From c4d5aed01fb27ed668fc0aeb3610d93479d9328b Mon Sep 17 00:00:00 2001
From: VakarisZ <vakarisz@yahoo.com>
Date: Thu, 6 Jun 2019 18:04:29 +0300
Subject: [PATCH 1/5] PTH implementation finished, helper methods added

---
 .../cc/services/attack/attack_report.py       |  5 +-
 .../attack/technique_reports/T1075.py         | 43 +++++++++++++++++
 .../components/attack/techniques/Helpers.js   |  7 +++
 .../src/components/attack/techniques/T1075.js | 46 +++++++++++++++++++
 .../src/components/attack/techniques/T1110.js | 11 ++---
 .../src/components/attack/techniques/T1197.js |  9 +---
 .../src/components/attack/techniques/T1210.js | 11 ++---
 .../report-components/AttackReport.js         |  6 ++-
 8 files changed, 111 insertions(+), 27 deletions(-)
 create mode 100644 monkey/monkey_island/cc/services/attack/technique_reports/T1075.py
 create mode 100644 monkey/monkey_island/cc/ui/src/components/attack/techniques/Helpers.js
 create mode 100644 monkey/monkey_island/cc/ui/src/components/attack/techniques/T1075.js

diff --git a/monkey/monkey_island/cc/services/attack/attack_report.py b/monkey/monkey_island/cc/services/attack/attack_report.py
index 6801bcd64..49d51ffe5 100644
--- a/monkey/monkey_island/cc/services/attack/attack_report.py
+++ b/monkey/monkey_island/cc/services/attack/attack_report.py
@@ -1,5 +1,5 @@
 import logging
-from monkey_island.cc.services.attack.technique_reports import T1210, T1197, T1110
+from monkey_island.cc.services.attack.technique_reports import T1210, T1197, T1110, T1075
 from monkey_island.cc.services.attack.attack_telem import AttackTelemService
 from monkey_island.cc.services.attack.attack_config import AttackConfig
 from monkey_island.cc.database import mongo
@@ -11,7 +11,8 @@ LOG = logging.getLogger(__name__)
 
 TECHNIQUES = {'T1210': T1210.T1210,
               'T1197': T1197.T1197,
-              'T1110': T1110.T1110}
+              'T1110': T1110.T1110,
+              'T1075': T1075.T1075}
 
 REPORT_NAME = 'new_report'
 
