From 330ad6540e16b74fcce7f7d29aed08eedef62771 Mon Sep 17 00:00:00 2001 From: Mike Salvatore Date: Tue, 8 Dec 2020 08:45:49 -0500 Subject: [PATCH 01/12] Check if user is root before starting deploy_linux script If the user is root, we want to exit as soon as possible since any commands that the deployment script runs will be run as root. --- deployment_scripts/deploy_linux.sh | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/deployment_scripts/deploy_linux.sh b/deployment_scripts/deploy_linux.sh index d13478018..1f21fb758 100755 --- a/deployment_scripts/deploy_linux.sh +++ b/deployment_scripts/deploy_linux.sh @@ -23,6 +23,11 @@ log_message() { echo -e "DEPLOYMENT SCRIPT: $1" } +if is_root; then + log_message "Please don't run this script as root" + exit 1 +fi + config_branch=${2:-"develop"} config_url="https://raw.githubusercontent.com/guardicore/monkey/${config_branch}/deployment_scripts/config" @@ -62,11 +67,6 @@ ISLAND_BINARIES_PATH="$ISLAND_PATH/cc/binaries" INFECTION_MONKEY_DIR="$monkey_home/monkey/infection_monkey" MONKEY_BIN_DIR="$INFECTION_MONKEY_DIR/bin" -if is_root; then - log_message "Please don't run this script as root" - exit 1 -fi - HAS_SUDO=$(has_sudo) if [[ ! $HAS_SUDO ]]; then log_message "You need root permissions for some of this script operations. Quiting." From 6f0fffee078bd0e376346f742bff795362e36302 Mon Sep 17 00:00:00 2001 From: Mike Salvatore Date: Tue, 8 Dec 2020 10:01:36 -0500 Subject: [PATCH 02/12] Fix hung timeout when checking for sudo in deploy_linux.sh --- deployment_scripts/deploy_linux.sh | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/deployment_scripts/deploy_linux.sh b/deployment_scripts/deploy_linux.sh index 1f21fb758..cea8d70a8 100755 --- a/deployment_scripts/deploy_linux.sh +++ b/deployment_scripts/deploy_linux.sh @@ -10,7 +10,7 @@ is_root() { has_sudo() { # 0 true, 1 false - timeout 1 sudo id && return 0 || return 1 + return $(sudo -nv > /dev/null 2>&1) } handle_error() { @@ -67,8 +67,7 @@ ISLAND_BINARIES_PATH="$ISLAND_PATH/cc/binaries" INFECTION_MONKEY_DIR="$monkey_home/monkey/infection_monkey" MONKEY_BIN_DIR="$INFECTION_MONKEY_DIR/bin" -HAS_SUDO=$(has_sudo) -if [[ ! $HAS_SUDO ]]; then +if ! has_sudo; then log_message "You need root permissions for some of this script operations. Quiting." exit 1 fi From 0238354bea6e06d91038b19d0cc56d1106ad3006 Mon Sep 17 00:00:00 2001 From: Mike Salvatore Date: Tue, 8 Dec 2020 10:23:53 -0500 Subject: [PATCH 03/12] Give a more descriptive error message if deploy_linux.sh cannot use sudo --- deployment_scripts/deploy_linux.sh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/deployment_scripts/deploy_linux.sh b/deployment_scripts/deploy_linux.sh index cea8d70a8..f11e126da 100755 --- a/deployment_scripts/deploy_linux.sh +++ b/deployment_scripts/deploy_linux.sh @@ -68,7 +68,8 @@ INFECTION_MONKEY_DIR="$monkey_home/monkey/infection_monkey" MONKEY_BIN_DIR="$INFECTION_MONKEY_DIR/bin" if ! has_sudo; then - log_message "You need root permissions for some of this script operations. Quiting." + log_message "You need root permissions for some of this script operations. \ +Run \`sudo -v\`, enter your password, and then re-run this script." exit 1 fi From 88c7a6a0f9a559c1e5eacd14d88beac64ac2430c Mon Sep 17 00:00:00 2001 From: VakarisZ Date: Mon, 5 Oct 2020 10:24:37 +0300 Subject: [PATCH 04/12] Fixed linux deployment script config to point to proper repository --- deployment_scripts/config | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/deployment_scripts/config b/deployment_scripts/config index bda54e390..2dbeaf442 100644 --- a/deployment_scripts/config +++ b/deployment_scripts/config @@ -10,7 +10,7 @@ get_latest_release() { sed -E 's/.