forked from p15670423/monkey
Agent: Change the logic of depth to represent current depth
Based on the previous logic the depth parameter represented hops remaining, not current depth.
This commit is contained in:
parent
e8001d8cf7
commit
df77ca4f96
|
@ -60,7 +60,7 @@ class Configuration(object):
|
||||||
###########################
|
###########################
|
||||||
|
|
||||||
# depth of propagation
|
# depth of propagation
|
||||||
depth = 2
|
depth = 0
|
||||||
max_depth = None
|
max_depth = None
|
||||||
|
|
||||||
keep_tunnel_open_time = 30
|
keep_tunnel_open_time = 30
|
||||||
|
|
|
@ -104,7 +104,7 @@ class HadoopExploiter(WebRCE):
|
||||||
|
|
||||||
def _build_command(self, path, http_path):
|
def _build_command(self, path, http_path):
|
||||||
# Build command to execute
|
# Build command to execute
|
||||||
monkey_cmd = build_monkey_commandline(self.host, self.current_depth - 1)
|
monkey_cmd = build_monkey_commandline(self.host, self.current_depth + 1)
|
||||||
if "linux" in self.host.os["type"]:
|
if "linux" in self.host.os["type"]:
|
||||||
base_command = HADOOP_LINUX_COMMAND
|
base_command = HADOOP_LINUX_COMMAND
|
||||||
else:
|
else:
|
||||||
|
|
|
@ -114,7 +114,7 @@ class Log4ShellExploiter(WebRCE):
|
||||||
|
|
||||||
def _build_command(self, path: PurePath, http_path) -> str:
|
def _build_command(self, path: PurePath, http_path) -> str:
|
||||||
# Build command to execute
|
# Build command to execute
|
||||||
monkey_cmd = build_monkey_commandline(self.host, self.current_depth - 1, location=path)
|
monkey_cmd = build_monkey_commandline(self.host, self.current_depth + 1, location=path)
|
||||||
if "linux" in self.host.os["type"]:
|
if "linux" in self.host.os["type"]:
|
||||||
base_command = LOG4SHELL_LINUX_COMMAND
|
base_command = LOG4SHELL_LINUX_COMMAND
|
||||||
else:
|
else:
|
||||||
|
|
|
@ -178,7 +178,7 @@ class MSSQLExploiter(HostExploiter):
|
||||||
|
|
||||||
def _build_agent_launch_command(self, agent_path_on_victim: PureWindowsPath) -> str:
|
def _build_agent_launch_command(self, agent_path_on_victim: PureWindowsPath) -> str:
|
||||||
agent_args = build_monkey_commandline(
|
agent_args = build_monkey_commandline(
|
||||||
self.host, self.current_depth - 1, agent_path_on_victim
|
self.host, self.current_depth + 1, agent_path_on_victim
|
||||||
)
|
)
|
||||||
|
|
||||||
return f"{agent_path_on_victim} {DROPPER_ARG} {agent_args}"
|
return f"{agent_path_on_victim} {DROPPER_ARG} {agent_args}"
|
||||||
|
|
|
@ -168,7 +168,7 @@ class PowerShellExploiter(HostExploiter):
|
||||||
|
|
||||||
def _run_monkey_executable_on_victim(self, executable_path):
|
def _run_monkey_executable_on_victim(self, executable_path):
|
||||||
monkey_execution_command = build_monkey_execution_command(
|
monkey_execution_command = build_monkey_execution_command(
|
||||||
self.host, self.current_depth - 1, executable_path
|
self.host, self.current_depth + 1, executable_path
|
||||||
)
|
)
|
||||||
|
|
||||||
logger.info(
|
logger.info(
|
||||||
|
|
|
@ -91,13 +91,13 @@ class SMBExploiter(HostExploiter):
|
||||||
"dropper_path": remote_full_path
|
"dropper_path": remote_full_path
|
||||||
} + build_monkey_commandline(
|
} + build_monkey_commandline(
|
||||||
self.host,
|
self.host,
|
||||||
self.current_depth - 1,
|