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1075.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1075.py
new file mode 100644
index 000000000..2ac3d5420
--- /dev/null
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1075.py
@@ -0,0 +1,43 @@
+from monkey_island.cc.services.attack.technique_reports import AttackTechnique
+from common.utils.attack_utils import ScanStatus
+from monkey_island.cc.database import mongo
+
+__author__ = "VakarisZ"
+
+
+class T1075(AttackTechnique):
+
+    tech_id = "T1075"
+    unscanned_msg = "Monkey didn't try to use pass the hash attack."
+    scanned_msg = "Monkey tried to use hashes while logging in but didn't succeed."
+    used_msg = "Monkey successfully used hashed credentials."
+
+    login_attempt_query = {'data.attempts': {'$elemMatch': {'$or': [{'ntlm_hash': {'$ne': ''}},
+                                                                    {'lm_hash': {'$ne': ''}}]}}}
+
+    # Gets data about successful PTH logins
+    query = [{'$match': {'telem_type': 'exploit',
+                         'data.attempts': {'$not': {'$size': 0},
+                                           '$elemMatch': {'$and': [{'$or': [{'ntlm_hash': {'$ne': ''}},
+                                                                            {'lm_hash': {'$ne': ''}}]},
+                                                                   {'result': True}]}}}},
+             {'$project': {'_id': 0,
+                           'machine': '$data.machine',
+                           'info': '$data.info',
+                           'attempt_cnt': {'$size': '$data.attempts'},
+                           'attempts': {'$filter': {'input': '$data.attempts',
+                                                    'as': 'attempt',
+                                                    'cond': {'$eq': ['$$attempt.result', True]}}}}}]
+
+    @staticmethod
+    def get_report_data():
+        data = {'title': T1075.technique_title(T1075.tech_id)}
+        successful_logins = list(mongo.db.telemetry.aggregate(T1075.query))
+        data.update({'successful_logins': successful_logins})
+        if successful_logins:
+            data.update({'message': T1075.used_msg, 'status': ScanStatus.USED.name})
+        elif mongo.db.telemetry.count_documents(T1075.login_attempt_query):
+            data.update({'message': T1075.scanned_msg, 'status': ScanStatus.SCANNED.name})
+        else:
+            data.update({'message': T1075.unscanned_msg, 'status': ScanStatus.UNSCANNED.name})
+        return data
diff --git a/monkey/monkey_island/cc/ui/src/components/attack/techniques/Helpers.js b/monkey/monkey_island/cc/ui/src/components/attack/techniques/Helpers.js
new file mode 100644
index 000000000..b15bba693
--- /dev/null
+++ b/monkey/monkey_island/cc/ui/src/components/attack/techniques/Helpers.js
@@ -0,0 +1,7 @@
+import React from "react";
+
+export function RenderMachine(val){
+    return (
+      <span>{val.ip_addr} {(val.domain_name ? " (".concat(val.domain_name, ")") : "")}</span>
+    )
+};
diff --git a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1075.js b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1075.js
new file mode 100644
index 000000000..f365e90f1
--- /dev/null
+++ b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1075.js
@@ -0,0 +1,46 @@
+import React from 'react';
+import '../../../styles/Collapse.scss'
+import ReactTable from "react-table";
+import { RenderMachine } from "./Helpers"
+
+
+class T1075 extends React.Component {
+
+  constructor(props) {
+    super(props);
+    this.props.data.successful_logins.forEach((login) => {
+      if(login.attempts[0].ntlm_hash !== ""){
+        login.attempts[0].hashType = 'NTLM';
+      } else if(login.attempts[0].lm_hash !== ""){
+        login.attempts[0].hashType = 'LM';
+      }
+    })
+  }
+
+  static getHashColumns() {
+    return ([{
+      columns: [
+        {Header: 'Machine', id: 'machine', accessor: x => RenderMachine(x.machine), style: { 'whiteSpace': 'unset' }},
+        {Header: 'Service', id: 'service', accessor: x => x.info.display_name, style: { 'whiteSpace': 'unset' }},
+        {Header: 'Username', id: 'attempts', accessor: x => x.attempts[0].user, style: { 'whiteSpace': 'unset' }},
+        {Header: 'Hash type', id: 'credentials', accessor: x => x.attempts[0].hashType, style: { 'whiteSpace': 'unset' }},
+        ]
+    }])};
+
+  render() {
+    return (
+      <div>
+        <div>{this.props.data.message}</div>
+        <br/>
+        <ReactTable
+            columns={T1075.getHashColumns()}
+            data={this.props.data.successful_logins}
+            showPagination={false}
+            defaultPageSize={this.props.data.successful_logins.length}
+        />
+      </div>
+    );
+  }
+}
+
+export default T1075;
diff --git a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1110.js b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1110.js
index 64619ad55..468a9e79a 100644
--- a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1110.js
+++ b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1110.js
@@ -1,6 +1,7 @@
 import React from 'react';
 import '../../../styles/Collapse.scss'
 import ReactTable from "react-table";
+import { RenderMachine } from "./Helpers"
 
 
 class T1110 extends React.Component {
@@ -12,7 +13,7 @@ class T1110 extends React.Component {
   static getServiceColumns() {
     return ([{
       columns: [
-        {Header: 'Machine', id: 'machine', accessor: x => this.renderMachine(x.machine),
+        {Header: 'Machine', id: 'machine', accessor: x => RenderMachine(x.machine),
           style: { 'whiteSpace': 'unset' }, width: 160},
         {Header: 'Service', id: 'service', accessor: x => x.info.display_name, style: { 'whiteSpace': 'unset' }, width: 100},
         {Header: 'Started', id: 'started', accessor: x => x.info.started, style: { 'whiteSpace': 'unset' }},
@@ -23,13 +24,7 @@ class T1110 extends React.Component {
     }])};
 
   static renderCreds(creds) {
-    return <span>{creds.map(cred => <div>{cred}</div>)}</span>
-  };
-
-  static renderMachine(val){
-    return (
-      <span>{val.ip_addr} {(val.domain_name ? " (".concat(val.domain_name, ")") : "")}</span>
-    )
+    return <span>{creds.map(cred => <div key={cred}>{cred}</div>)}</span>
   };
 
