+For more information view docs/fullDocs.md diff --git a/envs/monkey_zoo/__init__.py b/envs/monkey_zoo/__init__.py new file mode 100644 index 000000000..e69de29bb diff --git a/envs/monkey_zoo/blackbox/README.md b/envs/monkey_zoo/blackbox/README.md new file mode 100644 index 000000000..f1b66de91 --- /dev/null +++ b/envs/monkey_zoo/blackbox/README.md @@ -0,0 +1,19 @@ +# Automatic blackbox tests +### Prerequisites +1. Download google sdk: https://cloud.google.com/sdk/docs/ +2. Download service account key for MonkeyZoo project (if you deployed MonkeyZoo via terraform scripts then you already have it). +GCP console -> IAM -> service accounts(you can use the same key used to authenticate terraform scripts) +3. Deploy the relevant branch + complied executables to the Island machine on GCP. + +### Running the tests +In order to execute the entire test suite, you must know the external IP of the Island machine on GCP. You can find +this information in the GCP Console `Compute Engine/VM Instances` under _External IP_. + +#### Running in command line +Run the following command: + +`monkey\envs\monkey_zoo\blackbox>python -m pytest --island=35.207.152.72:5000 test_blackbox.py` + +#### Running in PyCharm +Configure a PyTest configuration with the additional argument `--island=35.207.152.72` on the +`monkey\envs\monkey_zoo\blackbox`. diff --git a/envs/monkey_zoo/blackbox/__init__.py b/envs/monkey_zoo/blackbox/__init__.py new file mode 100644 index 000000000..e69de29bb diff --git a/envs/monkey_zoo/blackbox/analyzers/__init__.py b/envs/monkey_zoo/blackbox/analyzers/__init__.py new file mode 100644 index 000000000..e69de29bb diff --git a/envs/monkey_zoo/blackbox/analyzers/analyzer_log.py b/envs/monkey_zoo/blackbox/analyzers/analyzer_log.py new file mode 100644 index 000000000..f97418813 --- /dev/null +++ b/envs/monkey_zoo/blackbox/analyzers/analyzer_log.py @@ -0,0 +1,17 @@ +LOG_INIT_MESSAGE = "Analysis didn't run." + + +class AnalyzerLog(object): + + def __init__(self, analyzer_name): + self.contents = LOG_INIT_MESSAGE + self.name = analyzer_name + + def clear(self): + self.contents = "" + + def add_entry(self, message): + self.contents = "{}\n{}".format(self.contents, message) + + def get_contents(self): + return "{}: {}\n".format(self.name, self.contents) diff --git a/envs/monkey_zoo/blackbox/analyzers/communication_analyzer.py b/envs/monkey_zoo/blackbox/analyzers/communication_analyzer.py new file mode 100644 index 000000000..491b534b8 --- /dev/null +++ b/envs/monkey_zoo/blackbox/analyzers/communication_analyzer.py @@ -0,0 +1,24 @@ +from envs.monkey_zoo.blackbox.analyzers.analyzer_log import AnalyzerLog + + +class CommunicationAnalyzer(object): + + def __init__(self, island_client, machine_ips): + self.island_client = island_client + self.machine_ips = machine_ips + self.log = AnalyzerLog(self.__class__.__name__) + + def analyze_test_results(self): + self.log.clear() + all_monkeys_communicated = True + for machine_ip in self.machine_ips: + if not self.did_monkey_communicate_back(machine_ip): + self.log.add_entry("Monkey from {} didn't communicate back".format(machine_ip)) + all_monkeys_communicated = False + else: + self.log.add_entry("Monkey from {} communicated back".format(machine_ip)) + return all_monkeys_communicated + + def did_monkey_communicate_back(self, machine_ip): + query = {'ip_addresses': {'$elemMatch': {'$eq': machine_ip}}} + return len(self.island_client.find_monkeys_in_db(query)) > 0 diff --git a/envs/monkey_zoo/blackbox/conftest.py b/envs/monkey_zoo/blackbox/conftest.py new file mode 100644 index 000000000..13aabf5b6 --- /dev/null +++ b/envs/monkey_zoo/blackbox/conftest.py @@ -0,0 +1,11 @@ +import pytest + + +def pytest_addoption(parser): + parser.addoption("--island", action="store", default="", + help="Specify the Monkey Island address (host+port).") + + +@pytest.fixture(scope='module') +def island(request): + return request.config.getoption("--island") diff --git a/envs/monkey_zoo/blackbox/island_client/__init__.py b/envs/monkey_zoo/blackbox/island_client/__init__.py new file mode 100644 index 000000000..e69de29bb diff --git a/envs/monkey_zoo/blackbox/island_client/island_config_parser.py b/envs/monkey_zoo/blackbox/island_client/island_config_parser.py new file mode 100644 index 000000000..948b58310 --- /dev/null +++ b/envs/monkey_zoo/blackbox/island_client/island_config_parser.py @@ -0,0 +1,18 @@ +import json +import os + + +class IslandConfigParser(object): + + def __init__(self, config_filename): + self.config_raw = open(IslandConfigParser.get_conf_file_path(config_filename), 'r').read() + self.config_json = json.loads(self.config_raw) + + def get_ips_of_targets(self): + return self.config_json['basic_network']['general']['subnet_scan_list'] + + @staticmethod + def get_conf_file_path(conf_file_name): + return os.path.join(os.path.dirname(os.path.dirname(os.path.abspath(__file__))), + "island_configs", + conf_file_name) diff --git a/envs/monkey_zoo/blackbox/island_client/monkey_island_client.py b/envs/monkey_zoo/blackbox/island_client/monkey_island_client.py new file mode 100644 index 000000000..479c41bab --- /dev/null +++ b/envs/monkey_zoo/blackbox/island_client/monkey_island_client.py @@ -0,0 +1,87 @@ +from time import sleep +import json + +import logging +from bson import json_util + +from envs.monkey_zoo.blackbox.island_client.monkey_island_requests import MonkeyIslandRequests + +SLEEP_BETWEEN_REQUESTS_SECONDS = 0.5 +MONKEY_TEST_ENDPOINT = 'api/test/monkey' +LOG_TEST_ENDPOINT = 'api/test/log' +LOGGER = logging.getLogger(__name__) + + +def avoid_race_condition(func): + sleep(SLEEP_BETWEEN_REQUESTS_SECONDS) + return func + + +class MonkeyIslandClient(object): + def __init__(self, server_address): + self.requests = MonkeyIslandRequests(server_address) + + def get_api_status(self): + return self.requests.get("api") + + @avoid_race_condition + def import_config(self, config_contents): + _ = self.requests.post("api/configuration/island", data=config_contents) + + @avoid_race_condition + def run_monkey_local(self): + response = self.requests.post_json("api/local-monkey", dict_data={"action": "run"}) + if MonkeyIslandClient.monkey_ran_successfully(response): + LOGGER.info("Running the monkey.") + else: + LOGGER.error("Failed to run the monkey.") + assert False + + @staticmethod + def monkey_ran_successfully(response): + return response.ok and json.loads(response.content)['is_running'] + + @avoid_race_condition + def kill_all_monkeys(self): + if self.requests.get("api", {"action": "killall"}).ok: + LOGGER.info("Killing all monkeys after the test.") + else: + LOGGER.error("Failed to kill all monkeys.") + assert False + + @avoid_race_condition + def reset_env(self): + if self.requests.get("api", {"action": "reset"}).ok: + LOGGER.info("Resetting environment after the test.") + else: + LOGGER.error("Failed to reset the environment.") + assert False + + def find_monkeys_in_db(self, query): + if query is None: + raise TypeError + response = self.requests.get(MONKEY_TEST_ENDPOINT, + MonkeyIslandClient.form_find_query_for_request(query)) + return MonkeyIslandClient.get_test_query_results(response) + + def get_all_monkeys_from_db(self): + response = self.requests.get(MONKEY_TEST_ENDPOINT, + MonkeyIslandClient.form_find_query_for_request(None)) + return MonkeyIslandClient.get_test_query_results(response) + + def find_log_in_db(self, query): + response = self.requests.get(LOG_TEST_ENDPOINT, + MonkeyIslandClient.form_find_query_for_request(query)) + return MonkeyIslandClient.get_test_query_results(response) + + @staticmethod + def form_find_query_for_request(query): + return {'find_query': json_util.dumps(query)} + + @staticmethod + def get_test_query_results(response): + return json.loads(response.content)['results'] + + def is_all_monkeys_dead(self): + query = {'dead': False} + return len(self.find_monkeys_in_db(query)) == 0 diff --git a/envs/monkey_zoo/blackbox/island_client/monkey_island_requests.py b/envs/monkey_zoo/blackbox/island_client/monkey_island_requests.py new file mode 100644 index 000000000..e62cb2121 --- /dev/null +++ b/envs/monkey_zoo/blackbox/island_client/monkey_island_requests.py @@ -0,0 +1,49 @@ +import requests + +# SHA3-512 of '1234567890!@#$%^&*()_nothing_up_my_sleeve_1234567890!@#$%^&*()' +import logging + +NO_AUTH_CREDS = '55e97c9dcfd22b8079189ddaeea9bce8125887e3237b800c6176c9afa80d2062' \ + '8d2c8d0b1538d2208c1444ac66535b764a3d902b35e751df3faec1e477ed3557' +LOGGER = logging.getLogger(__name__) + + +class MonkeyIslandRequests(object): + def __init__(self, server_address): + self.addr = "https://{IP}/".format(IP=server_address) + self.token = self.try_get_jwt_from_server() + + def try_get_jwt_from_server(self): + try: + return self.get_jwt_from_server() + except requests.ConnectionError as err: + LOGGER.error( + "Unable to connect to island, aborting! Error information: {}. Server: {}".format(err, self.addr)) + assert False + + def get_jwt_from_server(self): + resp = requests.post(self.addr + "api/auth", + json={"username": NO_AUTH_CREDS, "password": NO_AUTH_CREDS}, + verify=False) + return resp.json()["access_token"] + + def get(self, url, data=None): + return requests.get(self.addr + url, + headers=self.get_jwt_header(), + params=data, + verify=False) + + def post(self, url, data): + return requests.post(self.addr + url, + data=data, + headers=self.get_jwt_header(), + verify=False) + + def post_json(self, url, dict_data): + return requests.post(self.addr + url, + json=dict_data, + headers=self.get_jwt_header(), + verify=False) + + def get_jwt_header(self): + return {"Authorization": "JWT " + self.token} diff --git a/envs/monkey_zoo/blackbox/island_configs/ELASTIC.conf b/envs/monkey_zoo/blackbox/island_configs/ELASTIC.conf new file mode 100644 index 000000000..0a81ea700 --- /dev/null +++ b/envs/monkey_zoo/blackbox/island_configs/ELASTIC.conf @@ -0,0 +1,184 @@ +{ + "basic": { + "credentials": { + "exploit_password_list": [ + "Password1!", + "1234", + "password", + "12345678" + ], + "exploit_user_list": [ + "Administrator", + "root", + "user" + ] + }, + "general": { + "should_exploit": true + } + }, + "basic_network": { + "general": { + "blocked_ips": [], + "depth": 2, + "local_network_scan": false, + "subnet_scan_list": [ + "10.2.2.4", + "10.2.2.5" + ] + }, + "network_analysis": { + "inaccessible_subnets": [] + } + }, + "cnc": { + "servers": { + "command_servers": [ + "10.2.2.251:5000" + ], + "current_server": "10.2.2.251:5000", + "internet_services": [ + "monkey.guardicore.com", + "www.google.com" + ] + } + }, + "exploits": { + "general": { + "exploiter_classes": [ + "ElasticGroovyExploiter" + ], + "skip_exploit_if_file_exist": false + }, + "ms08_067": { + "ms08_067_exploit_attempts": 5, + "remote_user_pass": "Password1!", + "user_to_add": "Monkey_IUSER_SUPPORT" + }, + "rdp_grinder": { + "rdp_use_vbs_download": true + }, + "sambacry": { + "sambacry_folder_paths_to_guess": [ + "/", + "/mnt", + "/tmp", + "/storage", + "/export", + "/share", + "/shares", + "/home" + ], + "sambacry_shares_not_to_check": [ + "IPC$", + "print$" + ], + "sambacry_trigger_timeout": 5 + }, + "smb_service": { + "smb_download_timeout": 300, + "smb_service_name": "InfectionMonkey" + } + }, + "internal": { + "classes": { + "finger_classes": [ + "SMBFinger", + "SSHFinger", + "PingScanner", + "HTTPFinger", + "MySQLFinger", + "MSSQLFinger", + "ElasticFinger" + ] + }, + "dropper": { + "dropper_date_reference_path_linux": "/bin/sh", + "dropper_date_reference_path_windows": "%windir%\\system32\\kernel32.dll", + "dropper_set_date": true, + "dropper_target_path_linux": "/tmp/monkey", + "dropper_target_path_win_32": "C:\\Windows\\temp\\monkey32.exe", + "dropper_target_path_win_64": "C:\\Windows\\temp\\monkey64.exe", + "dropper_try_move_first": true + }, + "exploits": { + "exploit_lm_hash_list": [], + "exploit_ntlm_hash_list": [], + "exploit_ssh_keys": [] + }, + "general": { + "keep_tunnel_open_time": 1, + "monkey_dir_name": "monkey_dir", + "singleton_mutex_name": "{2384ec59-0df8-4ab9-918c-843740924a28}" + }, + "kill_file": { + "kill_file_path_linux": "/var/run/monkey.not", + "kill_file_path_windows": "%windir%\\monkey.not" + }, + "logging": { + "dropper_log_path_linux": "/tmp/user-1562", + "dropper_log_path_windows": "%temp%\\~df1562.tmp", + "monkey_log_path_linux": "/tmp/user-1563", + "monkey_log_path_windows": "%temp%\\~df1563.tmp", + "send_log_to_server": true + } + }, + "monkey": { + "behaviour": { + "PBA_linux_filename": "", + "PBA_windows_filename": "", + "custom_PBA_linux_cmd": "", + "custom_PBA_windows_cmd": "", + "self_delete_in_cleanup": true, + "serialize_config": false, + "use_file_logging": true + }, + "general": { + "alive": true, + "post_breach_actions": [] + }, + "life_cycle": { + "max_iterations": 1, + "retry_failed_explotation": true, + "timeout_between_iterations": 100, + "victims_max_exploit": 7, + "victims_max_find": 30 + }, + "system_info": { + "collect_system_info": true, + "extract_azure_creds": true, + "should_use_mimikatz": true + } + }, + "network": { + "ping_scanner": { + "ping_scan_timeout": 1000 + }, + "tcp_scanner": { + "HTTP_PORTS": [ + 80, + 8080, + 443, + 8008, + 7001 + ], + "tcp_scan_get_banner": true, + "tcp_scan_interval": 0, + "tcp_scan_timeout": 3000, + "tcp_target_ports": [ + 22, + 2222, + 445, + 135, + 3389, + 80, + 8080, + 443, + 8008, + 3306, + 9200, + 7001 + ] + } + } +} diff --git a/envs/monkey_zoo/blackbox/island_configs/HADOOP.conf b/envs/monkey_zoo/blackbox/island_configs/HADOOP.conf new file mode 100644 index 000000000..0b897080b --- /dev/null +++ b/envs/monkey_zoo/blackbox/island_configs/HADOOP.conf @@ -0,0 +1,186 @@ +{ + "basic": { + "credentials": { + "exploit_password_list": [ + "Password1!", + "1234", + "password", + "12345678" + ], + "exploit_user_list": [ + "Administrator", + "root", + "user" + ] + }, + "general": { + "should_exploit": true + } + }, + "basic_network": { + "general": { + "blocked_ips": [], + "depth": 2, + "local_network_scan": false, + "subnet_scan_list": [ + "10.2.2.3", + "10.2.2.2" + ] + }, + "network_analysis": { + "inaccessible_subnets": [] + } + }, + "cnc": { + "servers": { + "command_servers": [ + "10.2.2.251:5000" + ], + "current_server": "10.2.2.251:5000", + "internet_services": [ + "monkey.guardicore.com", + "www.google.com" + ] + } + }, + "exploits": { + "general": { + "exploiter_classes": [ + "HadoopExploiter" + ], + "skip_exploit_if_file_exist": false + }, + "ms08_067": { + "ms08_067_exploit_attempts": 5, + "remote_user_pass": "Password1!", + "user_to_add": "Monkey_IUSER_SUPPORT" + }, + "rdp_grinder": { + "rdp_use_vbs_download": true + }, + "sambacry": { + "sambacry_folder_paths_to_guess": [ + "/", + "/mnt", + "/tmp", + "/storage", + "/export", + "/share", + "/shares", + "/home" + ], + "sambacry_shares_not_to_check": [ + "IPC$", + "print$" + ], + "sambacry_trigger_timeout": 5 + }, + "smb_service": { + "smb_download_timeout": 300, + "smb_service_name": "InfectionMonkey" + } + }, + "internal": { + "classes": { + "finger_classes": [ + "SMBFinger", + "SSHFinger", + "PingScanner", + "HTTPFinger", + "MySQLFinger", + "MSSQLFinger", + "ElasticFinger" + ] + }, + "dropper": { + "dropper_date_reference_path_linux": "/bin/sh", + "dropper_date_reference_path_windows": "%windir%\\system32\\kernel32.dll", + "dropper_set_date": true, + "dropper_target_path_linux": "/tmp/monkey", + "dropper_target_path_win_32": "C:\\Windows\\temp\\monkey32.exe", + "dropper_target_path_win_64": "C:\\Windows\\temp\\monkey64.exe", + "dropper_try_move_first": true + }, + "exploits": { + "exploit_lm_hash_list": [], + "exploit_ntlm_hash_list": [ + "e1c0dc690821c13b10a41dccfc72e43a" + ], + "exploit_ssh_keys": [] + }, + "general": { + "keep_tunnel_open_time": 1, + "monkey_dir_name": "monkey_dir", + "singleton_mutex_name": "{2384ec59-0df8-4ab9-918c-843740924a28}" + }, + "kill_file": { + "kill_file_path_linux": "/var/run/monkey.not", + "kill_file_path_windows": "%windir%\\monkey.not" + }, + "logging": { + "dropper_log_path_linux": "/tmp/user-1562", + "dropper_log_path_windows": "%temp%\\~df1562.tmp", + "monkey_log_path_linux": "/tmp/user-1563", + "monkey_log_path_windows": "%temp%\\~df1563.tmp", + "send_log_to_server": true + } + }, + "monkey": { + "behaviour": { + "PBA_linux_filename": "", + "PBA_windows_filename": "", + "custom_PBA_linux_cmd": "", + "custom_PBA_windows_cmd": "", + "self_delete_in_cleanup": true, + "serialize_config": false, + "use_file_logging": true + }, + "general": { + "alive": true, + "post_breach_actions": [] + }, + "life_cycle": { + "max_iterations": 1, + "retry_failed_explotation": true, + "timeout_between_iterations": 100, + "victims_max_exploit": 7, + "victims_max_find": 30 + }, + "system_info": { + "collect_system_info": true, + "extract_azure_creds": true, + "should_use_mimikatz": true + } + }, + "network": { + "ping_scanner": { + "ping_scan_timeout": 1000 + }, + "tcp_scanner": { + "HTTP_PORTS": [ + 80, + 8080, + 443, + 8008, + 7001 + ], + "tcp_scan_get_banner": true, + "tcp_scan_interval": 0, + "tcp_scan_timeout": 3000, + "tcp_target_ports": [ + 22, + 2222, + 445, + 135, + 3389, + 80, + 8080, + 443, + 8008, + 3306, + 9200, + 7001 + ] + } + } +} diff --git a/envs/monkey_zoo/blackbox/island_configs/MSSQL.conf b/envs/monkey_zoo/blackbox/island_configs/MSSQL.conf new file mode 100644 index 000000000..dc3332ed6 --- /dev/null +++ b/envs/monkey_zoo/blackbox/island_configs/MSSQL.conf @@ -0,0 +1,183 @@ +{ + "basic": { + "credentials": { + "exploit_password_list": [ + "Password1!", + "Xk8VDTsC", + "password", + "12345678" + ], + "exploit_user_list": [ + "Administrator", + "m0nk3y", + "user" + ] + }, + "general": { + "should_exploit": true + } + }, + "basic_network": { + "general": { + "blocked_ips": [], + "depth": 2, + "local_network_scan": false, + "subnet_scan_list": [ + "10.2.2.16" + ] + }, + "network_analysis": { + "inaccessible_subnets": [] + } + }, + "cnc": { + "servers": { + "command_servers": [ + "10.2.2.251:5000" + ], + "current_server": "10.2.2.251:5000", + "internet_services": [ + "monkey.guardicore.com", + "www.google.com" + ] + } + }, + "exploits": { + "general": { + "exploiter_classes": [ + "MSSQLExploiter" + ], + "skip_exploit_if_file_exist": false + }, + "ms08_067": { + "ms08_067_exploit_attempts": 5, + "remote_user_pass": "Password1!", + "user_to_add": "Monkey_IUSER_SUPPORT" + }, + "rdp_grinder": { + "rdp_use_vbs_download": true + }, + "sambacry": { + "sambacry_folder_paths_to_guess": [ + "/", + "/mnt", + "/tmp", + "/storage", + "/export", + "/share", + "/shares", + "/home" + ], + "sambacry_shares_not_to_check": [ + "IPC$", + "print$" + ], + "sambacry_trigger_timeout": 5 + }, + "smb_service": { + "smb_download_timeout": 300, + "smb_service_name": "InfectionMonkey" + } + }, + "internal": { + "classes": { + "finger_classes": [ + "SMBFinger", + "SSHFinger", + "PingScanner", + "HTTPFinger", + "MySQLFinger", + "MSSQLFinger", + "ElasticFinger" + ] + }, + "dropper": { + "dropper_date_reference_path_linux": "/bin/sh", + "dropper_date_reference_path_windows": "%windir%\\system32\\kernel32.dll", + "dropper_set_date": true, + "dropper_target_path_linux": "/tmp/monkey", + "dropper_target_path_win_32": "C:\\Windows\\temp\\monkey32.exe", + "dropper_target_path_win_64": "C:\\Windows\\temp\\monkey64.exe", + "dropper_try_move_first": true + }, + "exploits": { + "exploit_lm_hash_list": [], + "exploit_ntlm_hash_list": [], + "exploit_ssh_keys": [] + }, + "general": { + "keep_tunnel_open_time": 1, + "monkey_dir_name": "monkey_dir", + "singleton_mutex_name": "{2384ec59-0df8-4ab9-918c-843740924a28}" + }, + "kill_file": { + "kill_file_path_linux": "/var/run/monkey.not", + "kill_file_path_windows": "%windir%\\monkey.not" + }, + "logging": { + "dropper_log_path_linux": "/tmp/user-1562", + "dropper_log_path_windows": "%temp%\\~df1562.tmp", + "monkey_log_path_linux": "/tmp/user-1563", + "monkey_log_path_windows": "%temp%\\~df1563.tmp", + "send_log_to_server": true + } + }, + "monkey": { + "behaviour": { + "PBA_linux_filename": "", + "PBA_windows_filename": "", + "custom_PBA_linux_cmd": "", + "custom_PBA_windows_cmd": "", + "self_delete_in_cleanup": true, + "serialize_config": false, + "use_file_logging": true + }, + "general": { + "alive": true, + "post_breach_actions": [] + }, + "life_cycle": { + "max_iterations": 1, + "retry_failed_explotation": true, + "timeout_between_iterations": 100, + "victims_max_exploit": 7, + "victims_max_find": 30 + }, + "system_info": { + "collect_system_info": true, + "extract_azure_creds": true, + "should_use_mimikatz": true + } + }, + "network": { + "ping_scanner": { + "ping_scan_timeout": 1000 + }, + "tcp_scanner": { + "HTTP_PORTS": [ + 80, + 8080, + 443, + 8008, + 7001 + ], + "tcp_scan_get_banner": true, + "tcp_scan_interval": 0, + "tcp_scan_timeout": 3000, + "tcp_target_ports": [ + 22, + 2222, + 445, + 135, + 3389, + 80, + 8080, + 443, + 8008, + 3306, + 9200, + 7001 + ] + } + } +} diff --git a/envs/monkey_zoo/blackbox/island_configs/SHELLSHOCK.conf b/envs/monkey_zoo/blackbox/island_configs/SHELLSHOCK.conf new file mode 100644 index 000000000..83414774b --- /dev/null +++ b/envs/monkey_zoo/blackbox/island_configs/SHELLSHOCK.conf @@ -0,0 +1,183 @@ +{ + "basic": { + "credentials": { + "exploit_password_list": [ + "Password1!", + "1234", + "password", + "12345678" + ], + "exploit_user_list": [ + "Administrator", + "root", + "user" + ] + }, + "general": { + "should_exploit": true + } + }, + "basic_network": { + "general": { + "blocked_ips": [], + "depth": 2, + "local_network_scan": false, + "subnet_scan_list": [ + "10.2.2.8" + ] + }, + "network_analysis": { + "inaccessible_subnets": [] + } + }, + "cnc": { + "servers": { + "command_servers": [ + "10.2.2.251:5000" + ], + "current_server": "10.2.2.251:5000", + "internet_services": [ + "monkey.guardicore.com", + "www.google.com" + ] + } + }, + "exploits": { + "general": { + "exploiter_classes": [ + "ShellShockExploiter" + ], + "skip_exploit_if_file_exist": false + }, + "ms08_067": { + "ms08_067_exploit_attempts": 5, + "remote_user_pass": "Password1!", + "user_to_add": "Monkey_IUSER_SUPPORT" + }, + "rdp_grinder": { + "rdp_use_vbs_download": true + }, + "sambacry": { + "sambacry_folder_paths_to_guess": [ + "/", + "/mnt", + "/tmp", + "/storage", + "/export", + "/share", + "/shares", + "/home" + ], + "sambacry_shares_not_to_check": [ + "IPC$", + "print$" + ], + "sambacry_trigger_timeout": 5 + }, + "smb_service": { + "smb_download_timeout": 300, + "smb_service_name": "InfectionMonkey" + } + }, + "internal": { + "classes": { + "finger_classes": [ + "SMBFinger", + "SSHFinger", + "PingScanner", + "HTTPFinger", + "MySQLFinger", + "MSSQLFinger", + "ElasticFinger" + ] + }, + "dropper": { + "dropper_date_reference_path_linux": "/bin/sh", + "dropper_date_reference_path_windows": "%windir%\\system32\\kernel32.dll", + "dropper_set_date": true, + "dropper_target_path_linux": "/tmp/monkey", + "dropper_target_path_win_32": "C:\\Windows\\temp\\monkey32.exe", + "dropper_target_path_win_64": "C:\\Windows\\temp\\monkey64.exe", + "dropper_try_move_first": true + }, + "exploits": { + "exploit_lm_hash_list": [], + "exploit_ntlm_hash_list": [], + "exploit_ssh_keys": [] + }, + "general": { + "keep_tunnel_open_time": 1, + "monkey_dir_name": "monkey_dir", + "singleton_mutex_name": "{2384ec59-0df8-4ab9-918c-843740924a28}" + }, + "kill_file": { + "kill_file_path_linux": "/var/run/monkey.not", + "kill_file_path_windows": "%windir%\\monkey.not" + }, + "logging": { + "dropper_log_path_linux": "/tmp/user-1562", + "dropper_log_path_windows": "%temp%\\~df1562.tmp", + "monkey_log_path_linux": "/tmp/user-1563", + "monkey_log_path_windows": "%temp%\\~df1563.tmp", + "send_log_to_server": true + } + }, + "monkey": { + "behaviour": { + "PBA_linux_filename": "", + "PBA_windows_filename": "", + "custom_PBA_linux_cmd": "", + "custom_PBA_windows_cmd": "", + "self_delete_in_cleanup": true, + "serialize_config": false, + "use_file_logging": true + }, + "general": { + "alive": true, + "post_breach_actions": [] + }, + "life_cycle": { + "max_iterations": 1, + "retry_failed_explotation": true, + "timeout_between_iterations": 100, + "victims_max_exploit": 7, + "victims_max_find": 30 + }, + "system_info": { + "collect_system_info": true, + "extract_azure_creds": true, + "should_use_mimikatz": true + } + }, + "network": { + "ping_scanner": { + "ping_scan_timeout": 1000 + }, + "tcp_scanner": { + "HTTP_PORTS": [ + 80, + 8080, + 443, + 8008, + 7001 + ], + "tcp_scan_get_banner": true, + "tcp_scan_interval": 0, + "tcp_scan_timeout": 3000, + "tcp_target_ports": [ + 22, + 2222, + 445, + 135, + 3389, + 80, + 8080, + 443, + 8008, + 3306, + 9200, + 7001 + ] + } + } +} diff --git a/envs/monkey_zoo/blackbox/island_configs/SMB_MIMIKATZ.conf b/envs/monkey_zoo/blackbox/island_configs/SMB_MIMIKATZ.conf new file mode 100644 index 000000000..e2a8a5596 --- /dev/null +++ b/envs/monkey_zoo/blackbox/island_configs/SMB_MIMIKATZ.conf @@ -0,0 +1,182 @@ +{ + "basic": { + "credentials": { + "exploit_password_list": [ + "Password1!", + "Ivrrw5zEzs" + ], + "exploit_user_list": [ + "Administrator", + "m0nk3y", + "user" + ] + }, + "general": { + "should_exploit": true + } + }, + "basic_network": { + "general": { + "blocked_ips": [], + "depth": 2, + "local_network_scan": false, + "subnet_scan_list": [ + "10.2.2.14", + "10.2.2.15" + ] + }, + "network_analysis": { + "inaccessible_subnets": [] + } + }, + "cnc": { + "servers": { + "command_servers": [ + "10.2.2.251:5000" + ], + "current_server": "10.2.2.251:5000", + "internet_services": [ + "monkey.guardicore.com", + "www.google.com" + ] + } + }, + "exploits": { + "general": { + "exploiter_classes": [ + "SmbExploiter" + ], + "skip_exploit_if_file_exist": false + }, + "ms08_067": { + "ms08_067_exploit_attempts": 5, + "remote_user_pass": "Password1!", + "user_to_add": "Monkey_IUSER_SUPPORT" + }, + "rdp_grinder": { + "rdp_use_vbs_download": true + }, + "sambacry": { + "sambacry_folder_paths_to_guess": [ + "/", + "/mnt", + "/tmp", + "/storage", + "/export", + "/share", + "/shares", + "/home" + ], + "sambacry_shares_not_to_check": [ + "IPC$", + "print$" + ], + "sambacry_trigger_timeout": 5 + }, + "smb_service": { + "smb_download_timeout": 300, + "smb_service_name": "InfectionMonkey" + } + }, + "internal": { + "classes": { + "finger_classes": [ + "SMBFinger", + "SSHFinger", + "PingScanner", + "HTTPFinger", + "MySQLFinger", + "MSSQLFinger", + "ElasticFinger" + ] + }, + "dropper": { + "dropper_date_reference_path_linux": "/bin/sh", + "dropper_date_reference_path_windows": "%windir%\\system32\\kernel32.dll", + "dropper_set_date": true, + "dropper_target_path_linux": "/tmp/monkey", + "dropper_target_path_win_32": "C:\\Windows\\temp\\monkey32.exe", + "dropper_target_path_win_64": "C:\\Windows\\temp\\monkey64.exe", + "dropper_try_move_first": true + }, + "exploits": { + "exploit_lm_hash_list": [], + "exploit_ntlm_hash_list": [], + "exploit_ssh_keys": [] + }, + "general": { + "keep_tunnel_open_time": 1, + "monkey_dir_name": "monkey_dir", + "singleton_mutex_name": "{2384ec59-0df8-4ab9-918c-843740924a28}" + }, + "kill_file": { + "kill_file_path_linux": "/var/run/monkey.not", + "kill_file_path_windows": "%windir%\\monkey.not" + }, + "logging": { + "dropper_log_path_linux": "/tmp/user-1562", + "dropper_log_path_windows": "%temp%\\~df1562.tmp", + "monkey_log_path_linux": "/tmp/user-1563", + "monkey_log_path_windows": "%temp%\\~df1563.tmp", + "send_log_to_server": true + } + }, + "monkey": { + "behaviour": { + "PBA_linux_filename": "", + "PBA_windows_filename": "", + "custom_PBA_linux_cmd": "", + "custom_PBA_windows_cmd": "", + "self_delete_in_cleanup": true, + "serialize_config": false, + "use_file_logging": true + }, + "general": { + "alive": true, + "post_breach_actions": [] + }, + "life_cycle": { + "max_iterations": 1, + "retry_failed_explotation": true, + "timeout_between_iterations": 100, + "victims_max_exploit": 7, + "victims_max_find": 30 + }, + "system_info": { + "collect_system_info": true, + "extract_azure_creds": true, + "should_use_mimikatz": true + } + }, + "network": { + "ping_scanner": { + "ping_scan_timeout": 1000 + }, + "tcp_scanner": { + "HTTP_PORTS": [ + 80, + 8080, + 443, + 8008, + 7001 + ], + "tcp_scan_get_banner": true, + "tcp_scan_interval": 0, + "tcp_scan_timeout": 3000, + "tcp_target_ports": [ + 22, + 2222, + 445, + 135, + 3389, + 80, + 8080, + 443, + 8008, + 3306, + 9200, + 7001 + ] + } + } +} diff --git a/envs/monkey_zoo/blackbox/island_configs/SMB_PTH.conf b/envs/monkey_zoo/blackbox/island_configs/SMB_PTH.conf new file mode 100644 index 000000000..d17e283c8 --- /dev/null +++ b/envs/monkey_zoo/blackbox/island_configs/SMB_PTH.conf @@ -0,0 +1,180 @@ +{ + "basic": { + "credentials": { + "exploit_password_list": [ + "Password1!" + ], + "exploit_user_list": [ + "Administrator", + "m0nk3y", + "user" + ] + }, + "general": { + "should_exploit": true + } + }, + "basic_network": { + "general": { + "blocked_ips": [], + "depth": 2, + "local_network_scan": false, + "subnet_scan_list": [ + "10.2.2.15" + ] + }, + "network_analysis": { + "inaccessible_subnets": [] + } + }, + "cnc": { + "servers": { + "command_servers": [ + "10.2.2.251:5000" + ], + "current_server": "10.2.2.251:5000", + "internet_services": [ + "monkey.guardicore.com", + "www.google.com" + ] + } + }, + "exploits": { + "general": { + "exploiter_classes": [ + "SmbExploiter" + ], + "skip_exploit_if_file_exist": false + }, + "ms08_067": { + "ms08_067_exploit_attempts": 5, + "remote_user_pass": "Password1!", + "user_to_add": "Monkey_IUSER_SUPPORT" + }, + "rdp_grinder": { + "rdp_use_vbs_download": true + }, + "sambacry": { + "sambacry_folder_paths_to_guess": [ + "/", + "/mnt", + "/tmp", + "/storage", + "/export", + "/share", + "/shares", + "/home" + ], + "sambacry_shares_not_to_check": [ + "IPC$", + "print$" + ], + "sambacry_trigger_timeout": 5 + }, + "smb_service": { + "smb_download_timeout": 300, + "smb_service_name": "InfectionMonkey" + } + }, + "internal": { + "classes": { + "finger_classes": [ + "SMBFinger", + "SSHFinger", + "PingScanner", + "HTTPFinger", + "MySQLFinger", + "MSSQLFinger", + "ElasticFinger" + ] + }, + "dropper": { + "dropper_date_reference_path_linux": "/bin/sh", + "dropper_date_reference_path_windows": "%windir%\\system32\\kernel32.dll", + "dropper_set_date": true, + "dropper_target_path_linux": "/tmp/monkey", + "dropper_target_path_win_32": "C:\\Windows\\temp\\monkey32.exe", + "dropper_target_path_win_64": "C:\\Windows\\temp\\monkey64.exe", + "dropper_try_move_first": true + }, + "exploits": { + "exploit_lm_hash_list": [], + "exploit_ntlm_hash_list": [ "f7e457346f7743daece17258667c936d" ], + "exploit_ssh_keys": [] + }, + "general": { + "keep_tunnel_open_time": 1, + "monkey_dir_name": "monkey_dir", + "singleton_mutex_name": "{2384ec59-0df8-4ab9-918c-843740924a28}" + }, + "kill_file": { + "kill_file_path_linux": "/var/run/monkey.not", + "kill_file_path_windows": "%windir%\\monkey.not" + }, + "logging": { + "dropper_log_path_linux": "/tmp/user-1562", + "dropper_log_path_windows": "%temp%\\~df1562.tmp", + "monkey_log_path_linux": "/tmp/user-1563", + "monkey_log_path_windows": "%temp%\\~df1563.tmp", + "send_log_to_server": true + } + }, + "monkey": { + "behaviour": { + "PBA_linux_filename": "", + "PBA_windows_filename": "", + "custom_PBA_linux_cmd": "", + "custom_PBA_windows_cmd": "", + "self_delete_in_cleanup": true, + "serialize_config": false, + "use_file_logging": true + }, + "general": { + "alive": true, + "post_breach_actions": [] + }, + "life_cycle": { + "max_iterations": 1, + "retry_failed_explotation": true, + "timeout_between_iterations": 100, + "victims_max_exploit": 7, + "victims_max_find": 30 + }, + "system_info": { + "collect_system_info": true, + "extract_azure_creds": true, + "should_use_mimikatz": true + } + }, + "network": { + "ping_scanner": { + "ping_scan_timeout": 1000 + }, + "tcp_scanner": { + "HTTP_PORTS": [ + 80, + 8080, + 443, + 8008, + 7001 + ], + "tcp_scan_get_banner": true, + "tcp_scan_interval": 0, + "tcp_scan_timeout": 3000, + "tcp_target_ports": [ + 22, + 2222, + 445, + 135, + 3389, + 80, + 8080, + 443, + 8008, + 3306, + 9200, + 7001 + ] + } + } +} diff --git a/envs/monkey_zoo/blackbox/island_configs/SSH.conf b/envs/monkey_zoo/blackbox/island_configs/SSH.conf new file mode 100644 index 000000000..ebb1def8b --- /dev/null +++ b/envs/monkey_zoo/blackbox/island_configs/SSH.conf @@ -0,0 +1,192 @@ +{ + "basic": { + "credentials": { + "exploit_password_list": [ + "Password1!", + "12345678", + "^NgDvY59~8" + ], + "exploit_user_list": [ + "Administrator", + "m0nk3y", + "user" + ] + }, + "general": { + "should_exploit": true + } + }, + "basic_network": { + "general": { + "blocked_ips": [], + "depth": 2, + "local_network_scan": false, + "subnet_scan_list": [ + "10.2.2.11", + "10.2.2.12" + ] + }, + "network_analysis": { + "inaccessible_subnets": [] + } + }, + "cnc": { + "servers": { + "command_servers": [ + "10.2.2.251:5000" + ], + "current_server": "10.2.2.251:5000", + "internet_services": [ + "monkey.guardicore.com", + "www.google.com" + ] + } + }, + "exploits": { + "general": { + "exploiter_classes": [ + "SmbExploiter", + "WmiExploiter", + "SSHExploiter", + "ShellShockExploiter", + "SambaCryExploiter", + "ElasticGroovyExploiter", + "Struts2Exploiter", + "WebLogicExploiter", + "HadoopExploiter", + "VSFTPDExploiter" + ], + "skip_exploit_if_file_exist": false + }, + "ms08_067": { + "ms08_067_exploit_attempts": 5, + "remote_user_pass": "Password1!", + "user_to_add": "Monkey_IUSER_SUPPORT" + }, + "rdp_grinder": { + "rdp_use_vbs_download": true + }, + "sambacry": { + "sambacry_folder_paths_to_guess": [ + "/", + "/mnt", + "/tmp", + "/storage", + "/export", + "/share", + "/shares", + "/home" + ], + "sambacry_shares_not_to_check": [ + "IPC$", + "print$" + ], + "sambacry_trigger_timeout": 5 + }, + "smb_service": { + "smb_download_timeout": 300, + "smb_service_name": "InfectionMonkey" + } + }, + "internal": { + "classes": { + "finger_classes": [ + "SMBFinger", + "SSHFinger", + "PingScanner", + "HTTPFinger", + "MySQLFinger", + "MSSQLFinger", + "ElasticFinger" + ] + }, + "dropper": { + "dropper_date_reference_path_linux": "/bin/sh", + "dropper_date_reference_path_windows": "%windir%\\system32\\kernel32.dll", + "dropper_set_date": true, + "dropper_target_path_linux": "/tmp/monkey", + "dropper_target_path_win_32": "C:\\Windows\\temp\\monkey32.exe", + "dropper_target_path_win_64": "C:\\Windows\\temp\\monkey64.exe", + "dropper_try_move_first": true + }, + "exploits": { + "exploit_lm_hash_list": [], + "exploit_ntlm_hash_list": [], + "exploit_ssh_keys": [] + }, + "general": { + "keep_tunnel_open_time": 1, + "monkey_dir_name": "monkey_dir", + "singleton_mutex_name": "{2384ec59-0df8-4ab9-918c-843740924a28}" + }, + "kill_file": { + "kill_file_path_linux": "/var/run/monkey.not", + "kill_file_path_windows": "%windir%\\monkey.not" + }, + "logging": { + "dropper_log_path_linux": "/tmp/user-1562", + "dropper_log_path_windows": "%temp%\\~df1562.tmp", + "monkey_log_path_linux": "/tmp/user-1563", + "monkey_log_path_windows": "%temp%\\~df1563.tmp", + "send_log_to_server": true + } + }, + "monkey": { + "behaviour": { + "PBA_linux_filename": "", + "PBA_windows_filename": "", + "custom_PBA_linux_cmd": "", + "custom_PBA_windows_cmd": "", + "self_delete_in_cleanup": true, + "serialize_config": false, + "use_file_logging": true + }, + "general": { + "alive": true, + "post_breach_actions": [] + }, + "life_cycle": { + "max_iterations": 1, + "retry_failed_explotation": true, + "timeout_between_iterations": 100, + "victims_max_exploit": 7, + "victims_max_find": 30 + }, + "system_info": { + "collect_system_info": true, + "extract_azure_creds": true, + "should_use_mimikatz": true + } + }, + "network": { + "ping_scanner": { + "ping_scan_timeout": 1000 + }, + "tcp_scanner": { + "HTTP_PORTS": [ + 80, + 8080, + 443, + 8008, + 7001 + ], + "tcp_scan_get_banner": true, + "tcp_scan_interval": 0, + "tcp_scan_timeout": 3000, + "tcp_target_ports": [ + 22, + 2222, + 445, + 135, + 3389, + 80, + 8080, + 443, + 8008, + 3306, + 9200, + 7001 + ] + } + } +} diff --git a/envs/monkey_zoo/blackbox/island_configs/STRUTS2.conf b/envs/monkey_zoo/blackbox/island_configs/STRUTS2.conf new file mode 100644 index 000000000..ea53f3b0b --- /dev/null +++ b/envs/monkey_zoo/blackbox/island_configs/STRUTS2.conf @@ -0,0 +1,193 @@ +{ + "basic": { + "credentials": { + "exploit_password_list": [ + "Password1!", + "1234", + "password", + "12345678" + ], + "exploit_user_list": [ + "Administrator", + "root", + "user" + ] + }, + "general": { + "should_exploit": true + } + }, + "basic_network": { + "general": { + "blocked_ips": [], + "depth": 2, + "local_network_scan": false, + "subnet_scan_list": [ + "10.2.2.23", + "10.2.2.24" + ] + }, + "network_analysis": { + "inaccessible_subnets": [] + } + }, + "cnc": { + "servers": { + "command_servers": [ + "10.2.2.251:5000" + ], + "current_server": "10.2.2.251:5000", + "internet_services": [ + "monkey.guardicore.com", + "www.google.com" + ] + } + }, + "exploits": { + "general": { + "exploiter_classes": [ + "SmbExploiter", + "WmiExploiter", + "SSHExploiter", + "ShellShockExploiter", + "SambaCryExploiter", + "ElasticGroovyExploiter", + "Struts2Exploiter", + "WebLogicExploiter", + "HadoopExploiter", + "VSFTPDExploiter" + ], + "skip_exploit_if_file_exist": false + }, + "ms08_067": { + "ms08_067_exploit_attempts": 5, + "remote_user_pass": "Password1!", + "user_to_add": "Monkey_IUSER_SUPPORT" + }, + "rdp_grinder": { + "rdp_use_vbs_download": true + }, + "sambacry": { + "sambacry_folder_paths_to_guess": [ + "/", + "/mnt", + "/tmp", + "/storage", + "/export", + "/share", + "/shares", + "/home" + ], + "sambacry_shares_not_to_check": [ + "IPC$", + "print$" + ], + "sambacry_trigger_timeout": 5 + }, + "smb_service": { + "smb_download_timeout": 300, + "smb_service_name": "InfectionMonkey" + } + }, + "internal": { + "classes": { + "finger_classes": [ + "SMBFinger", + "SSHFinger", + "PingScanner", + "HTTPFinger", + "MySQLFinger", + "MSSQLFinger", + "ElasticFinger" + ] + }, + "dropper": { + "dropper_date_reference_path_linux": "/bin/sh", + "dropper_date_reference_path_windows": "%windir%\\system32\\kernel32.dll", + "dropper_set_date": true, + "dropper_target_path_linux": "/tmp/monkey", + "dropper_target_path_win_32": "C:\\Windows\\temp\\monkey32.exe", + "dropper_target_path_win_64": "C:\\Windows\\temp\\monkey64.exe", + "dropper_try_move_first": true + }, + "exploits": { + "exploit_lm_hash_list": [], + "exploit_ntlm_hash_list": [], + "exploit_ssh_keys": [] + }, + "general": { + "keep_tunnel_open_time": 1, + "monkey_dir_name": "monkey_dir", + "singleton_mutex_name": "{2384ec59-0df8-4ab9-918c-843740924a28}" + }, + "kill_file": { + "kill_file_path_linux": "/var/run/monkey.not", + "kill_file_path_windows": "%windir%\\monkey.not" + }, + "logging": { + "dropper_log_path_linux": "/tmp/user-1562", + "dropper_log_path_windows": "%temp%\\~df1562.tmp", + "monkey_log_path_linux": "/tmp/user-1563", + "monkey_log_path_windows": "%temp%\\~df1563.tmp", + "send_log_to_server": true + } + }, + "monkey": { + "behaviour": { + "PBA_linux_filename": "", + "PBA_windows_filename": "", + "custom_PBA_linux_cmd": "", + "custom_PBA_windows_cmd": "", + "self_delete_in_cleanup": true, + "serialize_config": false, + "use_file_logging": true + }, + "general": { + "alive": true, + "post_breach_actions": [] + }, + "life_cycle": { + "max_iterations": 1, + "retry_failed_explotation": true, + "timeout_between_iterations": 100, + "victims_max_exploit": 7, + "victims_max_find": 30 + }, + "system_info": { + "collect_system_info": true, + "extract_azure_creds": true, + "should_use_mimikatz": true + } + }, + "network": { + "ping_scanner": { + "ping_scan_timeout": 1000 + }, + "tcp_scanner": { + "HTTP_PORTS": [ + 80, + 8080, + 443, + 8008, + 7001 + ], + "tcp_scan_get_banner": true, + "tcp_scan_interval": 0, + "tcp_scan_timeout": 3000, + "tcp_target_ports": [ + 22, + 2222, + 445, + 135, + 3389, + 80, + 8080, + 443, + 8008, + 3306, + 9200, + 7001 + ] + } + } +} diff --git a/envs/monkey_zoo/blackbox/island_configs/TUNNELING.conf b/envs/monkey_zoo/blackbox/island_configs/TUNNELING.conf new file mode 100644 index 000000000..306a683eb --- /dev/null +++ b/envs/monkey_zoo/blackbox/island_configs/TUNNELING.conf @@ -0,0 +1,199 @@ +{ + "basic": { + "credentials": { + "exploit_password_list": [ + "Password1!", + "3Q=(Ge(+&w]*", + "`))jU7L(w}", + "12345678", + "another_one", + "and_another_one", + "one_more" + ], + "exploit_user_list": [ + "Administrator", + "rand", + "rand2", + "m0nk3y", + "user" + ] + }, + "general": { + "should_exploit": true + } + }, + "basic_network": { + "general": { + "blocked_ips": [], + "depth": 3, + "local_network_scan": false, + "subnet_scan_list": [ + "10.2.2.9", + "10.2.1.10", + "10.2.0.11" + ] + }, + "network_analysis": { + "inaccessible_subnets": [] + } + }, + "cnc": { + "servers": { + "command_servers": [ + "10.2.2.251:5000" + ], + "current_server": "10.2.2.251:5000", + "internet_services": [ + "monkey.guardicore.com", + "www.google.com" + ] + } + }, + "exploits": { + "general": { + "exploiter_classes": [ + "SmbExploiter", + "WmiExploiter", + "SSHExploiter", + "ShellShockExploiter", + "SambaCryExploiter", + "ElasticGroovyExploiter", + "Struts2Exploiter", + "WebLogicExploiter", + "HadoopExploiter", + "VSFTPDExploiter" + ], + "skip_exploit_if_file_exist": false + }, + "ms08_067": { + "ms08_067_exploit_attempts": 5, + "remote_user_pass": "Password1!", + "user_to_add": "Monkey_IUSER_SUPPORT" + }, + "rdp_grinder": { + "rdp_use_vbs_download": true + }, + "sambacry": { + "sambacry_folder_paths_to_guess": [ + "/", + "/mnt", + "/tmp", + "/storage", + "/export", + "/share", + "/shares", + "/home" + ], + "sambacry_shares_not_to_check": [ + "IPC$", + "print$" + ], + "sambacry_trigger_timeout": 5 + }, + "smb_service": { + "smb_download_timeout": 300, + "smb_service_name": "InfectionMonkey" + } + }, + "internal": { + "classes": { + "finger_classes": [ + "SMBFinger", + "SSHFinger", + "PingScanner", + "HTTPFinger", + "MySQLFinger", + "MSSQLFinger", + "ElasticFinger" + ] + }, + "dropper": { + "dropper_date_reference_path_linux": "/bin/sh", + "dropper_date_reference_path_windows": "%windir%\\system32\\kernel32.dll", + "dropper_set_date": true, + "dropper_target_path_linux": "/tmp/monkey", + "dropper_target_path_win_32": "C:\\Windows\\temp\\monkey32.exe", + "dropper_target_path_win_64": "C:\\Windows\\temp\\monkey64.exe", + "dropper_try_move_first": true + }, + "exploits": { + "exploit_lm_hash_list": [], + "exploit_ntlm_hash_list": [], + "exploit_ssh_keys": [] + }, + "general": { + "keep_tunnel_open_time": 60, + "monkey_dir_name": "monkey_dir", + "singleton_mutex_name": "{2384ec59-0df8-4ab9-918c-843740924a28}" + }, + "kill_file": { + "kill_file_path_linux": "/var/run/monkey.not", + "kill_file_path_windows": "%windir%\\monkey.not" + }, + "logging": { + "dropper_log_path_linux": "/tmp/user-1562", + "dropper_log_path_windows": "%temp%\\~df1562.tmp", + "monkey_log_path_linux": "/tmp/user-1563", + "monkey_log_path_windows": "%temp%\\~df1563.tmp", + "send_log_to_server": true + } + }, + "monkey": { + "behaviour": { + "PBA_linux_filename": "", + "PBA_windows_filename": "", + "custom_PBA_linux_cmd": "", + "custom_PBA_windows_cmd": "", + "self_delete_in_cleanup": true, + "serialize_config": false, + "use_file_logging": true + }, + "general": { + "alive": true, + "post_breach_actions": [] + }, + "life_cycle": { + "max_iterations": 1, + "retry_failed_explotation": true, + "timeout_between_iterations": 100, + "victims_max_exploit": 7, + "victims_max_find": 30 + }, + "system_info": { + "collect_system_info": true, + "extract_azure_creds": true, + "should_use_mimikatz": true + } + }, + "network": { + "ping_scanner": { + "ping_scan_timeout": 1000 + }, + "tcp_scanner": { + "HTTP_PORTS": [ + 80, + 8080, + 443, + 8008, + 7001 + ], + "tcp_scan_get_banner": true, + "tcp_scan_interval": 0, + "tcp_scan_timeout": 3000, + "tcp_target_ports": [ + 22, + 2222, + 445, + 135, + 3389, + 80, + 8080, + 443, + 8008, + 3306, + 9200, + 7001 + ] + } + } +} diff --git a/envs/monkey_zoo/blackbox/island_configs/WEBLOGIC.conf b/envs/monkey_zoo/blackbox/island_configs/WEBLOGIC.conf new file mode 100644 index 000000000..b86b2b566 --- /dev/null +++ b/envs/monkey_zoo/blackbox/island_configs/WEBLOGIC.conf @@ -0,0 +1,184 @@ +{ + "basic": { + "credentials": { + "exploit_password_list": [ + "Password1!", + "1234", + "password", + "12345678" + ], + "exploit_user_list": [ + "Administrator", + "root", + "user" + ] + }, + "general": { + "should_exploit": true + } + }, + "basic_network": { + "general": { + "blocked_ips": [], + "depth": 2, + "local_network_scan": false, + "subnet_scan_list": [ + "10.2.2.18", + "10.2.2.19" + ] + }, + "network_analysis": { + "inaccessible_subnets": [] + } + }, + "cnc": { + "servers": { + "command_servers": [ + "10.2.2.251:5000" + ], + "current_server": "10.2.2.251:5000", + "internet_services": [ + "monkey.guardicore.com", + "www.google.com" + ] + } + }, + "exploits": { + "general": { + "exploiter_classes": [ + "WebLogicExploiter" + ], + "skip_exploit_if_file_exist": false + }, + "ms08_067": { + "ms08_067_exploit_attempts": 5, + "remote_user_pass": "Password1!", + "user_to_add": "Monkey_IUSER_SUPPORT" + }, + "rdp_grinder": { + "rdp_use_vbs_download": true + }, + "sambacry": { + "sambacry_folder_paths_to_guess": [ + "/", + "/mnt", + "/tmp", + "/storage", + "/export", + "/share", + "/shares", + "/home" + ], + "sambacry_shares_not_to_check": [ + "IPC$", + "print$" + ], + "sambacry_trigger_timeout": 5 + }, + "smb_service": { + "smb_download_timeout": 300, + "smb_service_name": "InfectionMonkey" + } + }, + "internal": { + "classes": { + "finger_classes": [ + "SMBFinger", + "SSHFinger", + "PingScanner", + "HTTPFinger", + "MySQLFinger", + "MSSQLFinger", + "ElasticFinger" + ] + }, + "dropper": { + "dropper_date_reference_path_linux": "/bin/sh", + "dropper_date_reference_path_windows": "%windir%\\system32\\kernel32.dll", + "dropper_set_date": true, + "dropper_target_path_linux": "/tmp/monkey", + "dropper_target_path_win_32": "C:\\Windows\\temp\\monkey32.exe", + "dropper_target_path_win_64": "C:\\Windows\\temp\\monkey64.exe", + "dropper_try_move_first": true + }, + "exploits": { + "exploit_lm_hash_list": [], + "exploit_ntlm_hash_list": [], + "exploit_ssh_keys": [] + }, + "general": { + "keep_tunnel_open_time": 1, + "monkey_dir_name": "monkey_dir", + "singleton_mutex_name": "{2384ec59-0df8-4ab9-918c-843740924a28}" + }, + "kill_file": { + "kill_file_path_linux": "/var/run/monkey.not", + "kill_file_path_windows": "%windir%\\monkey.not" + }, + "logging": { + "dropper_log_path_linux": "/tmp/user-1562", + "dropper_log_path_windows": "%temp%\\~df1562.tmp", + "monkey_log_path_linux": "/tmp/user-1563", + "monkey_log_path_windows": "%temp%\\~df1563.tmp", + "send_log_to_server": true + } + }, + "monkey": { + "behaviour": { + "PBA_linux_filename": "", + "PBA_windows_filename": "", + "custom_PBA_linux_cmd": "", + "custom_PBA_windows_cmd": "", + "self_delete_in_cleanup": true, + "serialize_config": false, + "use_file_logging": true + }, + "general": { + "alive": true, + "post_breach_actions": [] + }, + "life_cycle": { + "max_iterations": 1, + "retry_failed_explotation": true, + "timeout_between_iterations": 100, + "victims_max_exploit": 7, + "victims_max_find": 30 + }, + "system_info": { + "collect_system_info": true, + "extract_azure_creds": true, + "should_use_mimikatz": true + } + }, + "network": { + "ping_scanner": { + "ping_scan_timeout": 1000 + }, + "tcp_scanner": { + "HTTP_PORTS": [ + 80, + 8080, + 443, + 8008, + 7001 + ], + "tcp_scan_get_banner": true, + "tcp_scan_interval": 0, + "tcp_scan_timeout": 3000, + "tcp_target_ports": [ + 22, + 2222, + 445, + 135, + 3389, + 80, + 8080, + 443, + 8008, + 3306, + 9200, + 7001 + ] + } + } +} diff --git a/envs/monkey_zoo/blackbox/island_configs/WMI_MIMIKATZ.conf b/envs/monkey_zoo/blackbox/island_configs/WMI_MIMIKATZ.conf new file mode 100644 index 000000000..7b5fb3784 --- /dev/null +++ b/envs/monkey_zoo/blackbox/island_configs/WMI_MIMIKATZ.conf @@ -0,0 +1,190 @@ +{ + "basic": { + "credentials": { + "exploit_password_list": [ + "Password1!", + "Ivrrw5zEzs" + ], + "exploit_user_list": [ + "Administrator", + "m0nk3y", + "user" + ] + }, + "general": { + "should_exploit": true + } + }, + "basic_network": { + "general": { + "blocked_ips": [], + "depth": 2, + "local_network_scan": false, + "subnet_scan_list": [ + "10.2.2.14", + "10.2.2.15" + ] + }, + "network_analysis": { + "inaccessible_subnets": [] + } + }, + "cnc": { + "servers": { + "command_servers": [ + "10.2.2.251:5000" + ], + "current_server": "10.2.2.251:5000", + "internet_services": [ + "monkey.guardicore.com", + "www.google.com" + ] + } + }, + "exploits": { + "general": { + "exploiter_classes": [ + "WmiExploiter", + "SSHExploiter", + "ShellShockExploiter", + "SambaCryExploiter", + "ElasticGroovyExploiter", + "Struts2Exploiter", + "WebLogicExploiter", + "HadoopExploiter", + "VSFTPDExploiter" + ], + "skip_exploit_if_file_exist": false + }, + "ms08_067": { + "ms08_067_exploit_attempts": 5, + "remote_user_pass": "Password1!", + "user_to_add": "Monkey_IUSER_SUPPORT" + }, + "rdp_grinder": { + "rdp_use_vbs_download": true + }, + "sambacry": { + "sambacry_folder_paths_to_guess": [ + "/", + "/mnt", + "/tmp", + "/storage", + "/export", + "/share", + "/shares", + "/home" + ], + "sambacry_shares_not_to_check": [ + "IPC$", + "print$" + ], + "sambacry_trigger_timeout": 5 + }, + "smb_service": { + "smb_download_timeout": 300, + "smb_service_name": "InfectionMonkey" + } + }, + "internal": { + "classes": { + "finger_classes": [ + "SMBFinger", + "SSHFinger", + "PingScanner", + "HTTPFinger", + "MySQLFinger", + "MSSQLFinger", + "ElasticFinger" + ] + }, + "dropper": { + "dropper_date_reference_path_linux": "/bin/sh", + "dropper_date_reference_path_windows": "%windir%\\system32\\kernel32.dll", + "dropper_set_date": true, + "dropper_target_path_linux": "/tmp/monkey", + "dropper_target_path_win_32": "C:\\Windows\\temp\\monkey32.exe", + "dropper_target_path_win_64": "C:\\Windows\\temp\\monkey64.exe", + "dropper_try_move_first": true + }, + "exploits": { + "exploit_lm_hash_list": [], + "exploit_ntlm_hash_list": [], + "exploit_ssh_keys": [] + }, + "general": { + "keep_tunnel_open_time": 1, + "monkey_dir_name": "monkey_dir", + "singleton_mutex_name": "{2384ec59-0df8-4ab9-918c-843740924a28}" + }, + "kill_file": { + "kill_file_path_linux": "/var/run/monkey.not", + "kill_file_path_windows": "%windir%\\monkey.not" + }, + "logging": { + "dropper_log_path_linux": "/tmp/user-1562", + "dropper_log_path_windows": "%temp%\\~df1562.tmp", + "monkey_log_path_linux": "/tmp/user-1563", + "monkey_log_path_windows": "%temp%\\~df1563.tmp", + "send_log_to_server": true + } + }, + "monkey": { + "behaviour": { + "PBA_linux_filename": "", + "PBA_windows_filename": "", + "custom_PBA_linux_cmd": "", + "custom_PBA_windows_cmd": "", + "self_delete_in_cleanup": true, + "serialize_config": false, + "use_file_logging": true + }, + "general": { + "alive": true, + "post_breach_actions": [] + }, + "life_cycle": { + "max_iterations": 1, + "retry_failed_explotation": true, + "timeout_between_iterations": 100, + "victims_max_exploit": 7, + "victims_max_find": 30 + }, + "system_info": { + "collect_system_info": true, + "extract_azure_creds": true, + "should_use_mimikatz": true + } + }, + "network": { + "ping_scanner": { + "ping_scan_timeout": 1000 + }, + "tcp_scanner": { + "HTTP_PORTS": [ + 80, + 8080, + 443, + 8008, + 7001 + ], + "tcp_scan_get_banner": true, + "tcp_scan_interval": 0, + "tcp_scan_timeout": 3000, + "tcp_target_ports": [ + 22, + 2222, + 445, + 135, + 3389, + 80, + 8080, + 443, + 8008, + 3306, + 9200, + 7001 + ] + } + } +} diff --git a/envs/monkey_zoo/blackbox/island_configs/WMI_PTH.conf b/envs/monkey_zoo/blackbox/island_configs/WMI_PTH.conf new file mode 100644 index 000000000..1ac0a6c3d --- /dev/null +++ b/envs/monkey_zoo/blackbox/island_configs/WMI_PTH.conf @@ -0,0 +1,188 @@ +{ + "basic": { + "credentials": { + "exploit_password_list": [ + "Password1!" + ], + "exploit_user_list": [ + "Administrator", + "m0nk3y", + "user" + ] + }, + "general": { + "should_exploit": true + } + }, + "basic_network": { + "general": { + "blocked_ips": [], + "depth": 2, + "local_network_scan": false, + "subnet_scan_list": [ + "10.2.2.15" + ] + }, + "network_analysis": { + "inaccessible_subnets": [] + } + }, + "cnc": { + "servers": { + "command_servers": [ + "10.2.2.251:5000" + ], + "current_server": "10.2.2.251:5000", + "internet_services": [ + "monkey.guardicore.com", + "www.google.com" + ] + } + }, + "exploits": { + "general": { + "exploiter_classes": [ + "WmiExploiter", + "SSHExploiter", + "ShellShockExploiter", + "SambaCryExploiter", + "ElasticGroovyExploiter", + "Struts2Exploiter", + "WebLogicExploiter", + "HadoopExploiter", + "VSFTPDExploiter" + ], + "skip_exploit_if_file_exist": false + }, + "ms08_067": { + "ms08_067_exploit_attempts": 5, + "remote_user_pass": "Password1!", + "user_to_add": "Monkey_IUSER_SUPPORT" + }, + "rdp_grinder": { + "rdp_use_vbs_download": true + }, + "sambacry": { + "sambacry_folder_paths_to_guess": [ + "/", + "/mnt", + "/tmp", + "/storage", + "/export", + "/share", + "/shares", + "/home" + ], + "sambacry_shares_not_to_check": [ + "IPC$", + "print$" + ], + "sambacry_trigger_timeout": 5 + }, + "smb_service": { + "smb_download_timeout": 300, + "smb_service_name": "InfectionMonkey" + } + }, + "internal": { + "classes": { + "finger_classes": [ + "SMBFinger", + "SSHFinger", + "PingScanner", + "HTTPFinger", + "MySQLFinger", + "MSSQLFinger", + "ElasticFinger" + ] + }, + "dropper": { + "dropper_date_reference_path_linux": "/bin/sh", + "dropper_date_reference_path_windows": "%windir%\\system32\\kernel32.dll", + "dropper_set_date": true, + "dropper_target_path_linux": "/tmp/monkey", + "dropper_target_path_win_32": "C:\\Windows\\temp\\monkey32.exe", + "dropper_target_path_win_64": "C:\\Windows\\temp\\monkey64.exe", + "dropper_try_move_first": true + }, + "exploits": { + "exploit_lm_hash_list": [], + "exploit_ntlm_hash_list": [ "f7e457346f7743daece17258667c936d" ], + "exploit_ssh_keys": [] + }, + "general": { + "keep_tunnel_open_time": 1, + "monkey_dir_name": "monkey_dir", + "singleton_mutex_name": "{2384ec59-0df8-4ab9-918c-843740924a28}" + }, + "kill_file": { + "kill_file_path_linux": "/var/run/monkey.not", + "kill_file_path_windows": "%windir%\\monkey.not" + }, + "logging": { + "dropper_log_path_linux": "/tmp/user-1562", + "dropper_log_path_windows": "%temp%\\~df1562.tmp", + "monkey_log_path_linux": "/tmp/user-1563", + "monkey_log_path_windows": "%temp%\\~df1563.tmp", + "send_log_to_server": true + } + }, + "monkey": { + "behaviour": { + "PBA_linux_filename": "", + "PBA_windows_filename": "", + "custom_PBA_linux_cmd": "", + "custom_PBA_windows_cmd": "", + "self_delete_in_cleanup": true, + "serialize_config": false, + "use_file_logging": true + }, + "general": { + "alive": true, + "post_breach_actions": [] + }, + "life_cycle": { + "max_iterations": 1, + "retry_failed_explotation": true, + "timeout_between_iterations": 100, + "victims_max_exploit": 7, + "victims_max_find": 30 + }, + "system_info": { + "collect_system_info": true, + "extract_azure_creds": true, + "should_use_mimikatz": true + } + }, + "network": { + "ping_scanner": { + "ping_scan_timeout": 1000 + }, + "tcp_scanner": { + "HTTP_PORTS": [ + 80, + 8080, + 443, + 8008, + 7001 + ], + "tcp_scan_get_banner": true, + "tcp_scan_interval": 0, + "tcp_scan_timeout": 3000, + "tcp_target_ports": [ + 22, + 2222, + 445, + 135, + 3389, + 80, + 8080, + 443, + 8008, + 3306, + 9200, + 7001 + ] + } + } +} diff --git a/envs/monkey_zoo/blackbox/log_handlers/__init__.py b/envs/monkey_zoo/blackbox/log_handlers/__init__.py new file mode 100644 index 000000000..e69de29bb diff --git a/envs/monkey_zoo/blackbox/log_handlers/monkey_log.py b/envs/monkey_zoo/blackbox/log_handlers/monkey_log.py new file mode 100644 index 000000000..091be570a --- /dev/null +++ b/envs/monkey_zoo/blackbox/log_handlers/monkey_log.py @@ -0,0 +1,38 @@ +import os + +import logging +from bson import ObjectId + +LOGGER = logging.getLogger(__name__) + + +class MonkeyLog(object): + def __init__(self, monkey, log_dir_path): + self.monkey = monkey + self.log_dir_path = log_dir_path + + def download_log(self, island_client): + log = island_client.find_log_in_db({'monkey_id': ObjectId(self.monkey['id'])}) + if not log: + LOGGER.error("Log for monkey {} not found".format(self.monkey['ip_addresses'][0])) + return False + else: + self.write_log_to_file(log) + return True + + def write_log_to_file(self, log): + with open(self.get_log_path_for_monkey(self.monkey), 'w') as log_file: + log_file.write(MonkeyLog.parse_log(log)) + + @staticmethod + def parse_log(log): + log = log.strip('"') + log = log.replace("\\n", "\n ") + return log + + @staticmethod + def get_filename_for_monkey_log(monkey): + return "{}.txt".format(monkey['ip_addresses'][0]) + + def get_log_path_for_monkey(self, monkey): + return os.path.join(self.log_dir_path, MonkeyLog.get_filename_for_monkey_log(monkey)) diff --git a/envs/monkey_zoo/blackbox/log_handlers/monkey_log_parser.py b/envs/monkey_zoo/blackbox/log_handlers/monkey_log_parser.py new file mode 100644 index 000000000..44804a1fd --- /dev/null +++ b/envs/monkey_zoo/blackbox/log_handlers/monkey_log_parser.py @@ -0,0 +1,43 @@ +import logging +import re + +LOGGER = logging.getLogger(__name__) + + +class MonkeyLogParser(object): + + def __init__(self, log_path): + self.log_path = log_path + self.log_contents = self.read_log() + + def read_log(self): + with open(self.log_path, 'r') as log: + return log.read() + + def print_errors(self): + errors = MonkeyLogParser.get_errors(self.log_contents) + if len(errors) > 0: + LOGGER.info("Found {} errors:".format(len(errors))) + for index, error_line in enumerate(errors): + LOGGER.info("Err #{}: {}".format(index, error_line)) + else: + LOGGER.info("No errors!") + + @staticmethod + def get_errors(log_contents): + searcher = re.compile(r"^.