monkey/monkey_island/cc/services/report.py

import ipaddress

from cc.database import mongo
from cc.services.config import ConfigService
from cc.services.edge import EdgeService
from cc.services.node import NodeService
from cc.utils import local_ip_addresses, get_subnets

__author__ = "itay.mizeretz"


class ReportService:
    def __init__(self):
        pass

    EXPLOIT_DISPLAY_DICT = \
        {
            'SmbExploiter': 'SMB Exploiter',
            'WmiExploiter': 'WMI Exploiter',
            'SSHExploiter': 'SSH Exploiter',
            'RdpExploiter': 'RDP Exploiter',
            'SambaCryExploiter': 'SambaCry Exploiter',
            'ElasticGroovyExploiter': 'Elastic Groovy Exploiter',
            'Ms08_067_Exploiter': 'Conficker Exploiter',
            'ShellShockExploiter': 'ShellShock Exploiter',
        }

    class ISSUES_DICT:
        WEAK_PASSWORD = 0
        STOLEN_CREDS = 1
        ELASTIC = 2
        SAMBACRY = 3
        SHELLSHOCK = 4
        CONFICKER = 5

    class WARNINGS_DICT:
        CROSS_SEGMENT = 0
        TUNNEL = 1

    @staticmethod
    def get_first_monkey_time():
        return mongo.db.telemetry.find({}, {'timestamp': 1}).sort([('$natural', 1)]).limit(1)[0]['timestamp']

    @staticmethod
    def get_last_monkey_dead_time():
        return mongo.db.telemetry.find({}, {'timestamp': 1}).sort([('$natural', -1)]).limit(1)[0]['timestamp']

    @staticmethod
    def get_monkey_duration():
        delta = ReportService.get_last_monkey_dead_time() - ReportService.get_first_monkey_time()
        st = ""
        if delta.days > 0:
            st += "%d days, " % delta.days
        total = delta.seconds
        seconds = total % 60
        total = (total - seconds) / 60
        minutes = total % 60
        total = (total - minutes) / 60
        hours = total
        if hours > 0:
            st += "%d hours, " % hours

        st += "%d minutes and %d seconds" % (minutes, seconds)
        return st

    @staticmethod
    def get_tunnels():
        return [
            {
                'type': 'tunnel',
                'machine': NodeService.get_node_hostname(NodeService.get_node_or_monkey_by_id(tunnel['_id'])),
                'dest': NodeService.get_node_hostname(NodeService.get_node_or_monkey_by_id(tunnel['tunnel']))
            }
            for tunnel in mongo.db.monkey.find({'tunnel': {'$exists': True}}, {'tunnel': 1})]

    @staticmethod
    def get_scanned():
        nodes = \
            [NodeService.get_displayed_node_by_id(node['_id'], True) for node in mongo.db.node.find({}, {'_id': 1})] \
            + [NodeService.get_displayed_node_by_id(monkey['_id'], True) for monkey in mongo.db.monkey.find({}, {'_id': 1})]
        nodes = [
            {
                'label': node['label'],
                'ip_addresses': node['ip_addresses'],
                'accessible_from_nodes':
                    (x['hostname'] for x in
                     (NodeService.get_displayed_node_by_id(edge['from'], True)
                      for edge in EdgeService.get_displayed_edges_by_to(node['id'], True))),
                'services': node['services']
            }
            for node in nodes]

        return nodes

    @staticmethod
    def get_exploited():
        exploited = \
            [NodeService.get_displayed_node_by_id(monkey['_id'], True) for monkey in mongo.db.monkey.find({}, {'_id': 1})
             if not NodeService.get_monkey_manual_run(NodeService.get_monkey_by_id(monkey['_id']))] \
            + [NodeService.get_displayed_node_by_id(node['_id'], True)
               for node in mongo.db.node.find({'exploited': True}, {'_id': 1})]

        exploited = [
            {
                'label': monkey['label'],
                'ip_addresses': monkey['ip_addresses'],
                'exploits': list(set(
                    [ReportService.EXPLOIT_DISPLAY_DICT[exploit['exploiter']] for exploit in monkey['exploits'] if
                     exploit['result']]))
            }
            for monkey in exploited]

        return exploited

    @staticmethod
    def get_stolen_creds():
        PASS_TYPE_DICT = {'password': 'Clear Password', 'lm_hash': 'LM hash', 'ntlm_hash': 'NTLM hash'}
        creds = []
        for telem in mongo.db.telemetry.find(
                {'telem_type': 'system_info_collection', 'data.credentials': {'$exists': True}},
                {'data.credentials': 1, 'monkey_guid': 1}
        ):
            monkey_creds = telem['data']['credentials']
            if len(monkey_creds) == 0:
                continue
            origin = NodeService.get_monkey_by_guid(telem['monkey_guid'])['hostname']
            for user in monkey_creds:
                for pass_type in monkey_creds[user]:
                    creds.append(
                        {
                            'username': user.replace(',', '.'),
                            'type': PASS_TYPE_DICT[pass_type],
                            'origin': origin
                        }
                    )
        return creds