   render() {
diff --git a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1197.js b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1197.js
index cc963dde7..e4c7d841d 100644
--- a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1197.js
+++ b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1197.js
@@ -1,6 +1,7 @@
 import React from 'react';
 import '../../../styles/Collapse.scss'
 import ReactTable from "react-table";
+import { RenderMachine } from "./Helpers"
 
 
 class T1210 extends React.Component {
@@ -8,7 +9,7 @@ class T1210 extends React.Component {
   constructor(props) {
     super(props);
     this.columns = [ {Header: 'Machine',
-                      id: 'machine', accessor: x => T1210.renderMachine(x),
+                      id: 'machine', accessor: x => RenderMachine(x),
                       style: { 'whiteSpace': 'unset' },
                       width: 200},
                     {Header: 'Time',
@@ -21,12 +22,6 @@ class T1210 extends React.Component {
       ]
   }
 
-  static renderMachine(val){
-    return (
-      <span>{val.ip_addr} {(val.domain_name ? " (".concat(val.domain_name, ")") : "")}</span>
-    )
-  };
-
   renderExploitedMachines(){
     if (this.props.data.bits_jobs.length === 0){
       return (<div />)
diff --git a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1210.js b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1210.js
index 5820d25d0..76bc5d196 100644
--- a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1210.js
+++ b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1210.js
@@ -1,6 +1,7 @@
 import React from 'react';
 import '../../../styles/Collapse.scss'
 import ReactTable from "react-table";
+import { RenderMachine } from "./Helpers"
 
 
 class T1210 extends React.Component {
@@ -12,7 +13,7 @@ class T1210 extends React.Component {
   static getScanColumns() {
     return ([{
       columns: [
-        {Header: 'Machine', id: 'machine', accessor: x => this.renderMachine(x.machine),
+        {Header: 'Machine', id: 'machine', accessor: x => RenderMachine(x.machine),
           style: { 'whiteSpace': 'unset' }, width: 200},
         {Header: 'Time', id: 'time', accessor: x => x.time, style: { 'whiteSpace': 'unset' }, width: 170},
         {Header: 'Port', id: 'port', accessor: x =>x.service.port, style: { 'whiteSpace': 'unset' }},
@@ -23,7 +24,7 @@ class T1210 extends React.Component {
   static getExploitColumns() {
     return ([{
       columns: [
-        {Header: 'Machine', id: 'machine', accessor: x => this.renderMachine(x.machine),
+        {Header: 'Machine', id: 'machine', accessor: x => RenderMachine(x.machine),
           style: { 'whiteSpace': 'unset' }, width: 200},
         {Header: 'Time', id: 'time', accessor: x => x.time, style: { 'whiteSpace': 'unset' }, width: 170},
         {Header: 'Port/url', id: 'port', accessor: x =>this.renderEndpoint(x.service), style: { 'whiteSpace': 'unset' }},
@@ -31,12 +32,6 @@ class T1210 extends React.Component {
         ]
     }])};
 
-  static renderMachine(val){
-    return (
-      <span>{val.ip_addr} {(val.domain_name ? " (".concat(val.domain_name, ")") : "")}</span>
-    )
-  };
-
   static renderEndpoint(val){
     return (
       <span>{(val.vulnerable_urls.length !== 0 ? val.vulnerable_urls[0] : val.vulnerable_ports[0])}</span>
diff --git a/monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js b/monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js
index 19a7bb7c6..58f8ea4d7 100644
--- a/monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js
+++ b/monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js
@@ -2,17 +2,19 @@ import React from 'react';
 import {Col} from 'react-bootstrap';
 import {ReactiveGraph} from 'components/reactive-graph/ReactiveGraph';
 import {edgeGroupToColor, options} from 'components/map/MapOptions';
+import '../../styles/Collapse.scss'
 import AuthComponent from '../AuthComponent';
 import Collapse from '@kunukn/react-collapse';
 import T1210 from '../attack/techniques/T1210';
 import T1197 from '../attack/techniques/T1197';
 import T1110 from '../attack/techniques/T1110';
-import '../../styles/Collapse.scss'
+import T1075 from "../attack/techniques/T1075";
 
 const tech_components = {
   'T1210': T1210,
   'T1197': T1197,
-  'T1110': T1110
+  'T1110': T1110,
+  'T1075': T1075
 };
 
 const classNames = require('classnames');

From af63e93b139a948c0829e245142bb8c444f44e65 Mon Sep 17 00:00:00 2001
From: VakarisZ <vakarisz@yahoo.com>
Date: Fri, 7 Jun 2019 16:49:04 +0300
Subject: [PATCH 2/5] Table not shown if no hashes were used.