*:ERROR].*$", re.MULTILINE) + return searcher.findall(log_contents) + + def print_warnings(self): + warnings = MonkeyLogParser.get_warnings(self.log_contents) + if len(warnings) > 0: + LOGGER.info("Found {} warnings:".format(len(warnings))) + for index, warning_line in enumerate(warnings): + LOGGER.info("Warn #{}: {}".format(index, warning_line)) + else: + LOGGER.info("No warnings!") + + @staticmethod + def get_warnings(log_contents): + searcher = re.compile(r"^.*:WARNING].*$", re.MULTILINE) + return searcher.findall(log_contents) diff --git a/envs/monkey_zoo/blackbox/log_handlers/monkey_logs_downloader.py b/envs/monkey_zoo/blackbox/log_handlers/monkey_logs_downloader.py new file mode 100644 index 000000000..dbed46780 --- /dev/null +++ b/envs/monkey_zoo/blackbox/log_handlers/monkey_logs_downloader.py @@ -0,0 +1,26 @@ +import logging + +from envs.monkey_zoo.blackbox.log_handlers.monkey_log import MonkeyLog + +LOGGER = logging.getLogger(__name__) + + +class MonkeyLogsDownloader(object): + + def __init__(self, island_client, log_dir_path): + self.island_client = island_client + self.log_dir_path = log_dir_path + self.monkey_log_paths = [] + + def download_monkey_logs(self): + LOGGER.info("Downloading each monkey log.") + all_monkeys = self.island_client.get_all_monkeys_from_db() + for monkey in all_monkeys: + downloaded_log_path = self._download_monkey_log(monkey) + if downloaded_log_path: + self.monkey_log_paths.append(downloaded_log_path) + + def _download_monkey_log(self, monkey): + log_handler = MonkeyLog(monkey, self.log_dir_path) + download_successful = log_handler.download_log(self.island_client) + return log_handler.get_log_path_for_monkey(monkey) if download_successful else None diff --git a/envs/monkey_zoo/blackbox/log_handlers/test_logs_handler.py b/envs/monkey_zoo/blackbox/log_handlers/test_logs_handler.py new file mode 100644 index 000000000..b54f773e6 --- /dev/null +++ b/envs/monkey_zoo/blackbox/log_handlers/test_logs_handler.py @@ -0,0 +1,50 @@ +import os +import shutil + +import logging + +from envs.monkey_zoo.blackbox.log_handlers.monkey_log_parser import MonkeyLogParser +from envs.monkey_zoo.blackbox.log_handlers.monkey_logs_downloader import MonkeyLogsDownloader + +LOG_DIR_NAME = 'logs' +LOGGER = logging.getLogger(__name__) + + +class TestLogsHandler(object): + def __init__(self, test_name, island_client, log_dir_path): + self.test_name = test_name + self.island_client = island_client + self.log_dir_path = os.path.join(log_dir_path, self.test_name) + + def parse_test_logs(self): + log_paths = self.download_logs() + if not log_paths: + LOGGER.error("No logs were downloaded. Maybe no monkeys were ran " + "or early exception prevented log download?") + return + TestLogsHandler.parse_logs(log_paths) + + def download_logs(self): + self.try_create_log_dir_for_test() + downloader = MonkeyLogsDownloader(self.island_client, self.log_dir_path) + downloader.download_monkey_logs() + return downloader.monkey_log_paths + + def try_create_log_dir_for_test(self): + try: + os.mkdir(self.log_dir_path) + except Exception as e: + LOGGER.error("Can't create a dir for test logs: {}".format(e)) + + @staticmethod + def delete_log_folder_contents(log_dir_path): + shutil.rmtree(log_dir_path, ignore_errors=True) + os.mkdir(log_dir_path) + + @staticmethod + def parse_logs(log_paths): + for log_path in log_paths: + LOGGER.info("Info from log at {}".format(log_path)) + log_parser = MonkeyLogParser(log_path) + log_parser.print_errors() + log_parser.print_warnings() diff --git a/envs/monkey_zoo/blackbox/pytest.ini b/envs/monkey_zoo/blackbox/pytest.ini new file mode 100644 index 000000000..d8ba6b47a --- /dev/null +++ b/envs/monkey_zoo/blackbox/pytest.ini @@ -0,0 +1,5 @@ +[pytest] +log_cli = 1 +log_cli_level = INFO +log_cli_format = %(asctime)s [%(levelname)s] %(module)s.%(funcName)s.%(lineno)d: %(message)s +log_cli_date_format=%H:%M:%S diff --git a/envs/monkey_zoo/blackbox/requirements.txt b/envs/monkey_zoo/blackbox/requirements.txt new file mode 100644 index 000000000..0e6bd0ea3 --- /dev/null +++ b/envs/monkey_zoo/blackbox/requirements.txt @@ -0,0 +1,2 @@ +pytest +unittest diff --git a/envs/monkey_zoo/blackbox/test_blackbox.py b/envs/monkey_zoo/blackbox/test_blackbox.py new file mode 100644 index 000000000..fc20c8b39 --- /dev/null +++ b/envs/monkey_zoo/blackbox/test_blackbox.py @@ -0,0 +1,110 @@ +import os +import logging + +import pytest +from time import sleep + +from envs.monkey_zoo.blackbox.island_client.monkey_island_client import MonkeyIslandClient +from envs.monkey_zoo.blackbox.analyzers.communication_analyzer import CommunicationAnalyzer +from envs.monkey_zoo.blackbox.island_client.island_config_parser import IslandConfigParser +from envs.monkey_zoo.blackbox.utils import gcp_machine_handlers +from envs.monkey_zoo.blackbox.tests.basic_test import BasicTest +from envs.monkey_zoo.blackbox.log_handlers.test_logs_handler import TestLogsHandler + +DEFAULT_TIMEOUT_SECONDS = 5*60 +MACHINE_BOOTUP_WAIT_SECONDS = 30 +GCP_TEST_MACHINE_LIST = ['sshkeys-11', 'sshkeys-12', 'elastic-4', 'elastic-5', 'haddop-2', 'hadoop-3', 'mssql-16', + 'mimikatz-14', 'mimikatz-15', 'struts2-23', 'struts2-24', 'tunneling-9', 'tunneling-10', + 'tunneling-11', 'weblogic-18', 'weblogic-19', 'shellshock-8'] +LOG_DIR_PATH = "./logs" +LOGGER = logging.getLogger(__name__) + + +@pytest.fixture(autouse=True, scope='session') +def GCPHandler(request): + GCPHandler = gcp_machine_handlers.GCPHandler() + GCPHandler.start_machines(" ".join(GCP_TEST_MACHINE_LIST)) + wait_machine_bootup() + + def fin(): + GCPHandler.stop_machines(" ".join(GCP_TEST_MACHINE_LIST)) + + request.addfinalizer(fin) + + +@pytest.fixture(autouse=True, scope='session') +def delete_logs(): + LOGGER.info("Deleting monkey logs before new tests.") + TestLogsHandler.delete_log_folder_contents(TestMonkeyBlackbox.get_log_dir_path()) + + +def wait_machine_bootup(): + sleep(MACHINE_BOOTUP_WAIT_SECONDS) + + +@pytest.fixture(scope='class') +def island_client(island): + island_client_object = MonkeyIslandClient(island) + island_client_object.reset_env() + yield island_client_object + + +@pytest.mark.usefixtures('island_client') +# noinspection PyUnresolvedReferences +class TestMonkeyBlackbox(object): + + @staticmethod + def run_basic_test(island_client, conf_filename, test_name, timeout_in_seconds=DEFAULT_TIMEOUT_SECONDS): + config_parser = IslandConfigParser(conf_filename) + analyzer = CommunicationAnalyzer(island_client, config_parser.get_ips_of_targets()) + log_handler = TestLogsHandler(test_name, island_client, TestMonkeyBlackbox.get_log_dir_path()) + BasicTest(test_name, + island_client, + config_parser, + [analyzer], + timeout_in_seconds, + log_handler).run() + + @staticmethod + def get_log_dir_path(): + return os.path.abspath(LOG_DIR_PATH) + + def test_server_online(self, island_client): + assert island_client.get_api_status() is not None + + def test_ssh_exploiter(self, island_client): + TestMonkeyBlackbox.run_basic_test(island_client, "SSH.conf", "SSH_exploiter_and_keys") + + def test_hadoop_exploiter(self, island_client): + TestMonkeyBlackbox.run_basic_test(island_client, "HADOOP.conf", "Hadoop_exploiter", 6*60) + + def test_mssql_exploiter(self, island_client): + TestMonkeyBlackbox.run_basic_test(island_client, "MSSQL.conf", "MSSQL_exploiter") + + def test_smb_and_mimikatz_exploiters(self, island_client): + TestMonkeyBlackbox.run_basic_test(island_client, "SMB_MIMIKATZ.conf", "SMB_exploiter_mimikatz") + + def test_smb_pth(self, island_client): + TestMonkeyBlackbox.run_basic_test(island_client, "SMB_PTH.conf", "SMB_PTH") + + def test_elastic_exploiter(self, island_client): + TestMonkeyBlackbox.run_basic_test(island_client, "ELASTIC.conf", "Elastic_exploiter") + + def test_struts_exploiter(self, island_client): + TestMonkeyBlackbox.run_basic_test(island_client, "STRUTS2.conf", "Strtuts2_exploiter") + + def test_weblogic_exploiter(self, island_client): + TestMonkeyBlackbox.run_basic_test(island_client, "WEBLOGIC.conf", "Weblogic_exploiter") + + def test_shellshock_exploiter(self, island_client): + TestMonkeyBlackbox.run_basic_test(island_client, "SHELLSHOCK.conf", "Shellschock_exploiter") + + @pytest.mark.xfail(reason="Test fails randomly - still investigating.") + def test_tunneling(self, island_client): + TestMonkeyBlackbox.run_basic_test(island_client, "TUNNELING.conf", "Tunneling_exploiter", 10*60) + + def test_wmi_and_mimikatz_exploiters(self, island_client): + TestMonkeyBlackbox.run_basic_test(island_client, "WMI_MIMIKATZ.conf", "WMI_exploiter,_mimikatz") + + def test_wmi_pth(self, island_client): + TestMonkeyBlackbox.run_basic_test(island_client, "WMI_PTH.conf", "WMI_PTH") diff --git a/envs/monkey_zoo/blackbox/tests/__init__.py b/envs/monkey_zoo/blackbox/tests/__init__.py new file mode 100644 index 000000000..e69de29bb diff --git a/envs/monkey_zoo/blackbox/tests/basic_test.py b/envs/monkey_zoo/blackbox/tests/basic_test.py new file mode 100644 index 000000000..d2fad4e1e --- /dev/null +++ b/envs/monkey_zoo/blackbox/tests/basic_test.py @@ -0,0 +1,98 @@ +import json +from time import sleep + +import logging + +from envs.monkey_zoo.blackbox.utils.test_timer import TestTimer + +MAX_TIME_FOR_MONKEYS_TO_DIE = 5 * 60 +WAIT_TIME_BETWEEN_REQUESTS = 10 +TIME_FOR_MONKEY_PROCESS_TO_FINISH = 40 +DELAY_BETWEEN_ANALYSIS = 3 +LOGGER = logging.getLogger(__name__) + + +class BasicTest(object): + + def __init__(self, name, island_client, config_parser, analyzers, timeout, log_handler): + self.name = name + self.island_client = island_client + self.config_parser = config_parser + self.analyzers = analyzers + self.timeout = timeout + self.log_handler = log_handler + + def run(self): + LOGGER.info("Uploading configuration:\n{}".format(json.dumps(self.config_parser.config_json, indent=2))) + self.island_client.import_config(self.config_parser.config_raw) + self.print_test_starting_info() + try: + self.island_client.run_monkey_local() + self.test_until_timeout() + finally: + self.island_client.kill_all_monkeys() + self.wait_until_monkeys_die() + self.wait_for_monkey_process_to_finish() + self.parse_logs() + self.island_client.reset_env() + + def print_test_starting_info(self): + LOGGER.info("Started {} test".format(self.name)) + LOGGER.info("Machines participating in test:") + LOGGER.info(" ".join(self.config_parser.get_ips_of_targets())) + print("") + + def test_until_timeout(self): + timer = TestTimer(self.timeout) + while not timer.is_timed_out(): + if self.all_analyzers_pass(): + self.log_success(timer) + return + sleep(DELAY_BETWEEN_ANALYSIS) + LOGGER.debug("Waiting until all analyzers passed. Time passed: {}".format(timer.get_time_taken())) + self.log_failure(timer) + assert False + + def log_success(self, timer): + LOGGER.info(self.get_analyzer_logs()) + LOGGER.info("{} test passed, time taken: {:.1f} seconds.".format(self.name, timer.get_time_taken())) + + def log_failure(self, timer): + LOGGER.info(self.get_analyzer_logs()) + LOGGER.error("{} test failed because of timeout. Time taken: {:.1f} seconds.".format(self.name, + timer.get_time_taken())) + + def all_analyzers_pass(self): + for analyzer in self.analyzers: + if not analyzer.analyze_test_results(): + return False + return True + + def get_analyzer_logs(self): + log = "" + for analyzer in self.analyzers: + log += "\n" + analyzer.log.get_contents() + return log + + def wait_until_monkeys_die(self): + time_passed = 0 + while not self.island_client.is_all_monkeys_dead() and time_passed < MAX_TIME_FOR_MONKEYS_TO_DIE: + sleep(WAIT_TIME_BETWEEN_REQUESTS) + time_passed += WAIT_TIME_BETWEEN_REQUESTS + LOGGER.debug("Waiting for all monkeys to die. Time passed: {}".format(time_passed)) + if time_passed > MAX_TIME_FOR_MONKEYS_TO_DIE: + LOGGER.error("Some monkeys didn't die after the test, failing") + assert False + + def parse_logs(self): + LOGGER.info("Parsing test logs:") + self.log_handler.parse_test_logs() + + @staticmethod + def wait_for_monkey_process_to_finish(): + """ + There is a time period when monkey is set to dead, but the process is still closing. + If we try to launch monkey during that time window monkey will fail to start, that's + why test needs to wait a bit even after all monkeys are dead. + """ + sleep(TIME_FOR_MONKEY_PROCESS_TO_FINISH) diff --git a/envs/monkey_zoo/blackbox/utils/__init__.py b/envs/monkey_zoo/blackbox/utils/__init__.py new file mode 100644 index 000000000..e69de29bb diff --git a/envs/monkey_zoo/blackbox/utils/gcp_machine_handlers.py b/envs/monkey_zoo/blackbox/utils/gcp_machine_handlers.py new file mode 100644 index 000000000..3cb2ad6af --- /dev/null +++ b/envs/monkey_zoo/blackbox/utils/gcp_machine_handlers.py @@ -0,0 +1,54 @@ +import subprocess + +import logging + +LOGGER = logging.getLogger(__name__) + + +class GCPHandler(object): + + AUTHENTICATION_COMMAND = "gcloud auth activate-service-account --key-file=%s" + SET_PROPERTY_PROJECT = "gcloud config set project %s" + MACHINE_STARTING_COMMAND = "gcloud compute instances start %s --zone=%s" + MACHINE_STOPPING_COMMAND = "gcloud compute instances stop %s --zone=%s" + + def __init__(self, key_path="../gcp_keys/gcp_key.json", zone="europe-west3-a", project_id="guardicore-22050661"): + self.zone = zone + try: + # pass the key file to gcp + subprocess.call(GCPHandler.get_auth_command(key_path), shell=True) + LOGGER.info("GCP Handler passed key") + # set project + subprocess.call(GCPHandler.get_set_project_command(project_id), shell=True) + LOGGER.info("GCP Handler set project") + LOGGER.info("GCP Handler initialized successfully") + except Exception as e: + LOGGER.error("GCP Handler failed to initialize: %s." % e) + + def start_machines(self, machine_list): + """ + Start all the machines in the list. + :param machine_list: A space-separated string with all the machine names. Example: + start_machines(`" ".join(["elastic-3", "mssql-16"])`) + """ + LOGGER.info("Setting up all GCP machines...") + try: + subprocess.call((GCPHandler.MACHINE_STARTING_COMMAND % (machine_list, self.zone)), shell=True) + LOGGER.info("GCP machines successfully started.") + except Exception as e: + LOGGER.error("GCP Handler failed to start GCP machines: %s" % e) + + def stop_machines(self, machine_list): + try: + subprocess.call((GCPHandler.MACHINE_STOPPING_COMMAND % (machine_list, self.zone)), shell=True) + LOGGER.info("GCP machines stopped successfully.") + except Exception as e: + LOGGER.error("GCP Handler failed to stop network machines: %s" % e) + + @staticmethod + def get_auth_command(key_path): + return GCPHandler.AUTHENTICATION_COMMAND % key_path + + @staticmethod + def get_set_project_command(project): + return GCPHandler.SET_PROPERTY_PROJECT % project diff --git a/envs/monkey_zoo/blackbox/utils/json_encoder.py b/envs/monkey_zoo/blackbox/utils/json_encoder.py new file mode 100644 index 000000000..77be9211a --- /dev/null +++ b/envs/monkey_zoo/blackbox/utils/json_encoder.py @@ -0,0 +1,9 @@ +import json +from bson import ObjectId + + +class MongoQueryJSONEncoder(json.JSONEncoder): + def default(self, o): + if isinstance(o, ObjectId): + return str(o) + return json.JSONEncoder.default(self, o) diff --git a/envs/monkey_zoo/blackbox/utils/test_timer.py b/envs/monkey_zoo/blackbox/utils/test_timer.py new file mode 100644 index 000000000..2c0ca490a --- /dev/null +++ b/envs/monkey_zoo/blackbox/utils/test_timer.py @@ -0,0 +1,17 @@ +from time import time + + +class TestTimer(object): + def __init__(self, timeout): + self.timeout_time = TestTimer.get_timeout_time(timeout) + self.start_time = time() + + def is_timed_out(self): + return time() > self.timeout_time + + def get_time_taken(self): + return time() - self.start_time + + @staticmethod + def get_timeout_time(timeout): + return time() + timeout diff --git a/envs/monkey_zoo/docs/fullDocs.md b/envs/monkey_zoo/docs/fullDocs.md new file mode 100644 index 000000000..a8c0687fc --- /dev/null +++ b/envs/monkey_zoo/docs/fullDocs.md @@ -0,0 +1,1141 @@ +This document describes Infection Monkey’s test network, how to deploy and use it. + +[Warning\!](#warning)
+[Introduction](#introduction)
+[Getting started](#getting-started)
+[Using islands](#using-islands)
+[Running tests](#running-tests)
+[Machines’ legend](#machines-legend)
+[Machines](#machines)
+[Nr. 2 Hadoop](#_Toc526517182)
+[Nr. 3 Hadoop](#_Toc526517183)
+[Nr. 4 Elastic](#_Toc526517184)
+[Nr. 5 Elastic](#_Toc526517185)
+[Nr. 6 Sambacry](#_Toc536021459)
+[Nr. 7 Sambacry](#_Toc536021460)
+[Nr. 8 Shellshock](#_Toc536021461)
+[Nr. 9 Tunneling M1](#_Toc536021462)
+[Nr. 10 Tunneling M2](#_Toc536021463)
+[Nr. 11 SSH key steal](#_Toc526517190)
+[Nr. 12 SSH key steal](#_Toc526517191)
+[Nr. 13 RDP grinder](#_Toc526517192)
+[Nr. 14 Mimikatz](#_Toc536021467)
+[Nr. 15 Mimikatz](#_Toc536021468)
+[Nr. 16 MsSQL](#_Toc536021469)
+[Nr. 17 Upgrader](#_Toc536021470)
+[Nr. 18 WebLogic](#_Toc526517180)
+[Nr. 19 WebLogic](#_Toc526517181)
+[Nr. 20 SMB](#_Toc536021473)
+[Nr. 21 Scan](#_Toc526517196)
+[Nr. 22 Scan](#_Toc526517197)
+[Nr. 23 Struts2](#_Toc536021476)
+[Nr. 24 Struts2](#_Toc536021477)
+[Nr. 250 MonkeyIsland](#_Toc536021478)
+[Nr. 251 MonkeyIsland](#_Toc536021479)
+[Network topography](#network-topography)
+ +# Warning\! + +This project builds an intentionally +vulnerable network. Make sure not to add +production servers to the same network and leave it closed to the +public. + +# Introduction: + +MonkeyZoo is a Google Cloud Platform network deployed with terraform. +Terraform scripts allows you to quickly setup a network that’s full of +vulnerable machines to regression test monkey’s exploiters, evaluate +scanning times in a real-world scenario and many more. + +# Getting started: + +Requirements: +1. Have terraform installed. +2. Have a Google Cloud Platform account (upgraded if you want to test + whole network at once). + +To deploy: +1. Configure service account for your project: + + a. Create a service account (GCP website -> IAM -> service accounts) and name it “your\_name-monkeyZoo-user” + + b. Give these permissions to your service account: + + **Compute Engine -> Compute Network Admin** + and + **Compute Engine -> Compute Instance Admin** + and + **Compute Engine -> Compute Security Admin** + and + **Service Account User** + + or + + **Project -> Owner** + + c. Download its **Service account key** in JSON and place it in **/gcp_keys** as **gcp_key.json**. +2. Get these permissions in monkeyZoo project for your service account (ask monkey developers to add them): + + a. **Compute Engine -\> Compute image user** +3. Change configurations located in the + ../monkey/envs/monkey\_zoo/terraform/config.tf file (don’t forget to + link to your service account key file): + + provider "google" { + + project = "test-000000" // Change to your project id + + region = "europe-west3" // Change to your desired region or leave default + + zone = "europe-west3-b" // Change to your desired zone or leave default + + credentials = "${file("../gcp_keys/gcp_key.json")}" // Change to the location and name of the service key. + // If you followed instruction above leave it as is + + } + + locals { + + resource_prefix = "" // All of the resources will have this prefix. + // Only change if you want to have multiple zoo's in the same project + + service_account_email="tester-monkeyZoo-user@testproject-000000.iam.gserviceaccount.com" // Service account email + + monkeyzoo_project="guardicore-22050661" // Project where monkeyzoo images are kept. Leave as is. + + } + +4. Run terraform init + +To deploy the network run:
+`terraform plan` (review the changes it will make on GCP)
+`terraform apply` (creates 2 networks for machines)
+`terraform apply` (adds machines to these networks) + +# Using islands: + +###How to get into the islands: + +**island-linux-250:** SSH from GCP + +**island-windows-251:** In GCP/VM instances page click on +island-windows-251. Set password for your account and then RDP into +the island. + +###These are most common steps on monkey islands: + +####island-linux-250: + +To run monkey island:
+`sudo /usr/run\_island.sh`
+ +To run monkey:
+`sudo /usr/run\_monkey.sh`
+ +To update repository:
+`git pull /usr/infection_monkey`
+ +Update all requirements using deployment script:
+1\. `cd /usr/infection_monkey/deployment_scripts`
+2\. `./deploy_linux.sh "/usr/infection_monkey" "develop"`
+ +####island-windows-251: + +To run monkey island:
+Execute C:\\run\_monkey\_island.bat as administrator + +To run monkey:
+Execute C:\\run\_monkey.bat as administrator + +To update repository:
+1\. Open cmd as an administrator
+2\. `cd C:\infection_monkey`
+3\. `git pull` (updates develop branch)
+ +Update all requirements using deployment script:
+1. `cd C:\infection_monkey\deployment_scripts`
+2. `./run_script.bat "C:\infection_monkey" "develop"` + +# Running tests: + +Once you start monkey island you can import test configurations from +../monkey/envs/configs. + +fullTest.conf is a good config to start, because it covers all machines. + +# Machines: + +
Nr. 2 Hadoop +(10.2.2.2) |
+(Vulnerable) | +
|---|---|
| OS: | +Ubuntu 16.04.05 x64 | +
| Software: | +JDK, + |
+
| Default server’s port: | +8020 | +
| Server’s config: | +Single node cluster | +
| Scan results: | +Machine exploited using Hadoop exploiter | +
| Notes: | ++ |
Nr. 3 Hadoop +(10.2.2.3) |
+(Vulnerable) | +
|---|---|
| OS: | +Windows 10 x64 | +
| Software: | +JDK, + |
+
| Default server’s port: | +8020 | +
| Server’s config: | +Single node cluster | +
| Scan results: | +Machine exploited using Hadoop exploiter | +
| Notes: | ++ |
Nr. 4 Elastic +(10.2.2.4) |
+(Vulnerable) | +
|---|---|
| OS: | +Ubuntu 16.04.05 x64 | +
| Software: | +JDK, + |
+
| Default server’s port: | +9200 | +
| Server’s config: | +Default | +
| Scan results: | +Machine exploited using Elastic exploiter | +
| Notes: | +Quick tutorial on how to add entries (was useful when setting up). | +
| + | + |
Nr. 5 Elastic +(10.2.2.5) |
+(Vulnerable) | +
|---|---|
| OS: | +Windows 10 x64 | +
| Software: | +JDK, + |
+
| Default server’s port: | +9200 | +
| Server’s config: | +Default | +
| Scan results: | +Machine exploited using Elastic exploiter | +
| Notes: | +Quick tutorial on how to add entries (was useful when setting up). | +
Nr. 6 Sambacry +(10.2.2.6) |
+(Not implemented) | +
|---|---|
| OS: | +Ubuntu 16.04.05 x64 | +
| Software: | +Samba > 3.5.0 and < 4.6.4, 4.5.10 and 4.4.14 | +
| Default server’s port: | +- | +
| Root password: | +;^TK`9XN_x^ | +
| Server’s config: | ++ |
| Scan results: | +Machine exploited using Sambacry exploiter | +
| Notes: | ++ |
| + | + |
Nr. 7 Sambacry +(10.2.2.7) |
+(Not implemented) | +
|---|---|
| OS: | +Ubuntu 16.04.05 x32 | +
| Software: | +Samba > 3.5.0 and < 4.6.4, 4.5.10 and 4.4.14 | +
| Default server’s port: | +- | +
| Root password: | +*.&A7/W}Rc$ | +
| Server’s config: | ++ |
| Scan results: | +Machine exploited using Sambacry exploiter | +
| Notes: | ++ |
Nr. 8 Shellshock +(10.2.2.8) |
+(Vulnerable) | +
|---|---|
| OS: | +Ubuntu 12.04 LTS x64 | +
| Software: | +Apache2, bash 4.2. | +
| Default server’s port: | +80 | +
| Scan results: | +Machine exploited using Shellshock exploiter | +
| Notes: | +Vulnerable app is under /cgi-bin/test.cgi | +
| + | + |
Nr. 9 Tunneling M1 +(10.2.2.9, 10.2.1.9) |
+(Vulnerable) | +
|---|---|
| OS: | +Ubuntu 16.04.05 x64 | +
| Software: | +OpenSSL | +
| Default service’s port: | +22 | +
| Root password: | +`))jU7L(w} | +
| Server’s config: | +Default | +
| Notes: | ++ |
Nr. 10 Tunneling M2 +(10.2.1.10) |
+(Exploitable) | +
|---|---|
| OS: | +Ubuntu 16.04.05 x64 | +
| Software: | +OpenSSL | +
| Default service’s port: | +22 | +
| Root password: | +3Q=(Ge(+&w]* | +
| Server’s config: | +Default | +
| Notes: | +Accessible only trough Nr.9 | +
Nr. 11 Tunneling M3 +(10.2.0.11) |
+(Exploitable) | +
|---|---|
| OS: | +Ubuntu 16.04.05 x64 | +
| Software: | +OpenSSL | +
| Default service’s port: | +22 | +
| Root password: | +3Q=(Ge(+&w]* | +
| Server’s config: | +Default | +
| Notes: | +Accessible only trough Nr.10 | +
Nr. 11 SSH key steal. +(10.2.2.11) |
+(Vulnerable) | +
|---|---|
| OS: | +Ubuntu 16.04.05 x64 | +
| Software: | +OpenSSL | +
| Default connection port: | +22 | +
| Root password: | +^NgDvY59~8 | +
| Server’s config: | +SSH keys to connect to NR. 11 | +
| Notes: | ++ |
| + | + |
Nr. 12 SSH key steal. +(10.2.2.12) |
+(Exploitable) | +
|---|---|
| OS: | +Ubuntu 16.04.05 x64 | +
| Software: | +OpenSSL | +
| Default connection port: | +22 | +
| Root password: | +u?Sj5@6(-C | +
| Server’s config: | +SSH configured to allow connection from NR.10 | +
| Notes: | +Don’t add this machine’s credentials to exploit configuration. | +
| + | + |
Nr. 13 RDP grinder +(10.2.2.13) |
+(Not implemented) | +
|---|---|
| OS: | +Windows 10 x64 | +
| Software: | +- | +
| Default connection port: | +3389 | +
| Root password: | +2}p}aR]&=M | +
| Server’s config: | +Remote desktop enabled +Admin user’s credentials: +m0nk3y, 2}p}aR]&=M |
+
| Notes: | ++ |
| + | + |
Nr. 14 Mimikatz +(10.2.2.14) |
+(Vulnerable) | +
|---|---|
| OS: | +Windows 10 x64 | +
| Software: | +- | +
| Admin password: | +Ivrrw5zEzs | +
| Server’s config: | +Has cached mimikatz-15 RDP credentials +SMB turned on |
+
| Notes: | ++ |
Nr. 15 Mimikatz +(10.2.2.15) |
+(Exploitable) | +
|---|---|
| OS: | +Windows 10 x64 | +
| Software: | +- | +
| Admin password: | +pAJfG56JX>< | +
| Server’s config: | +It’s credentials are cashed at mimikatz-14 +SMB turned on |
+
| Notes: | +If you change this machine’s IP it won’t get exploited. | +
| + | + |
Nr. 16 MsSQL +(10.2.2.16) |
+(Vulnerable) | +
|---|---|
| OS: | +Windows 10 x64 | +
| Software: | +MSSQL Server | +
| Default service port: | +1433 | +
| Server’s config: | +xp_cmdshell feature enabled in MSSQL server |
+
| SQL server auth. creds: | +m0nk3y : Xk8VDTsC |
+
| Notes: | +Enabled SQL server browser service + + |
+
Nr. 17 Upgrader +(10.2.2.17) |
+(Not implemented) | +
|---|---|
| OS: | +Windows 10 x64 | +
| Default service port: | +445 | +
| Root password: | +U??7ppG_ | +
| Server’s config: | +Turn on SMB | +
| Notes: | ++ |
| + | + |
Nr. 18 WebLogic +(10.2.2.18) |
+(Vulnerable) | +
|---|---|
| OS: | +Ubuntu 16.04.05 x64 | +
| Software: | +JDK, + |
+
| Default server’s port: | +7001 | +
| Admin domain credentials: | +weblogic : B74Ot0c4 | +
| Server’s config: | +Default | +
| Notes: | ++ |
Nr. 19 WebLogic +(10.2.2.19) |
+(Vulnerable) | +
|---|---|
| OS: | +Windows 10 x64 | +
| Software: | +JDK, + |
+
| Default server’s port: | +7001 | +
| Admin servers credentials: | +weblogic : =ThS2d=m(`B | +
| Server’s config: | +Default | +
| Notes: | ++ |
Nr. 20 SMB +(10.2.2.20) |
+(Vulnerable) | +
|---|---|
| OS: | +Windows 10 x64 | +
| Software: | +- | +
| Default service’s port: | +445 | +
| Root password: | +YbS,<tpS.2av | +
| Server’s config: | +SMB turned on | +
| Notes: | ++ |
Nr. 21 Scan +(10.2.2.21) |
+(Secure) | +
|---|---|
| OS: | +Ubuntu 16.04.05 x64 | +
| Software: | +Apache tomcat 7.0.92 | +
| Default server’s port: | +8080 | +
| Server’s config: | +Default | +
| Notes: | +Used to scan a machine that has no vulnerabilities (to evaluate scanning speed for e.g.) | +
| + | + |
Nr. 22 Scan +(10.2.2.22) |
+(Secure) | +
|---|---|
| OS: | +Windows 10 x64 | +
| Software: | +Apache tomcat 7.0.92 | +
| Default server’s port: | +8080 | +
| Server’s config: | +Default | +
| Notes: | +Used to scan a machine that has no vulnerabilities (to evaluate scanning speed for e.g.) | +
| + | + |
Nr. 23 Struts2 +(10.2.2.23) |
+(Vulnerable) | +
|---|---|
| OS: | +Ubuntu 16.04.05 x64 | +
| Software: | +JDK, +struts2 2.3.15.1, +tomcat 9.0.0.M9 |
+
| Default server’s port: | +8080 | +
| Server’s config: | +Default | +
| Notes: | ++ |
Nr. 24 Struts2 +(10.2.2.24) |
+(Vulnerable) | +
|---|---|
| OS: | +Windows 10 x64 | +
| Software: | +JDK, +struts2 2.3.15.1, +tomcat 9.0.0.M9 |
+
| Default server’s port: | +8080 | +
| Server’s config: | +Default | +
| Notes: | ++ |
| + | + |
Nr. 250 MonkeyIsland +(10.2.2.250) |
++ |
|---|---|
| OS: | +Ubuntu 16.04.05 x64 | +
| Software: | +MonkeyIsland server, git, mongodb etc. | +
| Default server’s port: | +22, 443 | +
| Private key passphrase: | +- | +
| Notes: | +Only accessible trough GCP | +
| + | + |
Nr. 251 MonkeyIsland +(10.2.2.251) |
++ |
|---|---|
| OS: | +Windows Server 2016 x64 | +
| Software: | +MonkeyIsland server, git, mongodb etc. | +
| Default server’s port: | +3389, 443 | +
| Private key passphrase: | +- | +
| Notes: | +Only accessible trough GCP | +
| + | + |
diff --git a/envs/monkey_zoo/docs/images/networkTopography.jpg b/envs/monkey_zoo/docs/images/networkTopography.jpg
new file mode 100644
index 000000000..09130a251
Binary files /dev/null and b/envs/monkey_zoo/docs/images/networkTopography.jpg differ
diff --git a/envs/monkey_zoo/gcp_keys/.gitignore b/envs/monkey_zoo/gcp_keys/.gitignore
new file mode 100644
index 000000000..5e7d2734c
--- /dev/null
+++ b/envs/monkey_zoo/gcp_keys/.gitignore
@@ -0,0 +1,4 @@
+# Ignore everything in this directory
+*
+# Except this file
+!.gitignore
diff --git a/envs/monkey_zoo/terraform/config.tf b/envs/monkey_zoo/terraform/config.tf
new file mode 100644
index 000000000..3a2bf0fc4
--- /dev/null
+++ b/envs/monkey_zoo/terraform/config.tf
@@ -0,0 +1,11 @@
+provider "google" {
+ project = "test-000000"
+ region = "europe-west3"
+ zone = "europe-west3-b"
+ credentials = "${file("../gcp_keys/gcp_key.json")}"
+}
+locals {
+ resource_prefix = ""
+ service_account_email="tester-monkeyZoo-user@testproject-000000.iam.gserviceaccount.com"
+ monkeyzoo_project="guardicore-22050661"
+}
diff --git a/envs/monkey_zoo/terraform/firewalls.tf b/envs/monkey_zoo/terraform/firewalls.tf
new file mode 100644
index 000000000..afd99a347
--- /dev/null
+++ b/envs/monkey_zoo/terraform/firewalls.tf
@@ -0,0 +1,100 @@
+resource "google_compute_firewall" "islands-in" {
+ name = "${local.resource_prefix}islands-in"
+ network = "${google_compute_network.monkeyzoo.name}"
+
+ allow {
+ protocol = "tcp"
+ ports = ["22", "443", "3389", "5000"]
+ }
+
+ direction = "INGRESS"
+ priority = "65534"
+ target_tags = ["island"]
+}
+
+resource "google_compute_firewall" "islands-out" {
+ name = "${local.resource_prefix}islands-out"
+ network = "${google_compute_network.monkeyzoo.name}"
+
+ allow {
+ protocol = "tcp"
+ }
+
+ direction = "EGRESS"
+ priority = "65534"
+ target_tags = ["island"]
+}
+
+resource "google_compute_firewall" "monkeyzoo-in" {
+ name = "${local.resource_prefix}monkeyzoo-in"
+ network = "${google_compute_network.monkeyzoo.name}"
+
+ allow {
+ protocol = "all"
+ }
+
+ direction = "INGRESS"
+ priority = "65534"
+ source_ranges = ["10.2.2.0/24"]
+}
+
+resource "google_compute_firewall" "monkeyzoo-out" {
+ name = "${local.resource_prefix}monkeyzoo-out"
+ network = "${google_compute_network.monkeyzoo.name}"
+
+ allow {
+ protocol = "all"
+ }
+
+ direction = "EGRESS"
+ priority = "65534"
+ destination_ranges = ["10.2.2.0/24"]
+}
+
+resource "google_compute_firewall" "tunneling-in" {
+ name = "${local.resource_prefix}tunneling-in"
+ network = "${google_compute_network.tunneling.name}"
+
+ allow {
+ protocol = "all"
+ }
+
+ direction = "INGRESS"
+ source_ranges = ["10.2.1.0/24"]
+}
+
+resource "google_compute_firewall" "tunneling-out" {
+ name = "${local.resource_prefix}tunneling-out"
+ network = "${google_compute_network.tunneling.name}"
+
+ allow {
+ protocol = "all"
+ }
+
+ direction = "EGRESS"
+ destination_ranges = ["10.2.1.0/24"]
+}
+
+resource "google_compute_firewall" "tunneling2-in" {
+ name = "${local.resource_prefix}tunneling2-in"
+ network = "${google_compute_network.tunneling2.name}"
+
+ allow {
+ protocol = "all"
+ }
+
+ direction = "INGRESS"
+ source_ranges = ["10.2.0.0/24"]
+}
+
+resource "google_compute_firewall" "tunneling2-out" {
+ name = "${local.resource_prefix}tunneling2-out"
+ network = "${google_compute_network.tunneling2.name}"
+
+ allow {
+ protocol = "all"
+ }
+
+ direction = "EGRESS"
+ destination_ranges = ["10.2.0.0/24"]
+}
diff --git a/envs/monkey_zoo/terraform/images.tf b/envs/monkey_zoo/terraform/images.tf
new file mode 100644
index 000000000..dccbe16dd
--- /dev/null
+++ b/envs/monkey_zoo/terraform/images.tf
@@ -0,0 +1,95 @@
+//Custom cloud images
+data "google_compute_image" "hadoop-2" {
+ name = "hadoop-2"
+ project = "${local.monkeyzoo_project}"
+}
+data "google_compute_image" "hadoop-3" {
+ name = "hadoop-3"
+ project = "${local.monkeyzoo_project}"
+}
+data "google_compute_image" "elastic-4" {
+ name = "elastic-4"
+ project = "${local.monkeyzoo_project}"
+}
+data "google_compute_image" "elastic-5" {
+ name = "elastic-5"
+ project = "${local.monkeyzoo_project}"
+}
+
+/*
+data "google_compute_image" "sambacry-6" {
+ name = "sambacry-6"
+}
+*/
+data "google_compute_image" "shellshock-8" {
+ name = "shellshock-8"
+ project = "${local.monkeyzoo_project}"
+}
+data "google_compute_image" "tunneling-9" {
+ name = "tunneling-9"
+ project = "${local.monkeyzoo_project}"
+}
+data "google_compute_image" "tunneling-10" {
+ name = "tunneling-10"
+ project = "${local.monkeyzoo_project}"
+}
+data "google_compute_image" "tunneling-11" {
+ name = "tunneling-11"
+ project = "${local.monkeyzoo_project}"
+}
+data "google_compute_image" "sshkeys-11" {
+ name = "sshkeys-11"
+ project = "${local.monkeyzoo_project}"
+}
+data "google_compute_image" "sshkeys-12" {
+ name = "sshkeys-12"
+ project = "${local.monkeyzoo_project}"
+}
+data "google_compute_image" "mimikatz-14" {
+ name = "mimikatz-14"
+ project = "${local.monkeyzoo_project}"
+}
+data "google_compute_image" "mimikatz-15" {
+ name = "mimikatz-15"
+ project = "${local.monkeyzoo_project}"
+}
+data "google_compute_image" "mssql-16" {
+ name = "mssql-16"
+ project = "${local.monkeyzoo_project}"
+}
+data "google_compute_image" "weblogic-18" {
+ name = "weblogic-18"
+ project = "${local.monkeyzoo_project}"
+}
+data "google_compute_image" "weblogic-19" {
+ name = "weblogic-19"
+ project = "${local.monkeyzoo_project}"
+}
+data "google_compute_image" "smb-20" {
+ name = "smb-20"
+ project = "${local.monkeyzoo_project}"
+}
+data "google_compute_image" "scan-21" {
+ name = "scan-21"
+ project = "${local.monkeyzoo_project}"
+}
+data "google_compute_image" "scan-22" {
+ name = "scan-22"
+ project = "${local.monkeyzoo_project}"
+}
+data "google_compute_image" "struts2-23" {
+ name = "struts2-23"
+ project = "${local.monkeyzoo_project}"
+}
+data "google_compute_image" "struts2-24" {
+ name = "struts2-24"
+ project = "${local.monkeyzoo_project}"
+}
+data "google_compute_image" "island-linux-250" {
+ name = "island-linux-250"
+ project = "${local.monkeyzoo_project}"
+}
+data "google_compute_image" "island-windows-251" {
+ name = "island-windows-251"
+ project = "${local.monkeyzoo_project}"
+}
diff --git a/envs/monkey_zoo/terraform/monkey_zoo.tf b/envs/monkey_zoo/terraform/monkey_zoo.tf
new file mode 100644
index 000000000..cf45d93e0
--- /dev/null
+++ b/envs/monkey_zoo/terraform/monkey_zoo.tf
@@ -0,0 +1,460 @@
+
+// Local variables
+locals {
+ default_ubuntu="${google_compute_instance_template.ubuntu16.self_link}"
+ default_windows="${google_compute_instance_template.windows2016.self_link}"
+}
+
+resource "google_compute_network" "monkeyzoo" {
+ name = "${local.resource_prefix}monkeyzoo"
+ auto_create_subnetworks = false
+}
+
+resource "google_compute_network" "tunneling" {
+ name = "${local.resource_prefix}tunneling"
+ auto_create_subnetworks = false
+}
+
+resource "google_compute_network" "tunneling2" {
+ name = "${local.resource_prefix}tunneling2"
+ auto_create_subnetworks = false
+}
+
+resource "google_compute_subnetwork" "monkeyzoo-main" {
+ name = "${local.resource_prefix}monkeyzoo-main"
+ ip_cidr_range = "10.2.2.0/24"
+ network = "${google_compute_network.monkeyzoo.self_link}"
+}
+
+resource "google_compute_subnetwork" "tunneling-main" {
+ name = "${local.resource_prefix}tunneling-main"
+ ip_cidr_range = "10.2.1.0/28"
+ network = "${google_compute_network.tunneling.self_link}"
+}
+
+resource "google_compute_subnetwork" "tunneling2-main" {
+ name = "${local.resource_prefix}tunneling2-main"
+ ip_cidr_range = "10.2.0.0/27"
+ network = "${google_compute_network.tunneling2.self_link}"
+}
+
+resource "google_compute_instance_from_template" "hadoop-2" {
+ name = "${local.resource_prefix}hadoop-2"
+ source_instance_template = "${local.default_ubuntu}"
+ boot_disk{
+ initialize_params {
+ image = "${data.google_compute_image.hadoop-2.self_link}"
+ }
+ auto_delete = true
+ }
+ network_interface {
+ subnetwork="${local.resource_prefix}monkeyzoo-main"
+ network_ip="10.2.2.2"
+ }
+ // Add required ssh keys for hadoop service and restart it
+ metadata_startup_script = "[ ! -f /home/vakaris_zilius/.ssh/authorized_keys ] && sudo cat /home/vakaris_zilius/.ssh/id_rsa.pub >> /home/vakaris_zilius/.ssh/authorized_keys && sudo reboot"
+}
+
+resource "google_compute_instance_from_template" "hadoop-3" {
+ name = "${local.resource_prefix}hadoop-3"
+ source_instance_template = "${local.default_windows}"
+ boot_disk{
+ initialize_params {
+ image = "${data.google_compute_image.hadoop-3.self_link}"
+ }
+ auto_delete = true
+ }
+ network_interface {
+ subnetwork="${local.resource_prefix}monkeyzoo-main"
+ network_ip="10.2.2.3"
+ }
+}
+
+resource "google_compute_instance_from_template" "elastic-4" {
+ name = "${local.resource_prefix}elastic-4"
+ source_instance_template = "${local.default_ubuntu}"
+ boot_disk{
+ initialize_params {
+ image = "${data.google_compute_image.elastic-4.self_link}"
+ }
+ auto_delete = true
+ }
+ network_interface {
+ subnetwork="${local.resource_prefix}monkeyzoo-main"
+ network_ip="10.2.2.4"
+ }
+}
+
+resource "google_compute_instance_from_template" "elastic-5" {
+ name = "${local.resource_prefix}elastic-5"
+ source_instance_template = "${local.default_windows}"
+ boot_disk{
+ initialize_params {
+ image = "${data.google_compute_image.elastic-5.self_link}"
+ }
+ auto_delete = true
+ }
+ network_interface {
+ subnetwork="${local.resource_prefix}monkeyzoo-main"
+ network_ip="10.2.2.5"
+ }
+}
+
+/* Couldn't find ubuntu packages for required samba version (too old).