self.current_depth + 1,
|
||||||
str(dest_path),
|
str(dest_path),
|
||||||
)
|
)
|
||||||
else:
|
else:
|
||||||
cmdline = MONKEY_CMDLINE_DETACHED_WINDOWS % {
|
cmdline = MONKEY_CMDLINE_DETACHED_WINDOWS % {
|
||||||
"monkey_path": remote_full_path
|
"monkey_path": remote_full_path
|
||||||
} + build_monkey_commandline(self.host, self.current_depth - 1)
|
} + build_monkey_commandline(self.host, self.current_depth + 1)
|
||||||
|
|
||||||
smb_conn = None
|
smb_conn = None
|
||||||
for str_bind_format, port in SMBExploiter.KNOWN_PROTOCOLS.values():
|
for str_bind_format, port in SMBExploiter.KNOWN_PROTOCOLS.values():
|
||||||
|
|
|
@ -242,7 +242,7 @@ class SSHExploiter(HostExploiter):
|
||||||
|
|
||||||
try:
|
try:
|
||||||
cmdline = f"{monkey_path_on_victim} {MONKEY_ARG}"
|
cmdline = f"{monkey_path_on_victim} {MONKEY_ARG}"
|
||||||
cmdline += build_monkey_commandline(self.host, self.current_depth - 1)
|
cmdline += build_monkey_commandline(self.host, self.current_depth + 1)
|
||||||
cmdline += " > /dev/null 2>&1 &"
|
cmdline += " > /dev/null 2>&1 &"
|
||||||
ssh.exec_command(cmdline, timeout=SSH_EXEC_TIMEOUT)
|
ssh.exec_command(cmdline, timeout=SSH_EXEC_TIMEOUT)
|
||||||
|
|
||||||
|
|
|
@ -369,14 +369,14 @@ class WebRCE(HostExploiter):
|
||||||
default_path = self.get_default_dropper_path()
|
default_path = self.get_default_dropper_path()
|
||||||
if default_path is False:
|
if default_path is False:
|
||||||
return False
|
return False
|
||||||
monkey_cmd = build_monkey_commandline(self.host, self.current_depth - 1, default_path)
|
monkey_cmd = build_monkey_commandline(self.host, self.current_depth + 1, default_path)
|
||||||
command = RUN_MONKEY % {
|
command = RUN_MONKEY % {
|
||||||
"monkey_path": path,
|
"monkey_path": path,
|
||||||
"monkey_type": DROPPER_ARG,
|
"monkey_type": DROPPER_ARG,
|
||||||
"parameters": monkey_cmd,
|
"parameters": monkey_cmd,
|
||||||
}
|
}
|
||||||
else:
|
else:
|
||||||
monkey_cmd = build_monkey_commandline(self.host, self.current_depth - 1)
|
monkey_cmd = build_monkey_commandline(self.host, self.current_depth + 1)
|
||||||
command = RUN_MONKEY % {
|
command = RUN_MONKEY % {
|
||||||
"monkey_path": path,
|
"monkey_path": path,
|
||||||
"monkey_type": MONKEY_ARG,
|
"monkey_type": MONKEY_ARG,
|
||||||
|
|
|
@ -96,13 +96,13 @@ class WmiExploiter(HostExploiter):
|
||||||
"dropper_path": remote_full_path
|
"dropper_path": remote_full_path
|
||||||
} + build_monkey_commandline(
|
} + build_monkey_commandline(
|
||||||
self.host,
|
self.host,
|
||||||
self.current_depth - 1,
|
self.current_depth + 1,
|
||||||
DROPPER_TARGET_PATH_WIN64,
|
DROPPER_TARGET_PATH_WIN64,
|
||||||
)
|
)
|
||||||
else:
|
else:
|
||||||
cmdline = MONKEY_CMDLINE_WINDOWS % {
|
cmdline = MONKEY_CMDLINE_WINDOWS % {
|
||||||
"monkey_path": remote_full_path
|
"monkey_path": remote_full_path
|
||||||
} + build_monkey_commandline(self.host, self.current_depth - 1)
|
} + build_monkey_commandline(self.host, self.current_depth + 1)
|
||||||
|
|
||||||
# execute the remote monkey
|
# execute the remote monkey
|
||||||
result = WmiTools.get_object(wmi_connection, "Win32_Process").Create(
|
result = WmiTools.get_object(wmi_connection, "Win32_Process").Create(
|
||||||
|
|
|
@ -169,10 +169,10 @@ class AutomatedMaster(IMaster):