---
 .../cc/ui/src/components/attack/techniques/T1075.js | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1075.js b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1075.js
index f365e90f1..6e80c9196 100644
--- a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1075.js
+++ b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1075.js
@@ -32,12 +32,13 @@ class T1075 extends React.Component {
       <div>
         <div>{this.props.data.message}</div>
         <br/>
-        <ReactTable
-            columns={T1075.getHashColumns()}
-            data={this.props.data.successful_logins}
-            showPagination={false}
-            defaultPageSize={this.props.data.successful_logins.length}
-        />
+        {this.props.data.status === 'USED' ?
+          <ReactTable
+              columns={T1075.getHashColumns()}
+              data={this.props.data.successful_logins}
+              showPagination={false}
+              defaultPageSize={this.props.data.successful_logins.length}
+          /> : ""}
       </div>
     );
   }

From 8505ad0ca80d1a4a19a2350e1bd209d4b6be0542 Mon Sep 17 00:00:00 2001
From: VakarisZ <vakarisz@yahoo.com>
Date: Tue, 18 Jun 2019 16:36:37 +0300
Subject: [PATCH 3/5] Refactored AttackTechnique methods to use @classmethod
 and minor improvenets in UI

---
 .../attack/technique_reports/T1075.py         |  8 +--
 .../attack/technique_reports/T1110.py         |  6 +-
 .../attack/technique_reports/T1197.py         |  2 +-
 .../attack/technique_reports/__init__.py      | 63 +++++++++++--------
 .../components/attack/techniques/Helpers.js   |  2 +-
 .../src/components/attack/techniques/T1075.js | 20 +++---
 .../src/components/attack/techniques/T1110.js |  4 +-
 .../src/components/attack/techniques/T1197.js |  4 +-
 .../src/components/attack/techniques/T1210.js |  6 +-
 9 files changed, 63 insertions(+), 52 deletions(-)

diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1075.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1075.py
index 2ac3d5420..18082dfc1 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1075.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1075.py
@@ -16,7 +16,7 @@ class T1075(AttackTechnique):
                                                                     {'lm_hash': {'$ne': ''}}]}}}
 
     # Gets data about successful PTH logins
-    query = [{'$match': {'telem_type': 'exploit',
+    query = [{'$match': {'telem_category': 'exploit',
                          'data.attempts': {'$not': {'$size': 0},
                                            '$elemMatch': {'$and': [{'$or': [{'ntlm_hash': {'$ne': ''}},
                                                                             {'lm_hash': {'$ne': ''}}]},
@@ -35,9 +35,9 @@ class T1075(AttackTechnique):
         successful_logins = list(mongo.db.telemetry.aggregate(T1075.query))
         data.update({'successful_logins': successful_logins})
         if successful_logins:
-            data.update({'message': T1075.used_msg, 'status': ScanStatus.USED.name})
+            data.update(T1075.get_message_and_status(ScanStatus.USED))
         elif mongo.db.telemetry.count_documents(T1075.login_attempt_query):
-            data.update({'message': T1075.scanned_msg, 'status': ScanStatus.SCANNED.name})
+            data.update(T1075.get_message_and_status(ScanStatus.SCANNED))
         else:
-            data.update({'message': T1075.unscanned_msg, 'status': ScanStatus.UNSCANNED.name})
+            data.update(T1075.get_message_and_status(ScanStatus.UNSCANNED))
         return data
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1110.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1110.py
index 7fe5ac90f..e8e4a62c3 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1110.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1110.py
@@ -35,11 +35,11 @@ class T1110(AttackTechnique):
                 result['successful_creds'].append(T1110.parse_creds(attempt))
 
         if succeeded:
-            data = T1110.get_message_and_status(T1110, ScanStatus.USED)
+            data = T1110.get_message_and_status(ScanStatus.USED)
         elif attempts:
-            data = T1110.get_message_and_status(T1110, ScanStatus.SCANNED)
+            data = T1110.get_message_and_status(ScanStatus.SCANNED)
         else:
-            data = T1110.get_message_and_status(T1110, ScanStatus.UNSCANNED)
+            data = T1110.get_message_and_status(ScanStatus.UNSCANNED)
 
