p17860254
/
monkey
forked from p15670423/monkey
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Agent: Add display_name to PostBreachData

This commit is contained in:
Shreya Malviya 2022-03-25 13:09:10 +05:30
parent 196f814860
commit dda922d06f
4 changed files with 9 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
monkey/infection_monkey/i_puppet/i_puppet.py
View File

@ -34,7 +34,7 @@ class ExploiterResultData:
PingScanData = namedtuple("PingScanData", ["response_received", "os"])
PortScanData = namedtuple("PortScanData", ["port", "status", "banner", "service"])
FingerprintData = namedtuple("FingerprintData", ["os_type", "os_version", "services"])
PostBreachData = namedtuple("PostBreachData", ["command", "result"])
PostBreachData = namedtuple("PostBreachData", ["display_name", "command", "result"])
class IPuppet(metaclass=abc.ABCMeta):

7
monkey/infection_monkey/master/automated_master.py
View File

@ -195,14 +195,11 @@ class AutomatedMaster(IMaster):
logger.debug(f"No credentials were collected by {collector}")
def _run_pba(self, pba: Tuple[str, Dict]):
# TODO: This is the class's name right now. We need `display_name` (see the
# ProcessListCollection PBA). This is shown in the Security report as the PBA
# name and is checked against in the T1082's mongo query in the ATT&CK report.
name = pba[0]
options = pba[1]
command, result = self._puppet.run_pba(name, options)
self._telemetry_messenger.send_telemetry(PostBreachTelem(name, command, result))
display_name, command, result = self._puppet.run_pba(name, options)
self._telemetry_messenger.send_telemetry(PostBreachTelem(display_name, command, result))
def _can_propagate(self) -> bool:
return True

8
monkey/infection_monkey/master/mock_master.py
View File

@ -50,12 +50,12 @@ class MockMaster(IMaster):
logger.info("Running post breach actions")
name = "AccountDiscovery"
command, result = self._puppet.run_pba(name, {})
self._telemetry_messenger.send_telemetry(PostBreachTelem(name, command, result))
display_name, command, result = self._puppet.run_pba(name, {})
self._telemetry_messenger.send_telemetry(PostBreachTelem(display_name, command, result))
name = "CommunicateAsBackdoorUser"
command, result = self._puppet.run_pba(name, {})
self._telemetry_messenger.send_telemetry(PostBreachTelem(name, command, result))
display_name, command, result = self._puppet.run_pba(name, {})
self._telemetry_messenger.send_telemetry(PostBreachTelem(display_name, command, result))
logger.info("Finished running post breach actions")
def _scan_victims(self):

4
monkey/infection_monkey/puppet/mock_puppet.py
View File

@ -53,9 +53,9 @@ class MockPuppet(IPuppet):
logger.debug(f"run_pba({name}, {options})")
if name == "AccountDiscovery":
return PostBreachData("pba command 1", ["pba result 1", True])
return PostBreachData(name, "pba command 1", ["pba result 1", True])
else:
return PostBreachData("pba command 2", ["pba result 2", False])
return PostBreachData(name, "pba command 2", ["pba result 2", False])
def ping(self, host: str, timeout: float = 1) -> PingScanData:
logger.debug(f"run_ping({host}, {timeout})")