*"([^"]+)".*/\1/' # Pluck JSON value } -MONKEY_LATEST_RELEASE=$(get_latest_release "monkey/guardicore") +MONKEY_LATEST_RELEASE=$(get_latest_release "guardicore/monkey") # Monkey binaries LINUX_32_BINARY_NAME="monkey-linux-32" From b84d1f1708e2adff8139c13a7da958c4e08b8f69 Mon Sep 17 00:00:00 2001 From: VakarisZ Date: Mon, 5 Oct 2020 10:28:45 +0300 Subject: [PATCH 05/12] Fixed linux deployment script config syntax --- deployment_scripts/config | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/deployment_scripts/config b/deployment_scripts/config index 2dbeaf442..5d645a28f 100644 --- a/deployment_scripts/config +++ b/deployment_scripts/config @@ -14,31 +14,31 @@ MONKEY_LATEST_RELEASE=$(get_latest_release "guardicore/monkey") # Monkey binaries LINUX_32_BINARY_NAME="monkey-linux-32" -LINUX_32_BINARY_URL="https://github.com/guardicore/monkey/releases/download/$($MONKEY_LATEST_RELEASE)/monkey-linux-32" +LINUX_32_BINARY_URL="https://github.com/guardicore/monkey/releases/download/$MONKEY_LATEST_RELEASE/monkey-linux-32" export LINUX_32_BINARY_URL export LINUX_32_BINARY_NAME LINUX_64_BINARY_NAME="monkey-linux-64" -LINUX_64_BINARY_URL="https://github.com/guardicore/monkey/releases/download/$($MONKEY_LATEST_RELEASE)/monkey-linux-64" +LINUX_64_BINARY_URL="https://github.com/guardicore/monkey/releases/download/$MONKEY_LATEST_RELEASE/monkey-linux-64" export LINUX_64_BINARY_URL export LINUX_64_BINARY_NAME WINDOWS_32_BINARY_NAME="monkey-windows-32.exe" -WINDOWS_32_BINARY_URL="https://github.com/guardicore/monkey/releases/download/$($MONKEY_LATEST_RELEASE)/monkey-windows-32.exe" +WINDOWS_32_BINARY_URL="https://github.com/guardicore/monkey/releases/download/$MONKEY_LATEST_RELEASE/monkey-windows-32.exe" export WINDOWS_32_BINARY_URL export WINDOWS_32_BINARY_NAME WINDOWS_64_BINARY_NAME="monkey-windows-64.exe" -WINDOWS_64_BINARY_URL="https://github.com/guardicore/monkey/releases/download/$($MONKEY_LATEST_RELEASE)/monkey-windows-64.exe" +WINDOWS_64_BINARY_URL="https://github.com/guardicore/monkey/releases/download/$MONKEY_LATEST_RELEASE/monkey-windows-64.exe" export WINDOWS_64_BINARY_URL export WINDOWS_64_BINARY_NAME # Other binaries for monkey -TRACEROUTE_64_BINARY_URL="https://github.com/guardicore/monkey/releases/download/$($MONKEY_LATEST_RELEASE)/traceroute64" +TRACEROUTE_64_BINARY_URL="https://github.com/guardicore/monkey/releases/download/$MONKEY_LATEST_RELEASE/traceroute64" export TRACEROUTE_64_BINARY_URL -TRACEROUTE_32_BINARY_URL="https://github.com/guardicore/monkey/releases/download/$($MONKEY_LATEST_RELEASE)/traceroute32" +TRACEROUTE_32_BINARY_URL="https://github.com/guardicore/monkey/releases/download/$MONKEY_LATEST_RELEASE/traceroute32" export TRACEROUTE_32_BINARY_URL -SAMBACRY_64_BINARY_URL="https://github.com/guardicore/monkey/releases/download/$($MONKEY_LATEST_RELEASE)/sc_monkey_runner64.so" +SAMBACRY_64_BINARY_URL="https://github.com/guardicore/monkey/releases/download/$MONKEY_LATEST_RELEASE/sc_monkey_runner64.so" export SAMBACRY_64_BINARY_URL -SAMBACRY_32_BINARY_URL="https://github.com/guardicore/monkey/releases/download/$($MONKEY_LATEST_RELEASE)/sc_monkey_runner32.so" +SAMBACRY_32_BINARY_URL="https://github.com/guardicore/monkey/releases/download/$MONKEY_LATEST_RELEASE/sc_monkey_runner32.so" export