         # Remove data with no successful brute force attempts
         attempts = [attempt for attempt in attempts if attempt['attempts']]
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1197.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1197.py
index 0aaab082b..11e79877b 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1197.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1197.py
@@ -12,7 +12,7 @@ class T1197(AttackTechnique):
 
     @staticmethod
     def get_report_data():
-        data = T1197.get_tech_base_data(T1197)
+        data = T1197.get_tech_base_data()
         bits_results = mongo.db.attack_results.aggregate([{'$match': {'technique': T1197.tech_id}},
                                                           {'$group': {'_id': {'ip_addr': '$machine.ip_addr', 'usage': '$usage'},
                                                                       'ip_addr': {'$first': '$machine.ip_addr'},
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py b/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py
index 8d60e963f..f37f4e082 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py
@@ -47,51 +47,60 @@ class AttackTechnique(object):
         pass
 
     @staticmethod
-    def technique_status(technique):
+    def technique_status(tech_id):
         """
         Gets the status of a certain attack technique.
-        :param technique: technique's id.
+        :param tech_id: ID of attack technique, for e.g. T1110
         :return: ScanStatus Enum object
         """
-        if mongo.db.attack_results.find_one({'status': ScanStatus.USED.value, 'technique': technique}):
+        if mongo.db.attack_results.find_one({'status': ScanStatus.USED.value, 'technique': tech_id}):
             return ScanStatus.USED
-        elif mongo.db.attack_results.find_one({'status': ScanStatus.SCANNED.value, 'technique': technique}):
+        elif mongo.db.attack_results.find_one({'status': ScanStatus.SCANNED.value, 'technique': tech_id}):
             return ScanStatus.SCANNED
         else:
             return ScanStatus.UNSCANNED
 
-    @staticmethod
-    def get_message_and_status(technique, status):
-        return {'message': technique.get_message_by_status(technique, status), 'status': status.name}
-
-    @staticmethod
-    def get_message_by_status(technique, status):
-        if status == ScanStatus.UNSCANNED:
-            return technique.unscanned_msg
-        elif status == ScanStatus.SCANNED:
-            return technique.scanned_msg
-        else:
-            return technique.used_msg
-
-    @staticmethod
-    def technique_title(technique):
+    @classmethod
+    def get_message_and_status(cls, status):
         """
-        :param technique: Technique's id. E.g. T1110
+        Returns a dict with attack technique's message and status.
+        :param status: Enum type value from common/attack_utils.py
+        :return: Dict with message and status
+        """
+        return {'message': cls.get_message_by_status(status), 'status': status.name}
+
+    @classmethod
+    def get_message_by_status(cls, status):
+        """
+        Picks a message to return based on status.
+        :param status: Enum type value from common/attack_utils.py
+        :return: message string
+        """
+        if status == ScanStatus.UNSCANNED:
+            return cls.unscanned_msg
+        elif status == ScanStatus.SCANNED:
+            return cls.scanned_msg
+        else:
+            return cls.used_msg
+
+    @staticmethod
+    def technique_title(tech_id):
+        """
+        :param tech_id: Technique's id. E.g. T1110
         :return: techniques title. E.g. "T1110 Brute force"
         """
-        return AttackConfig.get_technique(technique)['title']
+        return AttackConfig.get_technique(tech_id)['title']
 
-    @staticmethod
-    def get_tech_base_data(technique):
+    @classmethod
+    def get_tech_base_data(cls):
         """
         Gathers basic attack technique data into a dict.
-        :param technique: Technique's id. E.g. T1110
         :return: dict E.g. {'message': 'Brute force used', 'status': 'Used', 'title': 'T1110 Brute force'}
         """
         data = {}
-        status = AttackTechnique.technique_status(technique.tech_id)
-        title = AttackTechnique.technique_title(technique.tech_id)
+        status = AttackTechnique.technique_status(cls.tech_id)
+        title = AttackTechnique.technique_title(cls.tech_id)
         data.update({'status': status.name,
                      'title': title,
-                     'message': technique.get_message_by_status(technique, status)})
+                     'message': cls.get_message_by_status(status)})
         return data
diff --git a/monkey/monkey_island/cc/ui/src/components/attack/techniques/Helpers.js b/monkey/monkey_island/cc/ui/src/components/attack/techniques/Helpers.js
index b15bba693..785e4a295 100644
--- a/monkey/monkey_island/cc/ui/src/components/attack/techniques/Helpers.js
+++ b/monkey/monkey_island/cc/ui/src/components/attack/techniques/Helpers.js
@@ -1,6 +1,6 @@
 import React from "react";
 