+resource "google_compute_instance_from_template" "sambacry-6" {
+ name = "${local.resource_prefix}sambacry-6"
+ source_instance_template = "${local.default_ubuntu}"
+ boot_disk{
+ initialize_params {
+ image = "${data.google_compute_image.sambacry-6.self_link}"
+ }
+ }
+ network_interface {
+ subnetwork="${local.resource_prefix}monkeyzoo-main"
+ network_ip="10.2.2.6"
+ }
+}
+*/
+
+/* We need custom 32 bit Ubuntu machine for this (there are no 32 bit ubuntu machines in GCP).
+resource "google_compute_instance_from_template" "sambacry-7" {
+ name = "${local.resource_prefix}sambacry-7"
+ source_instance_template = "${local.default_ubuntu}"
+ boot_disk {
+ initialize_params {
+ // Add custom image to cloud
+ image = "ubuntu32"
+ }
+ }
+ network_interface {
+ subnetwork="${local.resource_prefix}monkeyzoo-main"
+ network_ip="10.2.2.7"
+ }
+}
+*/
+
+resource "google_compute_instance_from_template" "shellshock-8" {
+ name = "${local.resource_prefix}shellshock-8"
+ source_instance_template = "${local.default_ubuntu}"
+ boot_disk{
+ initialize_params {
+ image = "${data.google_compute_image.shellshock-8.self_link}"
+ }
+ auto_delete = true
+ }
+ network_interface {
+ subnetwork="${local.resource_prefix}monkeyzoo-main"
+ network_ip="10.2.2.8"
+ }
+}
+
+resource "google_compute_instance_from_template" "tunneling-9" {
+ name = "${local.resource_prefix}tunneling-9"
+ source_instance_template = "${local.default_ubuntu}"
+ boot_disk{
+ initialize_params {
+ image = "${data.google_compute_image.tunneling-9.self_link}"
+ }
+ auto_delete = true
+ }
+ network_interface{
+ subnetwork="${local.resource_prefix}tunneling-main"
+ network_ip="10.2.1.9"
+ }
+ network_interface{
+ subnetwork="${local.resource_prefix}monkeyzoo-main"
+ network_ip="10.2.2.9"
+ }
+}
+
+resource "google_compute_instance_from_template" "tunneling-10" {
+ name = "${local.resource_prefix}tunneling-10"
+ source_instance_template = "${local.default_ubuntu}"
+ boot_disk{
+ initialize_params {
+ image = "${data.google_compute_image.tunneling-10.self_link}"
+ }
+ auto_delete = true
+ }
+ network_interface{
+ subnetwork="${local.resource_prefix}tunneling-main"
+ network_ip="10.2.1.10"
+ }
+ network_interface{
+ subnetwork="${local.resource_prefix}tunneling2-main"
+ network_ip="10.2.0.10"
+ }
+}
+
+resource "google_compute_instance_from_template" "tunneling-11" {
+ name = "${local.resource_prefix}tunneling-11"
+ source_instance_template = "${local.default_ubuntu}"
+ boot_disk{
+ initialize_params {
+ image = "${data.google_compute_image.tunneling-11.self_link}"
+ }
+ auto_delete = true
+ }
+ network_interface{
+ subnetwork="${local.resource_prefix}tunneling2-main"
+ network_ip="10.2.0.11"
+ }
+}
+
+resource "google_compute_instance_from_template" "sshkeys-11" {
+ name = "${local.resource_prefix}sshkeys-11"
+ source_instance_template = "${local.default_ubuntu}"
+ boot_disk{
+ initialize_params {
+ image = "${data.google_compute_image.sshkeys-11.self_link}"
+ }
+ auto_delete = true
+ }
+ network_interface {
+ subnetwork="${local.resource_prefix}monkeyzoo-main"
+ network_ip="10.2.2.11"
+ }
+}
+
+resource "google_compute_instance_from_template" "sshkeys-12" {
+ name = "${local.resource_prefix}sshkeys-12"
+ source_instance_template = "${local.default_ubuntu}"
+ boot_disk{
+ initialize_params {
+ image = "${data.google_compute_image.sshkeys-12.self_link}"
+ }
+ auto_delete = true
+ }
+ network_interface {
+ subnetwork="${local.resource_prefix}monkeyzoo-main"
+ network_ip="10.2.2.12"
+ }
+}
+
+/*
+resource "google_compute_instance_from_template" "rdpgrinder-13" {
+ name = "${local.resource_prefix}rdpgrinder-13"
+ source_instance_template = "${local.default_windows}"
+ boot_disk{
+ initialize_params {
+ image = "${data.google_compute_image.rdpgrinder-13.self_link}"
+ }
+ }
+ network_interface {
+ subnetwork="${local.resource_prefix}monkeyzoo-main"
+ network_ip="10.2.2.13"
+ }
+}
+*/
+
+resource "google_compute_instance_from_template" "mimikatz-14" {
+ name = "${local.resource_prefix}mimikatz-14"
+ source_instance_template = "${local.default_windows}"
+ boot_disk{
+ initialize_params {
+ image = "${data.google_compute_image.mimikatz-14.self_link}"
+ }
+ auto_delete = true
+ }
+ network_interface {
+ subnetwork="${local.resource_prefix}monkeyzoo-main"
+ network_ip="10.2.2.14"
+ }
+}
+
+resource "google_compute_instance_from_template" "mimikatz-15" {
+ name = "${local.resource_prefix}mimikatz-15"
+ source_instance_template = "${local.default_windows}"
+ boot_disk{
+ initialize_params {
+ image = "${data.google_compute_image.mimikatz-15.self_link}"
+ }
+ auto_delete = true
+ }
+ network_interface {
+ subnetwork="${local.resource_prefix}monkeyzoo-main"
+ network_ip="10.2.2.15"
+ }
+}
+
+resource "google_compute_instance_from_template" "mssql-16" {
+ name = "${local.resource_prefix}mssql-16"
+ source_instance_template = "${local.default_windows}"
+ boot_disk{
+ initialize_params {
+ image = "${data.google_compute_image.mssql-16.self_link}"
+ }
+ auto_delete = true
+ }
+ network_interface {
+ subnetwork="${local.resource_prefix}monkeyzoo-main"
+ network_ip="10.2.2.16"
+ }
+}
+
+/* We need to alter monkey's behavior for this to upload 32-bit monkey instead of 64-bit (not yet developed)
+resource "google_compute_instance_from_template" "upgrader-17" {
+ name = "${local.resource_prefix}upgrader-17"
+ source_instance_template = "${local.default_windows}"
+ boot_disk{
+ initialize_params {
+ image = "${data.google_compute_image.upgrader-17.self_link}"
+ }
+ }
+ network_interface {
+ subnetwork="${local.resource_prefix}monkeyzoo-main"
+ network_ip="10.2.2.17"
+ access_config {
+ // Cheaper, non-premium routing
+ network_tier = "STANDARD"
+ }
+ }
+}
+*/
+
+resource "google_compute_instance_from_template" "weblogic-18" {
+ name = "${local.resource_prefix}weblogic-18"
+ source_instance_template = "${local.default_ubuntu}"
+ boot_disk{
+ initialize_params {
+ image = "${data.google_compute_image.weblogic-18.self_link}"
+ }
+ auto_delete = true
+ }
+ network_interface {
+ subnetwork="${local.resource_prefix}monkeyzoo-main"
+ network_ip="10.2.2.18"
+ }
+}
+
+resource "google_compute_instance_from_template" "weblogic-19" {
+ name = "${local.resource_prefix}weblogic-19"
+ source_instance_template = "${local.default_windows}"
+ boot_disk{
+ initialize_params {
+ image = "${data.google_compute_image.weblogic-19.self_link}"
+ }
+ auto_delete = true
+ }
+ network_interface {
+ subnetwork="${local.resource_prefix}monkeyzoo-main"
+ network_ip="10.2.2.19"
+ }
+}
+
+resource "google_compute_instance_from_template" "smb-20" {
+ name = "${local.resource_prefix}smb-20"
+ source_instance_template = "${local.default_windows}"
+ boot_disk{
+ initialize_params {
+ image = "${data.google_compute_image.smb-20.self_link}"
+ }
+ auto_delete = true
+ }
+ network_interface {
+ subnetwork="${local.resource_prefix}monkeyzoo-main"
+ network_ip="10.2.2.20"
+ }
+}
+
+resource "google_compute_instance_from_template" "scan-21" {
+ name = "${local.resource_prefix}scan-21"
+ source_instance_template = "${local.default_ubuntu}"
+ boot_disk{
+ initialize_params {
+ image = "${data.google_compute_image.scan-21.self_link}"
+ }
+ auto_delete = true
+ }
+ network_interface {
+ subnetwork="${local.resource_prefix}monkeyzoo-main"
+ network_ip="10.2.2.21"
+ }
+}
+
+resource "google_compute_instance_from_template" "scan-22" {
+ name = "${local.resource_prefix}scan-22"
+ source_instance_template = "${local.default_windows}"
+ boot_disk{
+ initialize_params {
+ image = "${data.google_compute_image.scan-22.self_link}"
+ }
+ auto_delete = true
+ }
+ network_interface {
+ subnetwork="${local.resource_prefix}monkeyzoo-main"
+ network_ip="10.2.2.22"
+ }
+}
+
+resource "google_compute_instance_from_template" "struts2-23" {
+ name = "${local.resource_prefix}struts2-23"
+ source_instance_template = "${local.default_ubuntu}"
+ boot_disk{
+ initialize_params {
+ image = "${data.google_compute_image.struts2-23.self_link}"
+ }
+ auto_delete = true
+ }
+ network_interface {
+ subnetwork="${local.resource_prefix}monkeyzoo-main"
+ network_ip="10.2.2.23"
+ }
+}
+
+resource "google_compute_instance_from_template" "struts2-24" {
+ name = "${local.resource_prefix}struts2-24"
+ source_instance_template = "${local.default_windows}"
+ boot_disk{
+ initialize_params {
+ image = "${data.google_compute_image.struts2-24.self_link}"
+ }
+ auto_delete = true
+ }
+ network_interface {
+ subnetwork="${local.resource_prefix}monkeyzoo-main"
+ network_ip="10.2.2.24"
+ }
+}
+
+resource "google_compute_instance_from_template" "island-linux-250" {
+ name = "${local.resource_prefix}island-linux-250"
+ machine_type = "n1-standard-2"
+ tags = ["island", "linux", "ubuntu16"]
+ source_instance_template = "${local.default_ubuntu}"
+ boot_disk{
+ initialize_params {
+ image = "${data.google_compute_image.island-linux-250.self_link}"
+ }
+ auto_delete = true
+ }
+ network_interface {
+ subnetwork="${local.resource_prefix}monkeyzoo-main"
+ network_ip="10.2.2.250"
+ access_config {
+ // Cheaper, non-premium routing (not available in some regions)
+ // network_tier = "STANDARD"
+ }
+ }
+}
+
+resource "google_compute_instance_from_template" "island-windows-251" {
+ name = "${local.resource_prefix}island-windows-251"
+ machine_type = "n1-standard-2"
+ tags = ["island", "windows", "windowsserver2016"]
+ source_instance_template = "${local.default_windows}"
+ boot_disk{
+ initialize_params {
+ image = "${data.google_compute_image.island-windows-251.self_link}"
+ }
+ auto_delete = true
+ }
+ network_interface {
+ subnetwork="${local.resource_prefix}monkeyzoo-main"
+ network_ip="10.2.2.251"
+ access_config {
+ // Cheaper, non-premium routing (not available in some regions)
+ // network_tier = "STANDARD"
+ }
+ }
+}
diff --git a/envs/monkey_zoo/terraform/templates.tf b/envs/monkey_zoo/terraform/templates.tf
new file mode 100644
index 000000000..6ae6dafdc
--- /dev/null
+++ b/envs/monkey_zoo/terraform/templates.tf
@@ -0,0 +1,45 @@
+resource "google_compute_instance_template" "ubuntu16" {
+ name = "${local.resource_prefix}ubuntu16"
+ description = "Creates ubuntu 16.04 LTS servers at europe-west3-a."
+
+ tags = ["test-machine", "ubuntu16", "linux"]
+
+ machine_type = "n1-standard-1"
+ can_ip_forward = false
+
+ disk {
+ source_image = "ubuntu-os-cloud/ubuntu-1604-lts"
+ }
+ network_interface {
+ subnetwork="monkeyzoo-main"
+ access_config {
+ // Cheaper, non-premium routing
+ network_tier = "STANDARD"
+ }
+ }
+ service_account {
+ email ="${local.service_account_email}"
+ scopes=["cloud-platform"]
+ }
+}
+
+resource "google_compute_instance_template" "windows2016" {
+ name = "${local.resource_prefix}windows2016"
+ description = "Creates windows 2016 core servers at europe-west3-a."
+
+ tags = ["test-machine", "windowsserver2016", "windows"]
+
+ machine_type = "n1-standard-1"
+ can_ip_forward = false
+
+ disk {
+ source_image = "windows-cloud/windows-2016"
+ }
+ network_interface {
+ subnetwork="monkeyzoo-main"
+ }
+ service_account {
+ email="${local.service_account_email}"
+ scopes=["cloud-platform"]
+ }
+}
diff --git a/monkey/common/cloud/__init__.py b/monkey/common/cloud/__init__.py
new file mode 100644
index 000000000..ee5b79ad0
--- /dev/null
+++ b/monkey/common/cloud/__init__.py
@@ -0,0 +1 @@
+__author__ = 'itay.mizeretz'
diff --git a/monkey/common/cloud/aws_instance.py b/monkey/common/cloud/aws_instance.py
new file mode 100644
index 000000000..8cedaa4f3
--- /dev/null
+++ b/monkey/common/cloud/aws_instance.py
@@ -0,0 +1,79 @@
+import json
+import re
+import urllib2
+import logging
+
+
+__author__ = 'itay.mizeretz'
+
+AWS_INSTANCE_METADATA_LOCAL_IP_ADDRESS = "169.254.169.254"
+AWS_LATEST_METADATA_URI_PREFIX = 'http://{0}/latest/'.format(AWS_INSTANCE_METADATA_LOCAL_IP_ADDRESS)
+ACCOUNT_ID_KEY = "accountId"
+
+
+logger = logging.getLogger(__name__)
+
+
+class AwsInstance(object):
+ """
+ Class which gives useful information about the current instance you're on.
+ """
+
+ def __init__(self):
+ self.instance_id = None
+ self.region = None
+ self.account_id = None
+
+ try:
+ self.instance_id = urllib2.urlopen(
+ AWS_LATEST_METADATA_URI_PREFIX + 'meta-data/instance-id', timeout=2).read()
+ self.region = self._parse_region(
+ urllib2.urlopen(AWS_LATEST_METADATA_URI_PREFIX + 'meta-data/placement/availability-zone').read())
+ except (urllib2.URLError, IOError) as e:
+ logger.debug("Failed init of AwsInstance while getting metadata: {}".format(e.message), exc_info=True)
+
+ try:
+ self.account_id = self._extract_account_id(
+ urllib2.urlopen(
+ AWS_LATEST_METADATA_URI_PREFIX + 'dynamic/instance-identity/document', timeout=2).read())
+ except (urllib2.URLError, IOError) as e:
+ logger.debug("Failed init of AwsInstance while getting dynamic instance data: {}".format(e.message))
+
+ @staticmethod
+ def _parse_region(region_url_response):
+ # For a list of regions, see:
+ # https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.RegionsAndAvailabilityZones.html
+ # This regex will find any AWS region format string in the response.
+ re_phrase = r'((?:us|eu|ap|ca|cn|sa)-[a-z]*-[0-9])'
+ finding = re.findall(re_phrase, region_url_response, re.IGNORECASE)
+ if finding:
+ return finding[0]
+ else:
+ return None
+
+ def get_instance_id(self):
+ return self.instance_id
+
+ def get_region(self):
+ return self.region
+
+ def is_aws_instance(self):
+ return self.instance_id is not None
+
+ @staticmethod
+ def _extract_account_id(instance_identity_document_response):
+ """
+ Extracts the account id from the dynamic/instance-identity/document metadata path.
+ Based on https://forums.aws.amazon.com/message.jspa?messageID=409028 which has a few more solutions,
+ in case Amazon break this mechanism.
+ :param instance_identity_document_response: json returned via the web page ../dynamic/instance-identity/document
+ :return: The account id
+ """
+ return json.loads(instance_identity_document_response)[ACCOUNT_ID_KEY]
+
+ def get_account_id(self):
+ """
+ :return: the AWS account ID which "owns" this instance.
+ See https://docs.aws.amazon.com/general/latest/gr/acct-identifiers.html
+ """
+ return self.account_id
diff --git a/monkey/common/cloud/aws_service.py b/monkey/common/cloud/aws_service.py
new file mode 100644
index 000000000..41bb202bc
--- /dev/null
+++ b/monkey/common/cloud/aws_service.py
@@ -0,0 +1,88 @@
+import logging
+
+import boto3
+import botocore
+from botocore.exceptions import ClientError
+
+from common.cloud.aws_instance import AwsInstance
+
+__author__ = ['itay.mizeretz', 'shay.nehmad']
+
+INSTANCE_INFORMATION_LIST_KEY = 'InstanceInformationList'
+INSTANCE_ID_KEY = 'InstanceId'
+COMPUTER_NAME_KEY = 'ComputerName'
+PLATFORM_TYPE_KEY = 'PlatformType'
+IP_ADDRESS_KEY = 'IPAddress'
+
+
+logger = logging.getLogger(__name__)
+
+
+def filter_instance_data_from_aws_response(response):
+ return [{
+ 'instance_id': x[INSTANCE_ID_KEY],
+ 'name': x[COMPUTER_NAME_KEY],
+ 'os': x[PLATFORM_TYPE_KEY].lower(),
+ 'ip_address': x[IP_ADDRESS_KEY]
+ } for x in response[INSTANCE_INFORMATION_LIST_KEY]]
+
+
+class AwsService(object):
+ """
+ A wrapper class around the boto3 client and session modules, which supplies various AWS services.
+
+ This class will assume:
+ 1. That it's running on an EC2 instance
+ 2. That the instance is associated with the correct IAM role. See
+ https://boto3.amazonaws.com/v1/documentation/api/latest/guide/configuration.html#iam-role for details.
+ """
+
+ region = None
+
+ @staticmethod
+ def set_region(region):
+ AwsService.region = region
+
+ @staticmethod
+ def get_client(client_type, region=None):
+ return boto3.client(
+ client_type,
+ region_name=region if region is not None else AwsService.region)
+
+ @staticmethod
+ def get_session():
+ return boto3.session.Session()
+
+ @staticmethod
+ def get_regions():
+ return AwsService.get_session().get_available_regions('ssm')
+
+ @staticmethod
+ def test_client():
+ try:
+ AwsService.get_client('ssm').describe_instance_information()
+ return True
+ except ClientError:
+ return False
+
+ @staticmethod
+ def get_instances():
+ """
+ Get the information for all instances with the relevant roles.
+
+ This function will assume that it's running on an EC2 instance with the correct IAM role.
+ See https://boto3.amazonaws.com/v1/documentation/api/latest/guide/configuration.html#iam-role for details.
+
+ :raises: botocore.exceptions.ClientError if can't describe local instance information.