SAMBACRY_32_BINARY_URL From c807104a3815bbf630ff3aa26615c680b56ff81a Mon Sep 17 00:00:00 2001 From: Mike Salvatore Date: Tue, 8 Dec 2020 12:25:41 -0500 Subject: [PATCH 06/12] Enable deployment_scripts/config to use wget or curl --- deployment_scripts/config | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/deployment_scripts/config b/deployment_scripts/config index 5d645a28f..f5e4e5d88 100644 --- a/deployment_scripts/config +++ b/deployment_scripts/config @@ -4,10 +4,22 @@ export MONKEY_FOLDER_NAME="infection_monkey" # Url of public git repository that contains monkey's source code export MONKEY_GIT_URL="https://github.com/guardicore/monkey" +exists() { + command -v "$1" >/dev/null 2>&1 +} + get_latest_release() { - curl --silent "https://api.github.com/repos/$1/releases/latest" | # Get latest release from GitHub API - grep '"tag_name":' | # Get tag line - sed -E 's/.*"([^"]+)".*/\1/' # Pluck JSON value + RELEASE_URL="https://api.github.com/repos/$1/releases/latest" + + if exists wget; then + RELEASE_INFO=$(wget --quiet -O - "$RELEASE_URL") # Get latest release from GitHub API + else + RELEASE_INFO=$(curl --silent "$RELEASE_URL") # Get latest release from GitHub API + fi + + echo "$RELEASE_INFO" | + grep '"tag_name":' | # Get tag line + sed -E 's/.*"([^"]+)".*/\1/' # Pluck JSON value } MONKEY_LATEST_RELEASE=$(get_latest_release "guardicore/monkey") From 39da1299333d59204fd90c9348fae8ae74144d7c Mon Sep 17 00:00:00 2001 From: Mike Salvatore Date: Tue, 8 Dec 2020 12:38:04 -0500 Subject: [PATCH 07/12] Install python3-distutils in deploy_linux.sh --- deployment_scripts/deploy_linux.sh | 3 +++ 1 file changed, 3 insertions(+) diff --git a/deployment_scripts/deploy_linux.sh b/deployment_scripts/deploy_linux.sh index f11e126da..2dcccd02d 100755 --- a/deployment_scripts/deploy_linux.sh +++ b/deployment_scripts/deploy_linux.sh @@ -118,6 +118,9 @@ fi log_message "Installing build-essential" sudo apt install build-essential +log_message "Installing python3-distutils" +sudo apt install python3-distutils + log_message "Installing or updating pip" # shellcheck disable=SC2086 pip_url=https://bootstrap.pypa.io/get-pip.py From cdc65152d268f58fbbd40b6d9219f6e7b88138c6 Mon Sep 17 00:00:00 2001 From: Mike Salvatore Date: Tue, 8 Dec 2020 12:39:07 -0500 Subject: [PATCH 08/12] Make create_certificate.sh executible when deploying on linux --- deployment_scripts/deploy_linux.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/deployment_scripts/deploy_linux.sh b/deployment_scripts/deploy_linux.sh index 2dcccd02d..044e95bd2 100755 --- a/deployment_scripts/deploy_linux.sh +++ b/deployment_scripts/deploy_linux.sh @@ -174,6 +174,7 @@ sudo apt-get install openssl # Generate SSL certificate log_message "Generating certificate" +chmod u+x "${ISLAND_PATH}"/linux/create_certificate.sh "${ISLAND_PATH}"/linux/create_certificate.sh ${ISLAND_PATH}/cc # Update node From 66ac438fa263c85e80790d98c2e4f9a4cc03d885 Mon Sep 17 00:00:00 2001 From: Mike Salvatore Date: Tue, 8 Dec 2020 13:50:33 -0500 Subject: [PATCH 09/12] Install libcurl4 in deploy_linux.sh --- deployment_scripts/deploy_linux.sh | 3 +++ 1 file changed, 3 insertions(+) diff --git a/deployment_scripts/deploy_linux.sh b/deployment_scripts/deploy_linux.sh index 044e95bd2..9c73cbe03 100755 --- a/deployment_scripts/deploy_linux.sh +++ b/deployment_scripts/deploy_linux.sh @@ -165,6 +165,9 @@ chmod a+x "$ISLAND_BINARIES_PATH/$LINUX_64_BINARY_NAME" # If a user haven't installed mongo manually check if we can install it with our script if ! exists mongod; then + log_message "Installing libcurl4" + sudo apt install libcurl4 + log_message "Installing MongoDB" "${ISLAND_PATH}"/linux/install_mongo.sh ${MONGO_PATH} || handle_error fi From ce40392c2bd9534769036fea5961441e3f5fc96b Mon Sep 17 00:00:00 2001 From: Mike Salvatore Date: Tue, 8 Dec 2020 14:25:14 -0500 Subject: [PATCH 10/12] Assume yes for `apt install` commands in deploy_linux.sh --- deployment_scripts/deploy_linux.sh | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/deployment_scripts/deploy_linux.sh b/deployment_scripts/deploy_linux.sh index 9c73cbe03..c037881c4 100755 --- a/deployment_scripts/deploy_linux.sh +++ b/deployment_scripts/deploy_linux.sh @@ -110,16 +110,16 @@ if [[ ${python_cmd} == "" ]]; then log_message "Python 3.7 command not found. Installing python 3.7." sudo add-apt-repository ppa:deadsnakes/ppa sudo apt-get update - sudo apt install python3.7 python3.7-dev + sudo apt install -y python3.7 python3.7-dev log_message "Python 3.7 is now available with command 'python3.7'." python_cmd="python3.7" fi log_message "Installing build-essential" -sudo apt install build-essential +sudo apt install -y build-essential log_message "Installing python3-distutils" -sudo apt install python3-distutils +sudo apt install -y python3-distutils log_message "Installing or updating pip" # shellcheck disable=SC2086 @@ -137,7 +137,7 @@ requirements_island="$ISLAND_PATH/requirements.txt" ${python_cmd} -m pip install -r "${requirements_island}" --user --upgrade || handle_error log_message "Installing monkey requirements" -sudo apt-get install libffi-dev upx libssl-dev libc++1 +sudo apt install -y libffi-dev upx libssl-dev libc++1 requirements_monkey="$INFECTION_MONKEY_DIR/requirements.txt" ${python_cmd} -m pip install -r "${requirements_monkey}" --user --upgrade || handle_error @@ -166,13 +166,13 @@ chmod a+x "$ISLAND_BINARIES_PATH/$LINUX_64_BINARY_NAME" # If a user haven't installed mongo manually check if we can install it with our script if ! exists mongod; then log_message "Installing libcurl4" - sudo apt install libcurl4 + sudo apt install -y libcurl4 log_message "Installing MongoDB" "${ISLAND_PATH}"/linux/install_mongo.sh ${MONGO_PATH} || handle_error fi log_message "Installing openssl" -sudo apt-get install openssl +sudo apt install -y openssl # Generate SSL certificate log_message "Generating certificate" @@ -189,7 +189,7 @@ if ! exists npm; then else wget -q -O - $node_src | sudo -E bash - fi - sudo apt-get install -y nodejs + sudo apt install -y nodejs fi pushd "$ISLAND_PATH/cc/ui" || handle_error From 2111d2af697ae0276c9b1b5aeb17eab0a4498c25 Mon Sep 17 00:00:00 2001 From: Mike Salvatore Date: Tue, 8 Dec 2020 14:40:20 -0500 Subject: [PATCH 11/12] Add instructions on how to run monkey_island after deploy_linux.sh --- deployment_scripts/README.md | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/deployment_scripts/README.md b/deployment_scripts/README.md index 16b150852..4ee91b5b4 100644 --- a/deployment_scripts/README.md +++ b/deployment_scripts/README.md @@ -39,6 +39,7 @@ Your user must have root permissions; however, don't run the script as root! ```sh wget