-export function RenderMachine(val){
+export function renderMachine(val){
     return (
       <span>{val.ip_addr} {(val.domain_name ? " (".concat(val.domain_name, ")") : "")}</span>
     )
diff --git a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1075.js b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1075.js
index 6e80c9196..35fd0cbaa 100644
--- a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1075.js
+++ b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1075.js
@@ -1,26 +1,28 @@
 import React from 'react';
 import '../../../styles/Collapse.scss'
 import ReactTable from "react-table";
-import { RenderMachine } from "./Helpers"
+import { renderMachine } from "./Helpers"
 
 
 class T1075 extends React.Component {
 
   constructor(props) {
     super(props);
-    this.props.data.successful_logins.forEach((login) => {
-      if(login.attempts[0].ntlm_hash !== ""){
-        login.attempts[0].hashType = 'NTLM';
-      } else if(login.attempts[0].lm_hash !== ""){
-        login.attempts[0].hashType = 'LM';
-      }
-    })
+    this.props.data.successful_logins.forEach((login) => this.setLoginHashType(login))
+  }
+
+  setLoginHashType(login){
+    if(login.attempts[0].ntlm_hash !== ""){
+      login.attempts[0].hashType = 'NTLM';
+    } else if(login.attempts[0].lm_hash !== ""){
+      login.attempts[0].hashType = 'LM';
+    }
   }
 
   static getHashColumns() {
     return ([{
       columns: [
-        {Header: 'Machine', id: 'machine', accessor: x => RenderMachine(x.machine), style: { 'whiteSpace': 'unset' }},
+        {Header: 'Machine', id: 'machine', accessor: x => renderMachine(x.machine), style: { 'whiteSpace': 'unset' }},
         {Header: 'Service', id: 'service', accessor: x => x.info.display_name, style: { 'whiteSpace': 'unset' }},
         {Header: 'Username', id: 'attempts', accessor: x => x.attempts[0].user, style: { 'whiteSpace': 'unset' }},
         {Header: 'Hash type', id: 'credentials', accessor: x => x.attempts[0].hashType, style: { 'whiteSpace': 'unset' }},
diff --git a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1110.js b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1110.js
index 468a9e79a..294606d25 100644
--- a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1110.js
+++ b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1110.js
@@ -1,7 +1,7 @@
 import React from 'react';
 import '../../../styles/Collapse.scss'
 import ReactTable from "react-table";
-import { RenderMachine } from "./Helpers"
+import { renderMachine } from "./Helpers"
 
 
 class T1110 extends React.Component {
@@ -13,7 +13,7 @@ class T1110 extends React.Component {
   static getServiceColumns() {
     return ([{
       columns: [
-        {Header: 'Machine', id: 'machine', accessor: x => RenderMachine(x.machine),
+        {Header: 'Machine', id: 'machine', accessor: x => renderMachine(x.machine),
           style: { 'whiteSpace': 'unset' }, width: 160},
         {Header: 'Service', id: 'service', accessor: x => x.info.display_name, style: { 'whiteSpace': 'unset' }, width: 100},
         {Header: 'Started', id: 'started', accessor: x => x.info.started, style: { 'whiteSpace': 'unset' }},
diff --git a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1197.js b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1197.js
index e4c7d841d..8dc655aee 100644
--- a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1197.js
+++ b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1197.js
@@ -1,7 +1,7 @@
 import React from 'react';
 import '../../../styles/Collapse.scss'
 import ReactTable from "react-table";
-import { RenderMachine } from "./Helpers"
+import { renderMachine } from "./Helpers"
 
 
 class T1210 extends React.Component {
@@ -9,7 +9,7 @@ class T1210 extends React.Component {
   constructor(props) {
     super(props);
     this.columns = [ {Header: 'Machine',
-                      id: 'machine', accessor: x => RenderMachine(x),
+                      id: 'machine', accessor: x => renderMachine(x),
                       style: { 'whiteSpace': 'unset' },
                       width: 200},
                     {Header: 'Time',
diff --git a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1210.js b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1210.js
index 76bc5d196..1b3daa86c 100644
--- a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1210.js
+++ b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1210.js
@@ -1,7 +1,7 @@
 import React from 'react';
 import '../../../styles/Collapse.scss'
 import ReactTable from "react-table";
-import { RenderMachine } from "./Helpers"
+import { renderMachine } from "./Helpers"
 
