From 4496b0efa410f7be5fc9166aa1b2ca78f4c601ed Mon Sep 17 00:00:00 2001 From: VakarisZ Date: Mon, 1 Apr 2019 19:16:14 +0300 Subject: [PATCH] Changed base class not to send redundant info about current machine --- .../transport/attack_telems/base_telem.py | 11 +++------ .../attack_telems/victim_host_telem.py | 3 ++- monkey/infection_monkey/utils.py | 24 ------------------- .../cc/resources/attack_telem.py | 2 +- .../{attack_results.py => attack_telem.py} | 3 +++ 5 files changed, 9 insertions(+), 34 deletions(-) rename monkey/monkey_island/cc/services/attack/{attack_results.py => attack_telem.py} (76%) diff --git a/monkey/infection_monkey/transport/attack_telems/base_telem.py b/monkey/infection_monkey/transport/attack_telems/base_telem.py index f90a53256..054927a0d 100644 --- a/monkey/infection_monkey/transport/attack_telems/base_telem.py +++ b/monkey/infection_monkey/transport/attack_telems/base_telem.py @@ -1,10 +1,9 @@ from enum import Enum -from infection_monkey.config import WormConfiguration +from infection_monkey.config import WormConfiguration, GUID import requests import json from infection_monkey.control import ControlClient import logging -from infection_monkey.utils import get_host_info __author__ = "VakarisZ" @@ -22,26 +21,22 @@ class ScanStatus(Enum): class AttackTelem(object): - def __init__(self, technique, status, data=None, machine=False): + def __init__(self, technique, status, data=None): """ Default ATT&CK telemetry constructor :param technique: Technique ID. E.g. T111 :param status: int from ScanStatus Enum :param data: Other data relevant to the attack technique - :param machine: Boolean. Should we pass current machine's info or not """ self.technique = technique self.result = status - self.data = {'status': status} + self.data = {'status': status, 'id': GUID} if data: self.data.update(data) - if machine: - self.data.update({'machine': get_host_info()}) def send(self): """ Sends telemetry to island - :return: """ if not WormConfiguration.current_server: return diff --git a/monkey/infection_monkey/transport/attack_telems/victim_host_telem.py b/monkey/infection_monkey/transport/attack_telems/victim_host_telem.py index c549bde1e..4ed88ef95 100644 --- a/monkey/infection_monkey/transport/attack_telems/victim_host_telem.py +++ b/monkey/infection_monkey/transport/attack_telems/victim_host_telem.py @@ -1,4 +1,5 @@ from infection_monkey.transport.attack_telems.base_telem import AttackTelem +from infection_monkey.config import GUID __author__ = "VakarisZ" @@ -13,7 +14,7 @@ class VictimHostTelem(AttackTelem): :param machine: VictimHost obj from model/host.py :param data: Other data relevant to the attack technique """ - super(VictimHostTelem, self).__init__(technique, status, data, machine=False) + super(VictimHostTelem, self).__init__(technique, status, data) victim_host = {'hostname': machine.domain_name, 'ip': machine.ip_addr} if data: self.data.update(data) diff --git a/monkey/infection_monkey/utils.py b/monkey/infection_monkey/utils.py index 05d0cf807..741d7c950 100644 --- a/monkey/infection_monkey/utils.py +++ b/monkey/infection_monkey/utils.py @@ -2,13 +2,9 @@ import os import sys import shutil import struct -import socket from infection_monkey.config import WormConfiguration -LOCAL_IP = '127.0.0.1' -MOCK_IP = '10.255.255.255' - def get_monkey_log_path(): return os.path.expandvars(WormConfiguration.monkey_log_path_windows) if sys.platform == "win32" \ @@ -36,26 +32,6 @@ def is_windows_os(): return sys.platform.startswith("win") -def get_host_info(): - return {'hostname': socket.gethostname(), 'ip': get_primary_ip()} - - -def get_primary_ip(): - """ - :return: Primary (default route) IP address - """ - s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) - try: - # doesn't even have to be reachable - s.connect((MOCK_IP, 1)) - ip = s.getsockname()[0] - except: - ip = LOCAL_IP - finally: - s.close() - return ip - - def utf_to_ascii(string): # Converts utf string to ascii. Safe to use even if string is already ascii. udata = string.decode("utf-8") diff --git a/monkey/monkey_island/cc/resources/attack_telem.py b/monkey/monkey_island/cc/resources/attack_telem.py index a206d21d0..0dfa013e8 100644 --- a/monkey/monkey_island/cc/resources/attack_telem.py +++ b/monkey/monkey_island/cc/resources/attack_telem.py @@ -1,7 +1,7 @@ import flask_restful from flask import request import json -from cc.services.attack.attack_results import set_results +from cc.services.attack.attack_telem import set_results import logging __author__ = 'VakarisZ' diff --git a/monkey/monkey_island/cc/services/attack/attack_results.py b/monkey/monkey_island/cc/services/attack/attack_telem.py similarity index 76% rename from monkey/monkey_island/cc/services/attack/attack_results.py rename to monkey/monkey_island/cc/services/attack/attack_telem.py index fb8b1cd82..a55ab2f99 100644 --- a/monkey/monkey_island/cc/services/attack/attack_results.py +++ b/monkey/monkey_island/cc/services/attack/attack_telem.py @@ -1,3 +1,6 @@ +""" +File that contains ATT&CK telemetry storing/retrieving logic +""" import logging from cc.database import mongo