|
||||||
# still running.
|
# still running.
|
||||||
credential_collector_thread.join()
|
credential_collector_thread.join()
|
||||||
|
|
||||||
current_depth = self._current_depth if self._current_depth is not None else config["depth"]
|
current_depth = self._current_depth if self._current_depth is not None else 0
|
||||||
logger.info(f"Current depth is {current_depth}")
|
logger.info(f"Current depth is {current_depth}")
|
||||||
|
|
||||||
if self._can_propagate() and current_depth > 0:
|
if self._can_propagate() and current_depth < config["depth"]:
|
||||||
self._propagator.propagate(config["propagation"], current_depth, self._stop)
|
self._propagator.propagate(config["propagation"], current_depth, self._stop)
|
||||||
|
|
||||||
payload_thread = create_daemon_thread(
|
payload_thread = create_daemon_thread(
|
||||||
|
|
|
@ -166,7 +166,7 @@ class InfectionMonkey:
|
||||||
firewall.add_firewall_rule()
|
firewall.add_firewall_rule()
|
||||||
|
|
||||||
self._monkey_inbound_tunnel = self._control_client.create_control_tunnel()
|
self._monkey_inbound_tunnel = self._control_client.create_control_tunnel()
|
||||||
if self._monkey_inbound_tunnel and self._propagation_enabled():
|
if self._monkey_inbound_tunnel:
|
||||||
self._monkey_inbound_tunnel.start()
|
self._monkey_inbound_tunnel.start()
|
||||||
|
|
||||||
StateTelem(is_done=False, version=get_version()).send()
|
StateTelem(is_done=False, version=get_version()).send()
|
||||||
|
@ -353,7 +353,7 @@ class InfectionMonkey:
|
||||||
|
|
||||||
reset_signal_handlers()
|
reset_signal_handlers()
|
||||||
|
|
||||||
if self._monkey_inbound_tunnel and self._propagation_enabled():
|
if self._monkey_inbound_tunnel:
|
||||||
self._monkey_inbound_tunnel.stop()
|
self._monkey_inbound_tunnel.stop()
|
||||||
self._monkey_inbound_tunnel.join()
|
self._monkey_inbound_tunnel.join()
|
||||||
|
|
||||||
|
@ -378,12 +378,6 @@ class InfectionMonkey:
|
||||||
|
|
||||||
logger.info("Monkey is shutting down")
|
logger.info("Monkey is shutting down")
|
||||||
|
|
||||||
def _propagation_enabled(self) -> bool:
|
|
||||||
# If self._current_depth is None, assume that propagation is desired.
|
|
||||||
# The Master will ignore this value if it is None and pull the actual
|
|
||||||
# maximum depth from the server
|
|
||||||
return self._current_depth is None or self._current_depth > 0
|
|
||||||
|
|
||||||
def _close_tunnel(self):
|
def _close_tunnel(self):
|
||||||
tunnel_address = (
|
tunnel_address = (
|
||||||
self._control_client.proxies.get("https", "").replace("http://", "").split(":")[0]
|
self._control_client.proxies.get("https", "").replace("http://", "").split(":")[0]
|
||||||
|
|
|
@ -40,8 +40,6 @@ def build_monkey_commandline_explicitly(
|
||||||
cmdline.append("-s")
|
cmdline.append("-s")
|
||||||
cmdline.append(str(server))
|
cmdline.append(str(server))
|
||||||
if depth is not None:
|
if depth is not None:
|
||||||
if int(depth) < 0:
|
|
||||||
depth = 0
|
|
||||||
cmdline.append("-d")
|
cmdline.append("-d")
|
||||||
cmdline.append(str(depth))
|
cmdline.append(str(depth))
|
||||||
if location is not None:
|
if location is not None:
|
||||||
|
|
|
@ -28,16 +28,6 @@ def test_build_monkey_commandline_explicitly_arguments():
|
||||||
assert expected == actual
|
assert expected == actual
|
||||||
|
|
||||||
|
|
||||||
def test_build_monkey_commandline_explicitly_depth_condition_less():
|
|
||||||
expected = [
|
|
||||||
"-d",
|
|
||||||
"0",
|
|
||||||
]
|
|
||||||
actual = build_monkey_commandline_explicitly(depth=-50)
|
|
||||||
|
|
||||||
assert expected == actual
|
|
||||||
|
|
||||||
|
|
||||||
def test_build_monkey_commandline_explicitly_depth_condition_greater():
|
def test_build_monkey_commandline_explicitly_depth_condition_greater():
|
||||||
expected = [
|
expected = [
|
||||||
"-d",
|
"-d",
|
||||||
|
|
Loading…
Reference in New Issue