 
 class T1210 extends React.Component {
@@ -13,7 +13,7 @@ class T1210 extends React.Component {
   static getScanColumns() {
     return ([{
       columns: [
-        {Header: 'Machine', id: 'machine', accessor: x => RenderMachine(x.machine),
+        {Header: 'Machine', id: 'machine', accessor: x => renderMachine(x.machine),
           style: { 'whiteSpace': 'unset' }, width: 200},
         {Header: 'Time', id: 'time', accessor: x => x.time, style: { 'whiteSpace': 'unset' }, width: 170},
         {Header: 'Port', id: 'port', accessor: x =>x.service.port, style: { 'whiteSpace': 'unset' }},
@@ -24,7 +24,7 @@ class T1210 extends React.Component {
   static getExploitColumns() {
     return ([{
       columns: [
-        {Header: 'Machine', id: 'machine', accessor: x => RenderMachine(x.machine),
+        {Header: 'Machine', id: 'machine', accessor: x => renderMachine(x.machine),
           style: { 'whiteSpace': 'unset' }, width: 200},
         {Header: 'Time', id: 'time', accessor: x => x.time, style: { 'whiteSpace': 'unset' }, width: 170},
         {Header: 'Port/url', id: 'port', accessor: x =>this.renderEndpoint(x.service), style: { 'whiteSpace': 'unset' }},

From 8ec5a6ac4323b7f35ef98a6649e3d5de5da0713e Mon Sep 17 00:00:00 2001
From: VakarisZ <vakarisz@yahoo.com>
Date: Wed, 19 Jun 2019 11:54:58 +0300
Subject: [PATCH 4/5] Readability improvements

---
 .../attack/technique_reports/T1075.py         |  9 +++++----
 .../attack/technique_reports/T1110.py         | 10 +++++-----
 .../attack/technique_reports/T1210.py         |  9 +++++----
 .../attack/technique_reports/__init__.py      | 20 +++++++++----------
 4 files changed, 24 insertions(+), 24 deletions(-)

diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1075.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1075.py
index 18082dfc1..fa65a66c2 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1075.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1075.py
@@ -31,13 +31,14 @@ class T1075(AttackTechnique):
 
     @staticmethod
     def get_report_data():
-        data = {'title': T1075.technique_title(T1075.tech_id)}
+        data = {'title': T1075.technique_title()}
         successful_logins = list(mongo.db.telemetry.aggregate(T1075.query))
         data.update({'successful_logins': successful_logins})
         if successful_logins:
-            data.update(T1075.get_message_and_status(ScanStatus.USED))
+            status = ScanStatus.USED
         elif mongo.db.telemetry.count_documents(T1075.login_attempt_query):
-            data.update(T1075.get_message_and_status(ScanStatus.SCANNED))
+            status = ScanStatus.SCANNED
         else:
-            data.update(T1075.get_message_and_status(ScanStatus.UNSCANNED))
+            status = ScanStatus.UNSCANNED
+        data.update(T1075.get_message_and_status(status))
         return data
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1110.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1110.py
index e8e4a62c3..0f09fb0fe 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1110.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1110.py
@@ -35,16 +35,16 @@ class T1110(AttackTechnique):
                 result['successful_creds'].append(T1110.parse_creds(attempt))
 
         if succeeded:
-            data = T1110.get_message_and_status(ScanStatus.USED)
+            status = ScanStatus.USED
         elif attempts:
-            data = T1110.get_message_and_status(ScanStatus.SCANNED)
+            status = ScanStatus.SCANNED
         else:
-            data = T1110.get_message_and_status(ScanStatus.UNSCANNED)
-
+            status = ScanStatus.UNSCANNED
+        data = T1110.get_message_and_status(status)
         # Remove data with no successful brute force attempts
         attempts = [attempt for attempt in attempts if attempt['attempts']]
 
-        data.update({'services': attempts, 'title': T1110.technique_title(T1110.tech_id)})
+        data.update({'services': attempts, 'title': T1110.technique_title()})
         return data
 
