monkey/monkey/infection_monkey
Shay Nehmad 812e844f74
Merge pull request #396 from guardicore/improvment/395-log-hashes-not-creds
Filtering sensitive info when logging running config
2019-08-01 11:57:36 +03:00
..
exploit Hashing all places in the log that log passwords 2019-07-29 17:11:01 +03:00
model Mssql exploiter finished. 2019-05-16 10:10:26 +03:00
monkey_utils/sambacry_monkey_runner newline at end of file 2018-12-01 21:32:53 +02:00
network Fixed tunneling bug where local machine gets set as island. 2019-07-03 14:11:15 +03:00
post_breach PBA handles hostname lookup failure 2019-06-25 09:10:21 +03:00
pyinstaller_hooks Minor readability changes in config service 2019-05-22 17:09:09 +03:00
system_info Merge remote-tracking branch 'origin/develop' into feature/run-aws-monkey 2019-02-03 14:18:27 +02:00
telemetry Merge remote-tracking branch 'upstream/develop' into attack_file_deletion 2019-07-08 14:24:17 +03:00
transport HTTP servers bugfix 2019-06-19 09:22:29 +03:00
__init__.py Move everything under monkey 2018-05-23 16:05:41 +03:00
build_linux.sh merge spec files 2018-12-16 13:38:44 +02:00
build_windows.bat Move everything under monkey 2018-05-23 16:05:41 +03:00
config.py Hashing all places in the log that log passwords 2019-07-29 17:11:01 +03:00
control.py Fixed CR Comment - exported sensitive fields 2019-07-29 10:15:27 +03:00
dropper.py Added a decorator in which the "timer start" for the timeout can be implemented 2019-04-25 14:45:37 +03:00
example.conf Now using tempfile to create monkey directory 2019-06-12 17:08:33 +03:00
main.py Fixed CR Comment - exported sensitive fields 2019-07-29 10:15:27 +03:00
monkey.ico Move everything under monkey 2018-05-23 16:05:41 +03:00
monkey.py Merge pull request #366 from VakarisZ/attack_file_deletion 2019-07-31 11:43:07 +03:00
monkey.spec Minor readability changes in config service 2019-05-22 17:09:09 +03:00
monkeyfs.py Move everything under monkey 2018-05-23 16:05:41 +03:00
pyinstaller_utils.py Merge remote-tracking branch 'origin/develop' into feature/support-common-folder 2018-09-09 14:43:03 +03:00
readme.txt Fixed typo's in monkey's readme.txt 2019-04-09 10:47:48 +03:00
requirements_linux.txt Added enum34 to requirements 2019-02-26 19:55:47 +02:00
requirements_windows.txt Added enum34 to requirements 2019-02-26 19:55:47 +02:00
system_singleton.py infection monkey works via infection_monkey.py or monkey.exe 2018-06-13 14:38:58 +03:00
tunnel.py Mssql almost done, improved networking. 2019-05-14 17:24:24 +03:00
utils.py Implemented file deletion attack technique 2019-06-28 12:25:33 +03:00
windows_upgrader.py Mssql exploiter finished. 2019-05-16 10:10:26 +03:00

readme.txt

To get development versions of Monkey Island and Monkey look into deployment scripts folder.
If you only want to build monkey from scratch you may reference instructions below.

The monkey is composed of three separate parts.
* The Infection Monkey itself - PyInstaller compressed python archives
* Sambacry binaries - Two linux binaries, 32/64 bit.
* Mimikatz binaries - Two windows binaries, 32/64 bit.
* Traceroute binaries - Two linux binaries, 32/64bit.