+ :return: All visible instances from this instance
+ """
+ current_instance = AwsInstance()
+ local_ssm_client = boto3.client("ssm", current_instance.get_region())
+ try:
+ response = local_ssm_client.describe_instance_information()
+
+ filtered_instances_data = filter_instance_data_from_aws_response(response)
+ return filtered_instances_data
+ except botocore.exceptions.ClientError as e:
+ logger.warning("AWS client error while trying to get instances: " + e.message)
+ raise e
diff --git a/monkey/common/cloud/aws_service_test.py b/monkey/common/cloud/aws_service_test.py
new file mode 100644
index 000000000..699e2c489
--- /dev/null
+++ b/monkey/common/cloud/aws_service_test.py
@@ -0,0 +1,59 @@
+from unittest import TestCase
+from aws_service import filter_instance_data_from_aws_response
+
+import json
+
+
+__author__ = 'shay.nehmad'
+
+
+class TestFilterInstanceDataFromAwsResponse(TestCase):
+ def test_filter_instance_data_from_aws_response(self):
+ json_response_full = """
+ {
+ "InstanceInformationList": [
+ {
+ "ActivationId": "string",
+ "AgentVersion": "string",
+ "AssociationOverview": {
+ "DetailedStatus": "string",
+ "InstanceAssociationStatusAggregatedCount": {
+ "string" : 6
+ }
+ },
+ "AssociationStatus": "string",
+ "ComputerName": "string",
+ "IamRole": "string",
+ "InstanceId": "string",
+ "IPAddress": "string",
+ "IsLatestVersion": "True",
+ "LastAssociationExecutionDate": 6,
+ "LastPingDateTime": 6,
+ "LastSuccessfulAssociationExecutionDate": 6,
+ "Name": "string",
+ "PingStatus": "string",
+ "PlatformName": "string",
+ "PlatformType": "string",
+ "PlatformVersion": "string",
+ "RegistrationDate": 6,
+ "ResourceType": "string"
+ }
+ ],
+ "NextToken": "string"
+ }
+ """
+
+ json_response_empty = """
+ {
+ "InstanceInformationList": [],
+ "NextToken": "string"
+ }
+ """
+
+ self.assertEqual(filter_instance_data_from_aws_response(json.loads(json_response_empty)), [])
+ self.assertEqual(
+ filter_instance_data_from_aws_response(json.loads(json_response_full)),
+ [{'instance_id': u'string',
+ 'ip_address': u'string',
+ 'name': u'string',
+ 'os': u'string'}])
diff --git a/monkey/common/cmd/__init__.py b/monkey/common/cmd/__init__.py
new file mode 100644
index 000000000..e69de29bb
diff --git a/monkey/common/cmd/aws/__init__.py b/monkey/common/cmd/aws/__init__.py
new file mode 100644
index 000000000..e69de29bb
diff --git a/monkey/common/cmd/aws/aws_cmd_result.py b/monkey/common/cmd/aws/aws_cmd_result.py
new file mode 100644
index 000000000..79b1bb79d
--- /dev/null
+++ b/monkey/common/cmd/aws/aws_cmd_result.py
@@ -0,0 +1,26 @@
+from common.cmd.cmd_result import CmdResult
+
+
+__author__ = 'itay.mizeretz'
+
+
+class AwsCmdResult(CmdResult):
+ """
+ Class representing an AWS command result
+ """
+
+ def __init__(self, command_info):
+ super(AwsCmdResult, self).__init__(
+ self.is_successful(command_info, True), command_info[u'ResponseCode'], command_info[u'StandardOutputContent'],
+ command_info[u'StandardErrorContent'])
+ self.command_info = command_info
+
+ @staticmethod
+ def is_successful(command_info, is_timeout=False):
+ """
+ Determines whether the command was successful. If it timed out and was still in progress, we assume it worked.
+ :param command_info: Command info struct (returned by ssm.get_command_invocation)
+ :param is_timeout: Whether the given command timed out
+ :return: True if successful, False otherwise.
+ """
+ return (command_info[u'Status'] == u'Success') or (is_timeout and (command_info[u'Status'] == u'InProgress'))
diff --git a/monkey/common/cmd/aws/aws_cmd_runner.py b/monkey/common/cmd/aws/aws_cmd_runner.py
new file mode 100644
index 000000000..b4198f642
--- /dev/null
+++ b/monkey/common/cmd/aws/aws_cmd_runner.py
@@ -0,0 +1,42 @@
+import logging
+
+from common.cloud.aws_service import AwsService
+from common.cmd.aws.aws_cmd_result import AwsCmdResult
+from common.cmd.cmd_runner import CmdRunner
+from common.cmd.cmd_status import CmdStatus
+
+__author__ = 'itay.mizeretz'
+
+logger = logging.getLogger(__name__)
+
+
+class AwsCmdRunner(CmdRunner):
+ """
+ Class for running commands on a remote AWS machine
+ """
+
+ def __init__(self, is_linux, instance_id, region = None):
+ super(AwsCmdRunner, self).__init__(is_linux)
+ self.instance_id = instance_id
+ self.region = region
+ self.ssm = AwsService.get_client('ssm', region)
+
+ def query_command(self, command_id):
+ return self.ssm.get_command_invocation(CommandId=command_id, InstanceId=self.instance_id)
+
+ def get_command_result(self, command_info):
+ return AwsCmdResult(command_info)
+
+ def get_command_status(self, command_info):
+ if command_info[u'Status'] == u'InProgress':
+ return CmdStatus.IN_PROGRESS
+ elif command_info[u'Status'] == u'Success':
+ return CmdStatus.SUCCESS
+ else:
+ return CmdStatus.FAILURE
+
+ def run_command_async(self, command_line):
+ doc_name = "AWS-RunShellScript" if self.is_linux else "AWS-RunPowerShellScript"
+ command_res = self.ssm.send_command(DocumentName=doc_name, Parameters={'commands': [command_line]},
+ InstanceIds=[self.instance_id])
+ return command_res['Command']['CommandId']
diff --git a/monkey/common/cmd/cmd.py b/monkey/common/cmd/cmd.py
new file mode 100644
index 000000000..8cb2177a2
--- /dev/null
+++ b/monkey/common/cmd/cmd.py
@@ -0,0 +1,11 @@
+__author__ = 'itay.mizeretz'
+
+
+class Cmd(object):
+ """
+ Class representing a command
+ """
+
+ def __init__(self, cmd_runner, cmd_id):
+ self.cmd_runner = cmd_runner
+ self.cmd_id = cmd_id
diff --git a/monkey/common/cmd/cmd_result.py b/monkey/common/cmd/cmd_result.py
new file mode 100644
index 000000000..d3039736f
--- /dev/null
+++ b/monkey/common/cmd/cmd_result.py
@@ -0,0 +1,13 @@
+__author__ = 'itay.mizeretz'
+
+
+class CmdResult(object):
+ """
+ Class representing a command result
+ """
+
+ def __init__(self, is_success, status_code=None, stdout=None, stderr=None):
+ self.is_success = is_success
+ self.status_code = status_code
+ self.stdout = stdout
+ self.stderr = stderr
diff --git a/monkey/common/cmd/cmd_runner.py b/monkey/common/cmd/cmd_runner.py
new file mode 100644
index 000000000..6686508a4
--- /dev/null
+++ b/monkey/common/cmd/cmd_runner.py
@@ -0,0 +1,158 @@
+import time
+import logging
+from abc import abstractmethod
+
+from common.cmd.cmd import Cmd
+from common.cmd.cmd_result import CmdResult
+from common.cmd.cmd_status import CmdStatus
+
+__author__ = 'itay.mizeretz'
+
+logger = logging.getLogger(__name__)
+
+
+class CmdRunner(object):
+ """
+ Interface for running commands on a remote machine
+
+ Since these classes are a bit complex, I provide a list of common terminology and formats:
+ * command line - a command line. e.g. 'echo hello'
+ * command - represent a single command which was already run. Always of type Cmd
+ * command id - any unique identifier of a command which was already run
+ * command result - represents the result of running a command. Always of type CmdResult
+ * command status - represents the current status of a command. Always of type CmdStatus
+ * command info - Any consistent structure representing additional information of a command which was already run
+ * instance - a machine that commands will be run on. Can be any dictionary with 'instance_id' as a field
+ * instance_id - any unique identifier of an instance (machine). Can be of any format
+ """
+
+ # Default command timeout in seconds
+ DEFAULT_TIMEOUT = 5
+ # Time to sleep when waiting on commands.
+ WAIT_SLEEP_TIME = 1
+
+ def __init__(self, is_linux):
+ self.is_linux = is_linux
+
+ def run_command(self, command_line, timeout=DEFAULT_TIMEOUT):
+ """
+ Runs the given command on the remote machine
+ :param command_line: The command line to run
+ :param timeout: Timeout in seconds for command.
+ :return: Command result
+ """
+ c_id = self.run_command_async(command_line)
+ return self.wait_commands([Cmd(self, c_id)], timeout)[1]
+
+ @staticmethod
+ def run_multiple_commands(instances, inst_to_cmd, inst_n_cmd_res_to_res):
+ """
+ Run multiple commands on various instances
+ :param instances: List of instances.
+ :param inst_to_cmd: Function which receives an instance, runs a command asynchronously and returns Cmd
+ :param inst_n_cmd_res_to_res: Function which receives an instance and CmdResult
+ and returns a parsed result (of any format)
+ :return: Dictionary with 'instance_id' as key and parsed result as value
+ """
+ command_instance_dict = {}
+
+ for instance in instances:
+ command = inst_to_cmd(instance)
+ command_instance_dict[command] = instance
+
+ instance_results = {}
+ command_result_pairs = CmdRunner.wait_commands(command_instance_dict.keys())
+ for command, result in command_result_pairs:
+ instance = command_instance_dict[command]
+ instance_results[instance['instance_id']] = inst_n_cmd_res_to_res(instance, result)
+
+ return instance_results
+
+ @abstractmethod
+ def run_command_async(self, command_line):
+ """
+ Runs the given command on the remote machine asynchronously.
+ :param command_line: The command line to run
+ :return: Command ID (in any format)
+ """
+ raise NotImplementedError()
+
+ @staticmethod
+ def wait_commands(commands, timeout=DEFAULT_TIMEOUT):
+ """
+ Waits on all commands up to given timeout
+ :param commands: list of commands (of type Cmd)
+ :param timeout: Timeout in seconds for command.
+ :return: commands and their results (tuple of Command and CmdResult)
+ """
+ init_time = time.time()
+ curr_time = init_time
+
+ results = []
+
+ while (curr_time - init_time < timeout) and (len(commands) != 0):
+ for command in list(commands): # list(commands) clones the list. We do so because we remove items inside
+ CmdRunner._process_command(command, commands, results, True)
+
+ time.sleep(CmdRunner.WAIT_SLEEP_TIME)
+ curr_time = time.time()
+
+ for command in list(commands):
+ CmdRunner._process_command(command, commands, results, False)
+
+ for command, result in results:
+ if not result.is_success:
+ logger.error('The following command failed: `%s`. status code: %s',
+ str(command[1]), str(result.status_code))
+
+ return results
+
+ @abstractmethod
+ def query_command(self, command_id):
+ """
+ Queries the already run command for more info
+ :param command_id: The command ID to query
+ :return: Command info (in any format)
+ """
+ raise NotImplementedError()
+
+ @abstractmethod
+ def get_command_result(self, command_info):
+ """
+ Gets the result of the already run command
+ :param command_info: The command info of the command to get the result of
+ :return: CmdResult
+ """
+ raise NotImplementedError()
+
+ @abstractmethod
+ def get_command_status(self, command_info):
+ """
+ Gets the status of the already run command
+ :param command_info: The command info of the command to get the result of
+ :return: CmdStatus
+ """
+ raise NotImplementedError()
+
+ @staticmethod
+ def _process_command(command, commands, results, should_process_only_finished):
+ """
+ Removes the command from the list, processes its result and appends to results
+ :param command: Command to process. Must be in commands.
+ :param commands: List of unprocessed commands.
+ :param results: List of command results.
+ :param should_process_only_finished: If True, processes only if command finished.
+ :return: None
+ """
+ c_runner = command.cmd_runner
+ c_id = command.cmd_id
+ try:
+ command_info = c_runner.query_command(c_id)
+ if (not should_process_only_finished) or c_runner.get_command_status(command_info) != CmdStatus.IN_PROGRESS:
+ commands.remove(command)
+ results.append((command, c_runner.get_command_result(command_info)))
+ except Exception:
+ logger.exception('Exception while querying command: `%s`', str(c_id))
+ if not should_process_only_finished:
+ commands.remove(command)
+ results.append((command, CmdResult(False)))
diff --git a/monkey/common/cmd/cmd_status.py b/monkey/common/cmd/cmd_status.py
new file mode 100644
index 000000000..2fc9cc168
--- /dev/null
+++ b/monkey/common/cmd/cmd_status.py
@@ -0,0 +1,9 @@
+from enum import Enum
+
+__author__ = 'itay.mizeretz'
+
+
+class CmdStatus(Enum):
+ IN_PROGRESS = 0
+ SUCCESS = 1
+ FAILURE = 2
diff --git a/monkey/common/data/__init__.py b/monkey/common/data/__init__.py
new file mode 100644
index 000000000..a8c1a93f7
--- /dev/null
+++ b/monkey/common/data/__init__.py
@@ -0,0 +1,2 @@
+from zero_trust_consts import populate_mappings
+populate_mappings()
diff --git a/monkey/common/data/network_consts.py b/monkey/common/data/network_consts.py
new file mode 100644
index 000000000..5fc9d6d8a
--- /dev/null
+++ b/monkey/common/data/network_consts.py
@@ -0,0 +1,2 @@
+ES_SERVICE = 'elastic-search-9200'
+
diff --git a/monkey/common/data/post_breach_consts.py b/monkey/common/data/post_breach_consts.py
new file mode 100644
index 000000000..dee4f67d0
--- /dev/null
+++ b/monkey/common/data/post_breach_consts.py
@@ -0,0 +1,3 @@
+POST_BREACH_COMMUNICATE_AS_NEW_USER = "Communicate as new user"
+POST_BREACH_BACKDOOR_USER = "Backdoor user"
+POST_BREACH_FILE_EXECUTION = "File execution"
diff --git a/monkey/common/data/zero_trust_consts.py b/monkey/common/data/zero_trust_consts.py
new file mode 100644
index 000000000..4add05d04
--- /dev/null
+++ b/monkey/common/data/zero_trust_consts.py
@@ -0,0 +1,205 @@
+"""
+This file contains all the static data relating to Zero Trust. It is mostly used in the zero trust report generation and
+in creating findings.
+
+This file contains static mappings between zero trust components such as: pillars, principles, tests, statuses.
+Some of the mappings are computed when this module is loaded.
+"""
+
+AUTOMATION_ORCHESTRATION = u"Automation & Orchestration"
+VISIBILITY_ANALYTICS = u"Visibility & Analytics"
+WORKLOADS = u"Workloads"
+DEVICES = u"Devices"
+NETWORKS = u"Networks"
+PEOPLE = u"People"
+DATA = u"Data"
+PILLARS = (DATA, PEOPLE, NETWORKS, DEVICES, WORKLOADS, VISIBILITY_ANALYTICS, AUTOMATION_ORCHESTRATION)
+
+STATUS_UNEXECUTED = u"Unexecuted"
+STATUS_PASSED = u"Passed"
+STATUS_VERIFY = u"Verify"
+STATUS_FAILED = u"Failed"
+# Don't change order! The statuses are ordered by importance/severity.
+ORDERED_TEST_STATUSES = [STATUS_FAILED, STATUS_VERIFY, STATUS_PASSED, STATUS_UNEXECUTED]
+
+TEST_DATA_ENDPOINT_ELASTIC = u"unencrypted_data_endpoint_elastic"
+TEST_DATA_ENDPOINT_HTTP = u"unencrypted_data_endpoint_http"
+TEST_MACHINE_EXPLOITED = u"machine_exploited"
+TEST_ENDPOINT_SECURITY_EXISTS = u"endpoint_security_exists"
+TEST_SCHEDULED_EXECUTION = u"scheduled_execution"
+TEST_MALICIOUS_ACTIVITY_TIMELINE = u"malicious_activity_timeline"
+TEST_SEGMENTATION = u"segmentation"
+TEST_TUNNELING = u"tunneling"
+TEST_COMMUNICATE_AS_NEW_USER = u"communicate_as_new_user"
+TESTS = (
+ TEST_SEGMENTATION,
+ TEST_MALICIOUS_ACTIVITY_TIMELINE,
+ TEST_SCHEDULED_EXECUTION,
+ TEST_ENDPOINT_SECURITY_EXISTS,
+ TEST_MACHINE_EXPLOITED,
+ TEST_DATA_ENDPOINT_HTTP,
+ TEST_DATA_ENDPOINT_ELASTIC,
+ TEST_TUNNELING,
+ TEST_COMMUNICATE_AS_NEW_USER
+)
+
+PRINCIPLE_DATA_TRANSIT = u"data_transit"
+PRINCIPLE_ENDPOINT_SECURITY = u"endpoint_security"
+PRINCIPLE_USER_BEHAVIOUR = u"user_behaviour"
+PRINCIPLE_ANALYZE_NETWORK_TRAFFIC = u"analyze_network_traffic"
+PRINCIPLE_SEGMENTATION = u"segmentation"
+PRINCIPLE_RESTRICTIVE_NETWORK_POLICIES = u"network_policies"
+PRINCIPLE_USERS_MAC_POLICIES = u"users_mac_policies"
+PRINCIPLES = {
+ PRINCIPLE_SEGMENTATION: u"Apply segmentation and micro-segmentation inside your network.",
+ PRINCIPLE_ANALYZE_NETWORK_TRAFFIC: u"Analyze network traffic for malicious activity.",
+ PRINCIPLE_USER_BEHAVIOUR: u"Adopt security user behavior analytics.",
+ PRINCIPLE_ENDPOINT_SECURITY: u"Use anti-virus and other traditional endpoint security solutions.",
+ PRINCIPLE_DATA_TRANSIT: u"Secure data at transit by encrypting it.",
+ PRINCIPLE_RESTRICTIVE_NETWORK_POLICIES: u"Configure network policies to be as restrictive as possible.",
+ PRINCIPLE_USERS_MAC_POLICIES: u"Users' permissions to the network and to resources should be MAC (Mandetory "
+ u"Access Control) only.",
+}
+
+POSSIBLE_STATUSES_KEY = u"possible_statuses"
+PILLARS_KEY = u"pillars"
+PRINCIPLE_KEY = u"principle_key"
+FINDING_EXPLANATION_BY_STATUS_KEY = u"finding_explanation"
+TEST_EXPLANATION_KEY = u"explanation"
+TESTS_MAP = {
+ TEST_SEGMENTATION: {
+ TEST_EXPLANATION_KEY: u"The Monkey tried to scan and find machines that it can communicate with from the machine it's running on, that belong to different network segments.",
+ FINDING_EXPLANATION_BY_STATUS_KEY: {
+ STATUS_FAILED: "Monkey performed cross-segment communication. Check firewall rules and logs.",
+ STATUS_PASSED: "Monkey couldn't perform cross-segment communication. If relevant, check firewall logs."
+ },
+ PRINCIPLE_KEY: PRINCIPLE_SEGMENTATION,
+ PILLARS_KEY: [NETWORKS],
+ POSSIBLE_STATUSES_KEY: [STATUS_UNEXECUTED, STATUS_PASSED, STATUS_FAILED]
+ },
+ TEST_MALICIOUS_ACTIVITY_TIMELINE: {
+ TEST_EXPLANATION_KEY: u"The Monkeys in the network performed malicious-looking actions, like scanning and attempting exploitation.",
+ FINDING_EXPLANATION_BY_STATUS_KEY: {
+ STATUS_VERIFY: "Monkey performed malicious actions in the network. Check SOC logs and alerts."
+ },
+ PRINCIPLE_KEY: PRINCIPLE_ANALYZE_NETWORK_TRAFFIC,
+ PILLARS_KEY: [NETWORKS, VISIBILITY_ANALYTICS],
+ POSSIBLE_STATUSES_KEY: [STATUS_UNEXECUTED, STATUS_VERIFY]
+ },
+ TEST_ENDPOINT_SECURITY_EXISTS: {
+ TEST_EXPLANATION_KEY: u"The Monkey checked if there is an active process of an endpoint security software.",
+ FINDING_EXPLANATION_BY_STATUS_KEY: {
+ STATUS_FAILED: "Monkey didn't find ANY active endpoint security processes. Install and activate anti-virus software on endpoints.",
+ STATUS_PASSED: "Monkey found active endpoint security processes. Check their logs to see if Monkey was a security concern."
+ },
+ PRINCIPLE_KEY: PRINCIPLE_ENDPOINT_SECURITY,
+ PILLARS_KEY: [DEVICES],
+ POSSIBLE_STATUSES_KEY: [STATUS_UNEXECUTED, STATUS_FAILED, STATUS_PASSED]
+ },
+ TEST_MACHINE_EXPLOITED: {
+ TEST_EXPLANATION_KEY: u"The Monkey tries to exploit machines in order to breach them and propagate in the network.",
+ FINDING_EXPLANATION_BY_STATUS_KEY: {
+ STATUS_FAILED: "Monkey successfully exploited endpoints. Check IDS/IPS logs to see activity recognized and see which endpoints were compromised.",
+ STATUS_PASSED: "Monkey didn't manage to exploit an endpoint."
+ },
+ PRINCIPLE_KEY: PRINCIPLE_ENDPOINT_SECURITY,
+ PILLARS_KEY: [DEVICES],
+ POSSIBLE_STATUSES_KEY: [STATUS_UNEXECUTED, STATUS_FAILED, STATUS_VERIFY]
+ },
+ TEST_SCHEDULED_EXECUTION: {
+ TEST_EXPLANATION_KEY: "The Monkey was executed in a scheduled manner.",
+ FINDING_EXPLANATION_BY_STATUS_KEY: {
+ STATUS_VERIFY: "Monkey was executed in a scheduled manner. Locate this activity in User-Behavior security software.",
+ STATUS_PASSED: "Monkey failed to execute in a scheduled manner."
+ },
+ PRINCIPLE_KEY: PRINCIPLE_USER_BEHAVIOUR,
+ PILLARS_KEY: [PEOPLE, NETWORKS],
+ POSSIBLE_STATUSES_KEY: [STATUS_UNEXECUTED, STATUS_VERIFY]
+ },
+ TEST_DATA_ENDPOINT_ELASTIC: {
+ TEST_EXPLANATION_KEY: u"The Monkey scanned for unencrypted access to ElasticSearch instances.",
+ FINDING_EXPLANATION_BY_STATUS_KEY: {
+ STATUS_FAILED: "Monkey accessed ElasticSearch instances. Limit access to data by encrypting it in in-transit.",
+ STATUS_PASSED: "Monkey didn't find open ElasticSearch instances. If you have such instances, look for alerts that indicate attempts to access them."
+ },
+ PRINCIPLE_KEY: PRINCIPLE_DATA_TRANSIT,
+ PILLARS_KEY: [DATA],
+ POSSIBLE_STATUSES_KEY: [STATUS_UNEXECUTED, STATUS_FAILED, STATUS_PASSED]
+ },
+ TEST_DATA_ENDPOINT_HTTP: {
+ TEST_EXPLANATION_KEY: u"The Monkey scanned for unencrypted access to HTTP servers.",
+ FINDING_EXPLANATION_BY_STATUS_KEY: {
+ STATUS_FAILED: "Monkey accessed HTTP servers. Limit access to data by encrypting it in in-transit.",
+ STATUS_PASSED: "Monkey didn't find open HTTP servers. If you have such servers, look for alerts that indicate attempts to access them."
+ },
+ PRINCIPLE_KEY: PRINCIPLE_DATA_TRANSIT,
+ PILLARS_KEY: [DATA],
+ POSSIBLE_STATUSES_KEY: [STATUS_UNEXECUTED, STATUS_FAILED, STATUS_PASSED]
+ },
+ TEST_TUNNELING: {
+ TEST_EXPLANATION_KEY: u"The Monkey tried to tunnel traffic using other monkeys.",
+ FINDING_EXPLANATION_BY_STATUS_KEY: {
+ STATUS_FAILED: "Monkey tunneled its traffic using other monkeys. Your network policies are too permissive - restrict them."