     @staticmethod
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/T1210.py b/monkey/monkey_island/cc/services/attack/technique_reports/T1210.py
index 677495c10..ed4a9a787 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1210.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1210.py
@@ -14,15 +14,16 @@ class T1210(AttackTechnique):
 
     @staticmethod
     def get_report_data():
-        data = {'title': T1210.technique_title(T1210.tech_id)}
+        data = {'title': T1210.technique_title()}
         scanned_services = T1210.get_scanned_services()
         exploited_services = T1210.get_exploited_services()
         if exploited_services:
-            data.update({'status': ScanStatus.USED.name, 'message': T1210.used_msg})
+            status = ScanStatus.USED
         elif scanned_services:
-            data.update({'status': ScanStatus.SCANNED.name, 'message': T1210.scanned_msg})
+            status = ScanStatus.SCANNED
         else:
-            data.update({'status': ScanStatus.UNSCANNED.name, 'message': T1210.unscanned_msg})
+            status = ScanStatus.UNSCANNED
+        data.update(T1210.get_message_and_status(status))
         data.update({'scanned_services': scanned_services, 'exploited_services': exploited_services})
         return data
 
diff --git a/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py b/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py
index 7faaf5afd..fe2beb424 100644
--- a/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/__init__.py
@@ -46,20 +46,19 @@ class AttackTechnique(object):
         """
         pass
 
-    @staticmethod
-    def technique_status(tech_id):
+    @classmethod
+    def technique_status(cls):
         """
         Gets the status of a certain attack technique.
-        :param tech_id: ID of attack technique, for e.g. T1110
         :return: ScanStatus Enum object
         """
         if mongo.db.attack_results.find_one({'telem_catagory': 'attack',
                                              'status': ScanStatus.USED.value,
-                                             'technique': tech_id}):
+                                             'technique': cls.tech_id}):
             return ScanStatus.USED
         elif mongo.db.attack_results.find_one({'telem_catagory': 'attack',
                                                'status': ScanStatus.SCANNED.value,
-                                               'technique': tech_id}):
+                                               'technique': cls.tech_id}):
             return ScanStatus.SCANNED
         else:
             return ScanStatus.UNSCANNED
@@ -87,13 +86,12 @@ class AttackTechnique(object):
         else:
             return cls.used_msg
 
-    @staticmethod
-    def technique_title(tech_id):
+    @classmethod
+    def technique_title(cls):
         """
-        :param tech_id: Technique's id. E.g. T1110
         :return: techniques title. E.g. "T1110 Brute force"
         """
-        return AttackConfig.get_technique(tech_id)['title']
+        return AttackConfig.get_technique(cls.tech_id)['title']
 
     @classmethod
     def get_tech_base_data(cls):
@@ -102,8 +100,8 @@ class AttackTechnique(object):
         :return: dict E.g. {'message': 'Brute force used', 'status': 'Used', 'title': 'T1110 Brute force'}
         """
         data = {}
-        status = AttackTechnique.technique_status(cls.tech_id)
-        title = AttackTechnique.technique_title(cls.tech_id)
+        status = cls.technique_status()
+        title = cls.technique_title()
         data.update({'status': status.name,
                      'title': title,
                      'message': cls.get_message_by_status(status)})

From 737c735f8f4a5382c91495f4bb1a4f705560dd3c Mon Sep 17 00:00:00 2001
From: VakarisZ <vakarisz@yahoo.com>
Date: Wed, 26 Jun 2019 17:02:44 +0300
Subject: [PATCH 5/5] Updated attack report in pass the hash

---
 monkey/monkey_island/cc/services/attack/attack_report.py | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/monkey/monkey_island/cc/services/attack/attack_report.py b/monkey/monkey_island/cc/services/attack/attack_report.py
index 35dd87676..43bdeb411 100644
--- a/monkey/monkey_island/cc/services/attack/attack_report.py
+++ b/monkey/monkey_island/cc/services/attack/attack_report.py
@@ -1,6 +1,5 @@
 import logging
-from monkey_island.cc.services.attack.technique_reports import T1210, T1197, T1110
-from monkey_island.cc.services.attack.attack_telem import AttackTelemService
+from monkey_island.cc.services.attack.technique_reports import T1210, T1197, T1110, T1075
 from monkey_island.cc.services.attack.attack_config import AttackConfig
 from monkey_island.cc.database import mongo