--- Windows ---

1. Install python 2.7.15
    Download and install from: https://www.python.org/downloads/release/python-2715/
2.	Add python directories to PATH environment variable (if you didn't install ActiveState Python)
	a. Run the following command on a cmd console (Replace C:\Python27 with your python directory if it's different)
		setx /M PATH "%PATH%;C:\Python27;C:\Python27\Scripts
	b. Close the console, make sure you execute all commands in a new cmd console from now on.
3.	Install further dependencies
	a. install VCForPython27.msi
		https://aka.ms/vcpython27
	b. if not installed, install Microsoft Visual C++ 2010 SP1 Redistributable Package
		32bit: http://www.microsoft.com/en-us/download/details.aspx?id=8328
		64bit: http://www.microsoft.com/en-us/download/details.aspx?id=13523
4.	Download the dependent python packages using 
		pip install -r requirements_windows.txt
5.	Download and extract UPX binary to [source-path]\monkey\infection_monkey\bin\upx.exe:
		https://github.com/upx/upx/releases/download/v3.94/upx394w.zip
6.	Build/Download Sambacry and Mimikatz binaries
	a. Build/Download according to sections at the end of this readme.
	b. Place the binaries under [code location]\infection_monkey\bin
7.	To build the final exe:
		cd [code location]/infection_monkey
		build_windows.bat 
		output is placed under dist\monkey.exe

--- Linux ---

Tested on Ubuntu 16.04 and 17.04.

1.	Install dependencies by running:
		sudo apt-get update
		sudo apt-get install python-pip python-dev libffi-dev upx libssl-dev libc++1
    Install the python packages listed in requirements.txt using pip
        cd [code location]/infection_monkey
		pip install -r requirements_linux.txt
2.	Build Sambacry binaries
	a. Build/Download according to sections at the end of this readme.
	b. Place the binaries under [code location]\infection_monkey\bin, under the names 'sc_monkey_runner32.so', 'sc_monkey_runner64.so'
3.	Build Traceroute binaries
	a. Build/Download according to sections at the end of this readme.
	b. Place the binaries under [code location]\infection_monkey\bin, under the names 'traceroute32', 'traceroute64'
4.	To build, run in terminal:
		cd [code location]/infection_monkey
		chmod +x build_linux.sh
		./build_linux.sh
	output is placed under dist/monkey

-- Sambacry --

Sambacry requires two standalone binaries to execute remotely.
a. Build sambacry binaries yourself
	a.1. Install gcc-multilib if it's not installed
		 sudo apt-get install gcc-multilib
	a.2. Build the binaries
		 cd [code location]/infection_monkey/monkey_utils/sambacry_monkey_runner
		 ./build.sh

b. Download our pre-built sambacry binaries
	b.1. Available here: 
		32bit: https://github.com/guardicore/monkey/releases/download/1.6/sc_monkey_runner32.so
		64bit: https://github.com/guardicore/monkey/releases/download/1.6/sc_monkey_runner64.so

-- Mimikatz --

Mimikatz is required for the Monkey to be able to steal credentials on Windows. It's possible to either compile binaries from source (requires Visual Studio 2013 and up) or download them from our repository.
a. Build Mimikatz yourself
	a.0. Building mimikatz requires Visual Studio 2013 and up
	a.1. Clone our version of mimikatz from https://github.com/guardicore/mimikatz/tree/1.1.0
	a.2. Build using Visual Studio.
	a.3. Put each version in a zip file
		a.3.1. The zip should contain only the Mimikatz DLL named tmpzipfile123456.dll
		a.3.2. It should be protected using the password 'VTQpsJPXgZuXhX6x3V84G'.
		a.3.3. The zip file should be named mk32.zip/mk64.zip accordingly.
		a.3.4. Zipping with 7zip has been tested. Other zipping software may not work.
		
b. Download our pre-built mimikatz binaries
	b.1. Download both 32 and 64 bit zipped DLLs from https://github.com/guardicore/mimikatz/releases/tag/1.1.0
	b.2. Place them under [code location]\infection_monkey\bin

-- Traceroute --

Traceroute requires two standalone binaries to execute remotely.
The monkey carries the standalone binaries since traceroute isn't built in all Linux distributions.
You can either build them yourself or download pre-built binaries.

a. Build traceroute yourself
	a.1. The sources of traceroute are available here with building instructions: http://traceroute.sourceforge.net
b. Download our pre-built traceroute binaries
	b.1. Available here: 
		32bit: https://github.com/guardicore/monkey/releases/download/1.6/traceroute32
		64bit: https://github.com/guardicore/monkey/releases/download/1.6/traceroute64