https://raw.githubusercontent.com/guardicore/monkey/develop/deployment_scripts/deploy_linux.sh +chmod u+x ./deploy_linux.sh ``` This will download our deploy script. It's a good idea to read it quickly before executing it! @@ -52,4 +53,13 @@ After downloading that script, execute it in a shell. The first argument should - `./deploy_linux.sh "" "master"` (deploys master branch in script directory) - `./deploy_linux.sh "/home/user/new" "master"` (if directory "new" is not found creates it and clones master branch into it) -You may also pass in an optional third `false` parameter to disable downloading the latest agent binaries. \ No newline at end of file +You may also pass in an optional third `false` parameter to disable downloading the latest agent binaries. + +### Run on Linux + +After the `deploy_linux.sh` script completes, you can start the monkey island. + +```sh +cd infection_monkey/monkey +./monkey_island/linux/run.sh +``` From 5401cf2406f1ec29e356089795c852151a82e7b1 Mon Sep 17 00:00:00 2001 From: Mike Salvatore Date: Tue, 8 Dec 2020 18:53:19 -0500 Subject: [PATCH 12/12] Switch from `apt install` to `apt-get install` in deploy_linux.sh `apt-get` has a stable command-line interface, while `apt` does not. --- deployment_scripts/deploy_linux.sh | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/deployment_scripts/deploy_linux.sh b/deployment_scripts/deploy_linux.sh index c037881c4..728e2f52d 100755 --- a/deployment_scripts/deploy_linux.sh +++ b/deployment_scripts/deploy_linux.sh @@ -110,16 +110,16 @@ if [[ ${python_cmd} == "" ]]; then log_message "Python 3.7 command not found. Installing python 3.7." sudo add-apt-repository ppa:deadsnakes/ppa sudo apt-get update - sudo apt install -y python3.7 python3.7-dev + sudo apt-get install -y python3.7 python3.7-dev log_message "Python 3.7 is now available with command 'python3.7'." python_cmd="python3.7" fi log_message "Installing build-essential" -sudo apt install -y build-essential +sudo apt-get install -y build-essential log_message "Installing python3-distutils" -sudo apt install -y python3-distutils +sudo apt-get install -y python3-distutils log_message "Installing or updating pip" # shellcheck disable=SC2086 @@ -137,7 +137,7 @@ requirements_island="$ISLAND_PATH/requirements.txt" ${python_cmd} -m pip install -r "${requirements_island}" --user --upgrade || handle_error log_message "Installing monkey requirements" -sudo apt install -y libffi-dev upx libssl-dev libc++1 +sudo apt-get install -y libffi-dev upx libssl-dev libc++1 requirements_monkey="$INFECTION_MONKEY_DIR/requirements.txt" ${python_cmd} -m pip install -r "${requirements_monkey}" --user --upgrade || handle_error @@ -166,13 +166,13 @@ chmod a+x "$ISLAND_BINARIES_PATH/$LINUX_64_BINARY_NAME" # If a user haven't installed mongo manually check if we can install it with our script if ! exists mongod; then log_message "Installing libcurl4" - sudo apt install -y libcurl4 + sudo apt-get install -y libcurl4 log_message "Installing MongoDB" "${ISLAND_PATH}"/linux/install_mongo.sh ${MONGO_PATH} || handle_error fi log_message "Installing openssl" -sudo apt install -y openssl +sudo apt-get install -y openssl # Generate SSL certificate log_message "Generating certificate" @@ -189,7 +189,7 @@ if ! exists npm; then else wget -q -O - $node_src | sudo -E bash - fi - sudo apt install -y nodejs + sudo apt-get install -y nodejs fi pushd "$ISLAND_PATH/cc/ui" || handle_error