T1110, ScanStatus.UNSCANNED) + + # Remove data with no successful brute force attempts + attempts = [attempt for attempt in attempts if attempt['attempts']] + + data.update({'services': attempts, 'title': T1110.technique_title(T1110.tech_id)}) + return data + + @staticmethod + def parse_creds(attempt): + """ + Parses used credentials into a string + :param attempt: login attempt from database + :return: string with username and used password/hash + """ + username = attempt['user'] + creds = {'lm_hash': {'type': 'LM hash', 'output': T1110.censor_hash(attempt['lm_hash'])}, + 'ntlm_hash': {'type': 'NTLM hash', 'output': T1110.censor_hash(attempt['ntlm_hash'], 20)}, + 'ssh_key': {'type': 'SSH key', 'output': attempt['ssh_key']}, + 'password': {'type': 'Plaintext password', 'output': T1110.censor_password(attempt['password'])}} + for key, cred in creds.items(): + if attempt[key]: + return '%s ; %s : %s' % (username, + cred['type'], + cred['output']) + + @staticmethod + def censor_password(password, plain_chars=3, secret_chars=5): + """ + Decrypts and obfuscates password by changing characters to * + :param password: Password or string to obfuscate + :param plain_chars: How many plain-text characters should be kept at the start of the string + :param secret_chars: How many * symbols should be used to hide the remainder of the password + :return: Obfuscated string e.g. Pass**** + """ + if not password: + return "" + password = encryptor.dec(password) + return password[0:plain_chars] + '*' * secret_chars + + @staticmethod + def censor_hash(hash_, plain_chars=5): + """ + Decrypts and obfuscates hash by only showing a part of it + :param hash_: Hash to obfuscate + :param plain_chars: How many chars of hash should be shown + :return: Obfuscated string + """ + if not hash_: + return "" + hash_ = encryptor.dec(hash_) + return hash_[0: plain_chars] + ' ...' diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1210.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1210.py index 9d5ff4cfd..b6335422f 100644 --- a/monkey/monkey_island/cc/services/attack/technique_reports/T1210.py +++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1210.py @@ -4,13 +4,6 @@ from monkey_island.cc.database import mongo __author__ = "VakarisZ" -TECHNIQUE = "T1210" -MESSAGES = { - 'unscanned': "Monkey didn't scan any remote services. Maybe it didn't find any machines on the network?", - 'scanned': "Monkey scanned for remote services on the network, but couldn't exploit any of them.", - 'used': "Monkey scanned for remote services and exploited some on the network." -} - class T1210(AttackTechnique): @@ -21,7 +14,7 @@ class T1210(AttackTechnique): @staticmethod def get_report_data(): - data = {'title': T1210.technique_title(TECHNIQUE)} + data = {'title': T1210.technique_title(T1210.tech_id)} scanned_services = T1210.get_scanned_services() exploited_services = T1210.get_exploited_services() if exploited_services: diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py b/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py index 0346a1857..8d60e963f 100644 --- a/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py +++ b/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py @@ -60,6 +60,19 @@ class AttackTechnique(object): else: return ScanStatus.UNSCANNED + @staticmethod + def get_message_and_status(technique, status): + return {'message': technique.get_message_by_status(technique, status), 'status': status.name} + + @staticmethod + def get_message_by_status(technique, status): + if status == ScanStatus.UNSCANNED: + return technique.unscanned_msg + elif status == ScanStatus.SCANNED: + return technique.scanned_msg + else: + return technique.used_msg + @staticmethod def technique_title(technique): """ @@ -78,11 +91,7 @@ class AttackTechnique(object): data = {} status = AttackTechnique.technique_status(technique.tech_id) title = AttackTechnique.technique_title(technique.tech_id) - data.update({'status': status.name, 'title': title}) - if status == ScanStatus.UNSCANNED: - data.update({'message': technique.unscanned_msg}) - elif status == ScanStatus.SCANNED: - data.update({'message': technique.scanned_msg}) - else: - data.update({'message': technique.used_msg}) + data.update({'status': status.name, + 'title': title, + 'message': technique.get_message_by_status(technique, status)}) return data diff --git