    @staticmethod
    def process_general_exploit(exploit):
        ip_addr = exploit['data']['machine']['ip_addr']
        return {'machine': NodeService.get_node_hostname(NodeService.get_node_or_monkey_by_ip(ip_addr)),
                'ip_address': ip_addr}

    @staticmethod
    def process_general_creds_exploit(exploit):
        processed_exploit = ReportService.process_general_exploit(exploit)

        for attempt in exploit['data']['attempts']:
            if attempt['result']:
                processed_exploit['username'] = attempt['user']
                if len(attempt['password']) > 0:
                    processed_exploit['type'] = 'password'
                    processed_exploit['password'] = attempt['password']
                else:
                    processed_exploit['type'] = 'hash'
                return processed_exploit

    @staticmethod
    def process_smb_exploit(exploit):
        processed_exploit = ReportService.process_general_creds_exploit(exploit)
        if processed_exploit['type'] == 'password':
            processed_exploit['type'] = 'smb_password'
        else:
            processed_exploit['type'] = 'smb_pth'
        return processed_exploit

    @staticmethod
    def process_wmi_exploit(exploit):
        processed_exploit = ReportService.process_general_creds_exploit(exploit)
        if processed_exploit['type'] == 'password':
            processed_exploit['type'] = 'wmi_password'
        else:
            processed_exploit['type'] = 'wmi_pth'
        return processed_exploit

    @staticmethod
    def process_ssh_exploit(exploit):
        processed_exploit = ReportService.process_general_creds_exploit(exploit)
        processed_exploit['type'] = 'ssh'
        return processed_exploit

    @staticmethod
    def process_rdp_exploit(exploit):
        processed_exploit = ReportService.process_general_creds_exploit(exploit)
        processed_exploit['type'] = 'rdp'
        return processed_exploit

    @staticmethod
    def process_sambacry_exploit(exploit):
        processed_exploit = ReportService.process_general_creds_exploit(exploit)
        processed_exploit['type'] = 'sambacry'
        return processed_exploit

    @staticmethod
    def process_elastic_exploit(exploit):
        processed_exploit = ReportService.process_general_exploit(exploit)
        processed_exploit['type'] = 'elastic'
        return processed_exploit

    @staticmethod
    def process_conficker_exploit(exploit):
        processed_exploit = ReportService.process_general_exploit(exploit)
        processed_exploit['type'] = 'conficker'
        return processed_exploit

    @staticmethod
    def process_shellshock_exploit(exploit):
        processed_exploit = ReportService.process_general_exploit(exploit)
        processed_exploit['type'] = 'shellshock'
        urls = exploit['data']['info']['vulnerable_urls']
        processed_exploit['port'] = urls[0].split(':')[2].split('/')[0]
        processed_exploit['paths'] = ['/' + url.split(':')[2].split('/')[1] for url in urls]
        return processed_exploit

    @staticmethod
    def process_exploit(exploit):
        exploiter_type = exploit['data']['exploiter']
        if exploiter_type == 'SmbExploiter':
            return ReportService.process_smb_exploit(exploit)
        if exploiter_type == 'WmiExploiter':
            return ReportService.process_wmi_exploit(exploit)
        if exploiter_type == 'SSHExploiter':
            return ReportService.process_ssh_exploit(exploit)
        if exploiter_type == 'RdpExploiter':
            return ReportService.process_rdp_exploit(exploit)
        if exploiter_type == 'SambaCryExploiter':
            return ReportService.process_sambacry_exploit(exploit)
        if exploiter_type == 'ElasticGroovyExploiter':
            return ReportService.process_elastic_exploit(exploit)
        if exploiter_type == 'Ms08_067_Exploiter':
            return ReportService.process_conficker_exploit(exploit)
        if exploiter_type == 'ShellShockExploiter':
            return ReportService.process_shellshock_exploit(exploit)

    @staticmethod
    def get_exploits():
        exploits = []
        for exploit in mongo.db.telemetry.find({'telem_type': 'exploit', 'data.result': True}):
            new_exploit = ReportService.process_exploit(exploit)
            if new_exploit not in exploits:
                exploits.append(new_exploit)
        return exploits

    @staticmethod
    def get_monkey_subnets(monkey_guid):
        network_info = mongo.db.telemetry.find_one(
            {'telem_type': 'system_info_collection', 'monkey_guid': monkey_guid},
            {'data.network_info.networks': 1}
        )
        if network_info is None:
            return []

        return \
            [
                ipaddress.ip_interface(unicode(network['addr'] + '/' + network['netmask'])).network
                for network in network_info['data']['network_info']['networks']
            ]

    @staticmethod
    def get_cross_segment_issues():
        issues = []
        island_ips = local_ip_addresses()
        for monkey in mongo.db.monkey.find({'tunnel': {'$exists': False}}, {'tunnel': 1, 'guid': 1, 'hostname': 1}):
            found_good_ip = False
            monkey_subnets = ReportService.get_monkey_subnets(monkey['guid'])
            for subnet in monkey_subnets:
                for ip in island_ips:
                    if ipaddress.ip_address(unicode(ip)) in subnet:
                        found_good_ip = True
                        break
                if found_good_ip:
                    break
            if not found_good_ip:
                issues.append(
                    {'type': 'cross_segment', 'machine': monkey['hostname'],
                     'networks': [str(subnet) for subnet in monkey_subnets],
                     'server_networks': [str(subnet) for subnet in get_subnets()]}
                )

        return issues

    @staticmethod
    def get_issues():
        issues = ReportService.get_exploits() + ReportService.get_tunnels() + ReportService.get_cross_segment_issues()
        issues_dict = {}
        for issue in issues:
            machine = issue['machine']
            if machine not in issues_dict:
                issues_dict[machine] = []
            issues_dict[machine].append(issue)
        return issues_dict

    @staticmethod
    def get_manual_monkeys():
        return [monkey['hostname'] for monkey in mongo.db.monkey.find({}, {'hostname': 1, 'parent': 1, 'guid': 1}) if
                NodeService.get_monkey_manual_run(monkey)]

    @staticmethod
    def get_config_users():
        return ConfigService.get_config_value(['basic', 'credentials', 'exploit_user_list'], True)

    @staticmethod
    def get_config_passwords():
        return ConfigService.get_config_value(['basic', 'credentials', 'exploit_password_list'], True)

    @staticmethod
    def get_config_exploits():
        exploits_config_value = ['exploits', 'general', 'exploiter_classes']
        default_exploits = ConfigService.get_default_config()
        for namespace in exploits_config_value:
            default_exploits = default_exploits[namespace]
        exploits = ConfigService.get_config_value(exploits_config_value, True)

        if exploits == default_exploits:
            return ['default']

        return [ReportService.EXPLOIT_DISPLAY_DICT[exploit] for exploit in
                exploits]

    @staticmethod
    def get_config_ips():
        if ConfigService.get_config_value(['basic_network', 'network_range', 'range_class'], True) != 'FixedRange':
            return []
        return ConfigService.get_config_value(['basic_network', 'network_range', 'range_fixed'], True)

    @staticmethod
    def get_config_scan():
        return ConfigService.get_config_value(['basic_network', 'general', 'local_network_scan'], True)

    @staticmethod
    def get_issues_overview(issues, config_users, config_passwords):
        issues_byte_array = [False] * 6

        for machine in issues:
            for issue in issues[machine]:
                if issue['type'] == 'elastic':
                    issues_byte_array[ReportService.ISSUES_DICT.ELASTIC] = True
                elif issue['type'] == 'sambacry':
                    issues_byte_array[ReportService.ISSUES_DICT.SAMBACRY] = True
                elif issue['type'] == 'shellshock':
                    issues_byte_array[ReportService.ISSUES_DICT.SHELLSHOCK] = True
                elif issue['type'] == 'conficker':
                    issues_byte_array[ReportService.ISSUES_DICT.CONFICKER] = True
                elif issue['type'].endswith('_password') and issue['password'] in config_passwords and \
                                issue['username'] in config_users:
                    issues_byte_array[ReportService.ISSUES_DICT.WEAK_PASSWORD] = True
                elif issue['type'].endswith('_pth') or issue['type'].endswith('_password'):
                    issues_byte_array[ReportService.ISSUES_DICT.STOLEN_CREDS] = True

        return issues_byte_array

    @staticmethod
    def get_warnings_overview(issues):
        warnings_byte_array = [False] * 2

        for machine in issues:
            for issue in issues[machine]:
                if issue['type'] == 'cross_segment':
                    warnings_byte_array[ReportService.WARNINGS_DICT.CROSS_SEGMENT] = True
                elif issue['type'] == 'tunnel':
                    warnings_byte_array[ReportService.WARNINGS_DICT.TUNNEL] = True

        return warnings_byte_array

    @staticmethod
    def get_report():
        issues = ReportService.get_issues()
        config_users = ReportService.get_config_users()
        config_passwords = ReportService.get_config_passwords()

        return \
            {
                'overview':
                    {
                        'manual_monkeys': ReportService.get_manual_monkeys(),
                        'config_users': config_users,
                        'config_passwords': config_passwords,
                        'config_exploits': ReportService.get_config_exploits(),
                        'config_ips': ReportService.get_config_ips(),
                        'config_scan': ReportService.get_config_scan(),
                        'monkey_start_time': ReportService.get_first_monkey_time().strftime("%d/%m/%Y %H:%M:%S"),
                        'monkey_duration': ReportService.get_monkey_duration(),
                        'issues': ReportService.get_issues_overview(issues, config_users, config_passwords),
                        'warnings': ReportService.get_warnings_overview(issues)
                    },
                'glance':
                    {
                        'scanned': ReportService.get_scanned(),
                        'exploited': ReportService.get_exploited(),
                        'stolen_creds': ReportService.get_stolen_creds()
                    },
                'recommendations':
                    {
                        'issues': issues
                    }
            }

    @staticmethod
    def did_exploit_type_succeed(exploit_type):
        return mongo.db.edge.count(
            {'exploits': {'$elemMatch': {'exploiter': exploit_type, 'result': True}}},
            limit=1) > 0