a/monkey/monkey_island/cc/services/report.py b/monkey/monkey_island/cc/services/report.py index 21dcea0bc..702a42cd1 100644 --- a/monkey/monkey_island/cc/services/report.py +++ b/monkey/monkey_island/cc/services/report.py @@ -57,8 +57,8 @@ class ReportService: STRUTS2 = 8 WEBLOGIC = 9 HADOOP = 10 - PTH_CRIT_SERVICES_ACCESS = 11, - MSSQL = 12, + PTH_CRIT_SERVICES_ACCESS = 11 + MSSQL = 12 VSFTPD = 13 class WARNINGS_DICT(Enum): @@ -296,7 +296,7 @@ class ReportService: def process_vsftpd_exploit(exploit): processed_exploit = ReportService.process_general_creds_exploit(exploit) processed_exploit['type'] = 'vsftp' - return processed_exploit + return processed_exploit @staticmethod def process_sambacry_exploit(exploit): diff --git a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1110.js b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1110.js new file mode 100644 index 000000000..64619ad55 --- /dev/null +++ b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1110.js @@ -0,0 +1,52 @@ +import React from 'react'; +import '../../../styles/Collapse.scss' +import ReactTable from "react-table"; + + +class T1110 extends React.Component { + + constructor(props) { + super(props); + } + + static getServiceColumns() { + return ([{ + columns: [ + {Header: 'Machine', id: 'machine', accessor: x => this.renderMachine(x.machine), + style: { 'whiteSpace': 'unset' }, width: 160}, + {Header: 'Service', id: 'service', accessor: x => x.info.display_name, style: { 'whiteSpace': 'unset' }, width: 100}, + {Header: 'Started', id: 'started', accessor: x => x.info.started, style: { 'whiteSpace': 'unset' }}, + {Header: 'Finished', id: 'finished', accessor: x => x.info.finished, style: { 'whiteSpace': 'unset' }}, + {Header: 'Attempts', id: 'attempts', accessor: x => x.attempt_cnt, style: { 'whiteSpace': 'unset' }, width: 160}, + {Header: 'Successful credentials', id: 'credentials', accessor: x => this.renderCreds(x.successful_creds), style: { 'whiteSpace': 'unset' }}, + ] + }])}; + + static renderCreds(creds) { + return <span>{creds.map(cred => <div>{cred}</div>)}</span> + }; + + static renderMachine(val){ + return ( + <span>{val.ip_addr} {(val.domain_name ? " (".concat(val.domain_name, ")") : "")}</span> + ) + }; + + render() { + return ( + <div> + <div>{this.props.data.message}</div> + <br/> + {(this.props.data.status === 'SCANNED' || this.props.data.status === 'USED') ? + <ReactTable + columns={T1110.getServiceColumns()} + data={this.props.data.services} + showPagination={false} + defaultPageSize={this.props.data.services.length} + /> : ""} + </div> + ); + } +} + +export default T1110; diff --git a/monkey/monkey_island/cc/ui/src/components/pages/ReportPage.js b/monkey/monkey_island/cc/ui/src/components/pages/ReportPage.js index adc0911d8..72aeca574 100644 --- a/monkey/monkey_island/cc/ui/src/components/pages/ReportPage.js +++ b/monkey/monkey_island/cc/ui/src/components/pages/ReportPage.js @@ -81,7 +81,7 @@ class ReportPageComponent extends AuthComponent { } return ( - <Col xs={12} lg={8}> + <Col xs={12} lg={10}> <h1 className="page-title no-print">4. Security Report</h1> <div style={{'fontSize': '1.2em'}}> {content} @@ -308,7 +308,7 @@ class ReportPageComponent extends AuthComponent { }).length} threats</span>: <ul> {this.state.report.overview.issues[this.Issue.STOLEN_SSH_KEYS] ? - <li>Stolen SSH keys are used to exploit other machines.</li> : null } + <li>Stolen SSH keys are used to exploit other machines.</li> : null } {this.state.report.overview.issues[this.Issue.STOLEN_CREDS] ? <li>Stolen credentials are used to exploit other machines.</li> : null} {this.state.report.overview.issues[this.Issue.ELASTIC] ? diff --git a/monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js b/monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js index 2cc582832..19a7bb7c6 100644 --- a/monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js +++ b/monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js @@ -6,11 +6,13 @@ import AuthComponent from '../AuthComponent'; import Collapse from '@kunukn/react-collapse'; import T1210 from '../attack/techniques/T1210'; import T1197 from '../attack/techniques/T1197'; +import T1110 from '../attack/techniques/T1110'; import '../../styles/Collapse.scss' const tech_components = { 'T1210': T1210, - 'T1197': T1197 + 'T1197': T1197, + 'T1110': T1110 }; const classNames = require('classnames');