+ },
+ PRINCIPLE_KEY: PRINCIPLE_RESTRICTIVE_NETWORK_POLICIES,
+ PILLARS_KEY: [NETWORKS, VISIBILITY_ANALYTICS],
+ POSSIBLE_STATUSES_KEY: [STATUS_UNEXECUTED, STATUS_FAILED]
+ },
+ TEST_COMMUNICATE_AS_NEW_USER: {
+ TEST_EXPLANATION_KEY: u"The Monkey tried to create a new user and communicate with the internet from it.",
+ FINDING_EXPLANATION_BY_STATUS_KEY: {
+ STATUS_FAILED: "Monkey caused a new user to access the network. Your network policies are too permissive - restrict them to MAC only.",
+ STATUS_PASSED: "Monkey wasn't able to cause a new user to access the network."
+ },
+ PRINCIPLE_KEY: PRINCIPLE_USERS_MAC_POLICIES,
+ PILLARS_KEY: [PEOPLE, NETWORKS, VISIBILITY_ANALYTICS],
+ POSSIBLE_STATUSES_KEY: [STATUS_UNEXECUTED, STATUS_FAILED, STATUS_PASSED]
+ },
+}
+
+EVENT_TYPE_MONKEY_NETWORK = "monkey_network"
+EVENT_TYPE_MONKEY_LOCAL = "monkey_local"
+EVENT_TYPES = (EVENT_TYPE_MONKEY_LOCAL, EVENT_TYPE_MONKEY_NETWORK)
+
+PILLARS_TO_TESTS = {
+ DATA: [],
+ PEOPLE: [],
+ NETWORKS: [],
+ DEVICES: [],
+ WORKLOADS: [],
+ VISIBILITY_ANALYTICS: [],
+ AUTOMATION_ORCHESTRATION: []
+}
+
+PRINCIPLES_TO_TESTS = {}
+
+PRINCIPLES_TO_PILLARS = {}
+
+
+def populate_mappings():
+ populate_pillars_to_tests()
+ populate_principles_to_tests()
+ populate_principles_to_pillars()
+
+
+def populate_pillars_to_tests():
+ for pillar in PILLARS:
+ for test, test_info in TESTS_MAP.items():
+ if pillar in test_info[PILLARS_KEY]:
+ PILLARS_TO_TESTS[pillar].append(test)
+
+
+def populate_principles_to_tests():
+ for single_principle in PRINCIPLES:
+ PRINCIPLES_TO_TESTS[single_principle] = []
+ for test, test_info in TESTS_MAP.items():
+ PRINCIPLES_TO_TESTS[test_info[PRINCIPLE_KEY]].append(test)
+
+
+def populate_principles_to_pillars():
+ for principle, principle_tests in PRINCIPLES_TO_TESTS.items():
+ principles_pillars = set()
+ for test in principle_tests:
+ for pillar in TESTS_MAP[test][PILLARS_KEY]:
+ principles_pillars.add(pillar)
+ PRINCIPLES_TO_PILLARS[principle] = principles_pillars
diff --git a/monkey/common/network/network_range.py b/monkey/common/network/network_range.py
index a2142ce0e..de89f7e4a 100644
--- a/monkey/common/network/network_range.py
+++ b/monkey/common/network/network_range.py
@@ -5,9 +5,12 @@ from abc import ABCMeta, abstractmethod
import ipaddress
from six import text_type
+import logging
__author__ = 'itamar'
+LOG = logging.getLogger(__name__)
+
class NetworkRange(object):
__metaclass__ = ABCMeta
@@ -47,12 +50,23 @@ class NetworkRange(object):
address_str = address_str.strip()
if not address_str: # Empty string
return None
- if -1 != address_str.find('-'):
+ if NetworkRange.check_if_range(address_str):
return IpRange(ip_range=address_str)
if -1 != address_str.find('/'):
return CidrRange(cidr_range=address_str)
return SingleIpRange(ip_address=address_str)
+ @staticmethod
+ def check_if_range(address_str):
+ if -1 != address_str.find('-'):
+ ips = address_str.split('-')
+ try:
+ ipaddress.ip_address(ips[0]) and ipaddress.ip_address(ips[1])
+ except ValueError as e:
+ return False
+ return True
+ return False
+
@staticmethod
def _ip_to_number(address):
return struct.unpack(">L", socket.inet_aton(address))[0]
@@ -111,13 +125,58 @@ class IpRange(NetworkRange):
class SingleIpRange(NetworkRange):
def __init__(self, ip_address, shuffle=True):
super(SingleIpRange, self).__init__(shuffle=shuffle)
- self._ip_address = ip_address
+ self._ip_address, self.domain_name = self.string_to_host(ip_address)
def __repr__(self):
return "
+
)
+ };
+
+ render() {
+ let tableData = this.getTableData(this.props.configuration);
+ return (
+
+ {this.renderLegend()}
+
);
+ }
+}
+
+export default MatrixComponent;
diff --git a/monkey/monkey_island/cc/ui/src/components/attack/techniques/Helpers.js b/monkey/monkey_island/cc/ui/src/components/attack/techniques/Helpers.js
new file mode 100644
index 000000000..4d4f55dad
--- /dev/null
+++ b/monkey/monkey_island/cc/ui/src/components/attack/techniques/Helpers.js
@@ -0,0 +1,57 @@
+import React from "react";
+
+export function renderMachine(val){
+ return (
+ {val.ip_addr} {(val.domain_name ? " (".concat(val.domain_name, ")") : "")}
+ )
+}
+
+/* Function takes data gathered from system info collector and creates a
+ string representation of machine from that data. */
+export function renderMachineFromSystemData(data) {
+ let machineStr = data['hostname'] + " ( ";
+ data['ips'].forEach(function(ipInfo){
+ if(typeof ipInfo === "object"){
+ machineStr += ipInfo['addr'] + ", ";
+ } else {
+ machineStr += ipInfo + ", ";
+ }
+ });
+ // Replaces " ," with " )" to finish a list of IP's
+ return machineStr.slice(0, -2) + " )"
+}
+
+/* Formats telemetry data that contains _id.machine and _id.usage fields into columns
+ for react table. */
+export function getUsageColumns() {
+ return ([{
+ columns: [
+ {Header: 'Machine',
+ id: 'machine',
+ accessor: x => renderMachineFromSystemData(x.machine),
+ style: { 'whiteSpace': 'unset' },
+ width: 300},
+ {Header: 'Usage',
+ id: 'usage',
+ accessor: x => x.usage,
+ style: { 'whiteSpace': 'unset' }}]
+ }])}
+
+/* Renders table fields that contains 'used' boolean value and 'name' string value.
+'Used' value determines if 'name' value will be shown.
+ */
+export function renderUsageFields(usages){
+ let output = [];
+ usages.forEach(function(usage){
+ if(usage['used']){
+ output.push(
+
+ {usage['name']}
)
+ }
+ });
+ return ({output}
);
+ }
+
+export const ScanStatus = {
+ UNSCANNED: 0,
+ SCANNED: 1,
+ USED: 2
+};
diff --git a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1003.js b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1003.js
new file mode 100644
index 000000000..24d742c14
--- /dev/null
+++ b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1003.js
@@ -0,0 +1,27 @@
+import React from 'react';
+import '../../../styles/Collapse.scss'
+import '../../report-components/security/StolenPasswords'
+import StolenPasswordsComponent from "../../report-components/security/StolenPasswords";
+import {ScanStatus} from "./Helpers"
+
+
+class T1003 extends React.Component {
+
+ constructor(props) {
+ super(props);
+ }
+
+ render() {
+ return (
+
+
+ {this.props.data.status === ScanStatus.USED ? +
+ : ""}
+
+ );
+ }
+}
+
+export default T1003;
diff --git a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1005.js b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1005.js
new file mode 100644
index 000000000..6d46c2285
--- /dev/null
+++ b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1005.js
@@ -0,0 +1,38 @@
+import React from 'react';
+import '../../../styles/Collapse.scss'
+import ReactTable from "react-table";
+import {renderMachineFromSystemData, ScanStatus} from "./Helpers";
+
+class T1005 extends React.Component {
+
+ constructor(props) {
+ super(props);
+ }
+
+ static getDataColumns() {
+ return ([{
+ Header: "Sensitive data",
+ columns: [
+ {Header: 'Machine', id: 'machine', accessor: x => renderMachineFromSystemData(x.machine), style: { 'whiteSpace': 'unset' }},
+ {Header: 'Type', id: 'type', accessor: x => x.gathered_data_type, style: { 'whiteSpace': 'unset' }},
+ {Header: 'Info', id: 'info', accessor: x => x.info, style: { 'whiteSpace': 'unset' }},
+ ]}])};
+
+ render() {
+ return (
+ {this.props.data.message}
+ + {this.props.data.status === ScanStatus.USED ? +
+
+ {this.props.data.status === ScanStatus.USED ? +
+ );
+ }
+}
+
+export default T1005;
diff --git a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1016.js b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1016.js
new file mode 100644
index 000000000..63e2bb4a5
--- /dev/null
+++ b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1016.js
@@ -0,0 +1,39 @@
+import React from 'react';
+import '../../../styles/Collapse.scss'
+import ReactTable from "react-table";
+import { renderMachineFromSystemData, renderUsageFields, ScanStatus } from "./Helpers"
+
+
+class T1016 extends React.Component {
+
+ constructor(props) {
+ super(props);
+ }
+
+ static getNetworkInfoColumns() {
+ return ([{
+ Header: "Network configuration info gathered",
+ columns: [
+ {Header: 'Machine', id: 'machine', accessor: x => renderMachineFromSystemData(x.machine), style: { 'whiteSpace': 'unset' }},
+ {Header: 'Network info', id: 'info', accessor: x => renderUsageFields(x.info), style: { 'whiteSpace': 'unset' }},
+ ]
+ }])};
+
+ render() {
+ return (
+ {this.props.data.message}
+ + {this.props.data.status === ScanStatus.USED ? +
+
+ {this.props.data.status === ScanStatus.USED ? +
+ );
+ }
+}
+
+export default T1016;
diff --git a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1018.js b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1018.js
new file mode 100644
index 000000000..dcf7687db
--- /dev/null
+++ b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1018.js
@@ -0,0 +1,48 @@
+import React from 'react';
+import '../../../styles/Collapse.scss'
+import ReactTable from "react-table";
+import { renderMachineFromSystemData, renderMachine, ScanStatus } from "./Helpers"
+
+
+class T1018 extends React.Component {
+
+ constructor(props) {
+ super(props);
+ }
+
+ static renderMachines(machines){
+ let output = [];
+ machines.forEach(function(machine){
+ output.push(renderMachine(machine))
+ });
+ return ({this.props.data.message}
+ + {this.props.data.status === ScanStatus.USED ? +
{output}
);
+ }
+
+ static getScanInfoColumns() {
+ return ([{
+ columns: [
+ {Header: 'Machine', id: 'machine', accessor: x => renderMachineFromSystemData(x.monkey), style: { 'whiteSpace': 'unset' }},
+ {Header: 'First scan', id: 'started', accessor: x => x.started, style: { 'whiteSpace': 'unset' }},
+ {Header: 'Last scan', id: 'finished', accessor: x => x.finished, style: { 'whiteSpace': 'unset' }},
+ {Header: 'Systems found', id: 'systems', accessor: x => T1018.renderMachines(x.machines), style: { 'whiteSpace': 'unset' }},
+ ]
+ }])};
+
+ render() {
+ return (
+
+
+ {this.props.data.status === ScanStatus.USED ? +
+ );
+ }
+}
+
+export default T1018;
diff --git a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1021.js b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1021.js
new file mode 100644
index 000000000..ce8688af1
--- /dev/null
+++ b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1021.js
@@ -0,0 +1,44 @@
+import React from 'react';
+import '../../../styles/Collapse.scss'
+import ReactTable from "react-table";
+import { renderMachine, ScanStatus } from "./Helpers"
+
+
+class T1021 extends React.Component {
+
+ constructor(props) {
+ super(props);
+ }
+
+ static getServiceColumns() {
+ return ([{
+ columns: [
+ {Header: 'Machine', id: 'machine', accessor: x => renderMachine(x.machine),
+ style: { 'whiteSpace': 'unset' }, width: 160},
+ {Header: 'Service', id: 'service', accessor: x => x.info.display_name, style: { 'whiteSpace': 'unset' }, width: 100},
+ {Header: 'Valid account used', id: 'credentials', accessor: x => this.renderCreds(x.successful_creds), style: { 'whiteSpace': 'unset' }},
+ ]
+ }])};
+
+ static renderCreds(creds) {
+ return {creds.map(cred => {this.props.data.message}
+ + {this.props.data.status === ScanStatus.USED ? +
{cred}
)}
+ };
+
+ render() {
+ return (
+
+
+ {this.props.data.status === ScanStatus.USED ? +
+ );
+ }
+}
+
+export default T1021;
diff --git a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1035.js b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1035.js
new file mode 100644
index 000000000..7345ca497
--- /dev/null
+++ b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1035.js
@@ -0,0 +1,30 @@
+import React from 'react';
+import '../../../styles/Collapse.scss'
+import ReactTable from "react-table";
+import { getUsageColumns } from "./Helpers"
+
+
+class T1035 extends React.Component {
+
+ constructor(props) {
+ super(props);
+ }
+
+ render() {
+ return (
+ {this.props.data.message}
+ + {this.props.data.status === ScanStatus.USED ? +
+
+ {this.props.data.services.length !== 0 ? +
+ );
+ }
+}
+
+export default T1035;
diff --git a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1041.js b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1041.js
new file mode 100644
index 000000000..3d6b45d08
--- /dev/null
+++ b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1041.js
@@ -0,0 +1,37 @@
+import React from 'react';
+import '../../../styles/Collapse.scss'
+import ReactTable from "react-table";
+import {ScanStatus} from "./Helpers";
+
+class T1041 extends React.Component {
+
+ constructor(props) {
+ super(props);
+ }
+
+ static getC2Columns() {
+ return ([{
+ Header: "Data exfiltration channels",
+ columns: [
+ {Header: 'Source', id: 'src', accessor: x => x.src, style: { 'whiteSpace': 'unset' }},
+ {Header: 'Destination', id: 'dst', accessor: x => x.dst, style: { 'whiteSpace': 'unset' }}
+ ]}])};
+
+ render() {
+ return (
+ {this.props.data.message}
+ + {this.props.data.services.length !== 0 ? +
+
+ {this.props.data.status === ScanStatus.USED ? +
+ );
+ }
+}
+
+export default T1041;
diff --git a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1059.js b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1059.js
new file mode 100644
index 000000000..4651f5c41
--- /dev/null
+++ b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1059.js
@@ -0,0 +1,40 @@
+import React from 'react';
+import '../../../styles/Collapse.scss'
+import ReactTable from "react-table";
+import { renderMachine, ScanStatus } from "./Helpers"
+
+
+class T1059 extends React.Component {
+
+ constructor(props) {
+ super(props);
+ }
+
+ static getCommandColumns() {
+ return ([{
+ Header: 'Example commands used',
+ columns: [
+ {Header: 'Machine', id: 'machine', accessor: x => renderMachine(x.data.machine), style: { 'whiteSpace': 'unset'}, width: 160 },
+ {Header: 'Approx. Time', id: 'time', accessor: x => x.data.info.finished, style: { 'whiteSpace': 'unset' }},
+ {Header: 'Command', id: 'command', accessor: x => x.data.info.executed_cmds.cmd, style: { 'whiteSpace': 'unset' }},
+ ]
+ }])};
+
+ render() {
+ return (
+ {this.props.data.message}
+ + {this.props.data.status === ScanStatus.USED ? +
+
+ {this.props.data.status === ScanStatus.USED ? +
+ );
+ }
+}
+
+export default T1059;
diff --git a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1064.js b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1064.js
new file mode 100644
index 000000000..f57abd4b8
--- /dev/null
+++ b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1064.js
@@ -0,0 +1,30 @@
+import React from 'react';
+import '../../../styles/Collapse.scss'
+import ReactTable from "react-table";
+import { getUsageColumns } from "./Helpers"
+
+
+class T1064 extends React.Component {
+
+ constructor(props) {
+ super(props);
+ }
+
+ render() {
+ return (
+ {this.props.data.message}
+ + {this.props.data.status === ScanStatus.USED ? +
+
+ {this.props.data.scripts.length !== 0 ? +
+ );
+ }
+}
+
+export default T1064;
diff --git a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1065.js b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1065.js
new file mode 100644
index 000000000..5d5a8df4c
--- /dev/null
+++ b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1065.js
@@ -0,0 +1,16 @@
+import React from 'react';
+import '../../../styles/Collapse.scss'
+
+
+class T1065 extends React.Component {
+
+ render() {
+ return (
+ {this.props.data.message}
+ + {this.props.data.scripts.length !== 0 ? +
+
+ );
+ }
+}
+
+export default T1065;
diff --git a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1075.js b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1075.js
new file mode 100644
index 000000000..3cd12560b
--- /dev/null
+++ b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1075.js
@@ -0,0 +1,49 @@
+import React from 'react';
+import '../../../styles/Collapse.scss'
+import ReactTable from "react-table";
+import { renderMachine, ScanStatus } from "./Helpers"
+
+
+class T1075 extends React.Component {
+
+ constructor(props) {
+ super(props);
+ this.props.data.successful_logins.forEach((login) => this.setLoginHashType(login))
+ }
+
+ setLoginHashType(login){
+ if(login.attempts[0].ntlm_hash !== ""){
+ login.attempts[0].hashType = 'NTLM';
+ } else if(login.attempts[0].lm_hash !== ""){
+ login.attempts[0].hashType = 'LM';
+ }
+ }
+
+ static getHashColumns() {
+ return ([{
+ columns: [
+ {Header: 'Machine', id: 'machine', accessor: x => renderMachine(x.machine), style: { 'whiteSpace': 'unset' }},
+ {Header: 'Service', id: 'service', accessor: x => x.info.display_name, style: { 'whiteSpace': 'unset' }},
+ {Header: 'Username', id: 'username', accessor: x => x.attempts[0].user, style: { 'whiteSpace': 'unset' }},
+ {Header: 'Hash type', id: 'hash', accessor: x => x.attempts[0].hashType, style: { 'whiteSpace': 'unset' }},
+ ]
+ }])};
+
+ render() {
+ return (
+ {this.props.data.message}
+
+
+ {this.props.data.status === ScanStatus.USED ? +
+ );
+ }
+}
+
+export default T1075;
diff --git a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1082.js b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1082.js
new file mode 100644
index 000000000..8570ab1b0
--- /dev/null
+++ b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1082.js
@@ -0,0 +1,38 @@
+import React from 'react';
+import '../../../styles/Collapse.scss'
+import ReactTable from "react-table";
+import { renderMachineFromSystemData, renderUsageFields, ScanStatus } from "./Helpers"
+
+
+class T1082 extends React.Component {
+
+ constructor(props) {
+ super(props);
+ }
+
+ static getSystemInfoColumns() {
+ return ([{
+ columns: [
+ {Header: 'Machine', id: 'machine', accessor: x => renderMachineFromSystemData(x.machine), style: { 'whiteSpace': 'unset' }},
+ {Header: 'Gathered info', id: 'info', accessor: x => renderUsageFields(x.collections), style: { 'whiteSpace': 'unset' }},
+ ]
+ }])};
+
+ render() {
+ return (
+ {this.props.data.message}
+ + {this.props.data.status === ScanStatus.USED ? +
+
+ {this.props.data.status === ScanStatus.USED ? +
+ );
+ }
+}
+
+export default T1082;
diff --git a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1086.js b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1086.js
new file mode 100644
index 000000000..db75d8dda
--- /dev/null
+++ b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1086.js
@@ -0,0 +1,40 @@
+import React from 'react';
+import '../../../styles/Collapse.scss'
+import ReactTable from "react-table";
+import { renderMachine, ScanStatus } from "./Helpers"
+
+
+class T1086 extends React.Component {
+
+ constructor(props) {
+ super(props);
+ }
+
+ static getPowershellColumns() {
+ return ([{
+ Header: 'Example Powershell commands used',
+ columns: [
+ {Header: 'Machine', id: 'machine', accessor: x => renderMachine(x.data[0].machine), style: { 'whiteSpace': 'unset'}, width: 160 },
+ {Header: 'Approx. Time', id: 'time', accessor: x => x.data[0].info.finished, style: { 'whiteSpace': 'unset' }},
+ {Header: 'Command', id: 'command', accessor: x => x.data[0].info.executed_cmds[0].cmd, style: { 'whiteSpace': 'unset' }},
+ ]
+ }])};
+
+ render() {
+ return (
+ {this.props.data.message}
+ + {this.props.data.status === ScanStatus.USED ? +
+
+ {this.props.data.status === ScanStatus.USED ? +
+ );
+ }
+}
+
+export default T1086;
diff --git a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1090.js b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1090.js
new file mode 100644
index 000000000..934e76694
--- /dev/null
+++ b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1090.js
@@ -0,0 +1,39 @@
+import React from 'react';
+import '../../../styles/Collapse.scss'
+import ReactTable from "react-table";
+import { renderMachineFromSystemData, ScanStatus } from "./Helpers"
+
+
+class T1090 extends React.Component {
+
+ constructor(props) {
+ super(props);
+ }
+
+ static getProxyColumns() {
+ return ([{
+ columns: [
+ {Header: 'Machines',
+ id: 'machine',
+ accessor: x => renderMachineFromSystemData(x),
+ style: { 'whiteSpace': 'unset', textAlign: 'center' }}]}])
+ };
+
+ render() {
+ return (
+ {this.props.data.message}
+ + {this.props.data.status === ScanStatus.USED ? +
+
+ {this.props.data.status === ScanStatus.USED ? +
+ );
+ }
+}
+
+export default T1090;
diff --git a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1105.js b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1105.js
new file mode 100644
index 000000000..8acd48c4b
--- /dev/null
+++ b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1105.js
@@ -0,0 +1,40 @@
+import React from 'react';
+import '../../../styles/Collapse.scss'
+import ReactTable from "react-table";
+import { ScanStatus } from "./Helpers"
+
+
+class T1105 extends React.Component {
+
+ constructor(props) {
+ super(props);
+ }
+
+ static getFilesColumns() {
+ return ([{
+ Header: 'Files copied',
+ columns: [
+ {Header: 'Src. Machine', id: 'srcMachine', accessor: x => x.src, style: { 'whiteSpace': 'unset'}, width: 170 },
+ {Header: 'Dst. Machine', id: 'dstMachine', accessor: x => x.dst, style: { 'whiteSpace': 'unset'}, width: 170},
+ {Header: 'Filename', id: 'filename', accessor: x => x.filename, style: { 'whiteSpace': 'unset'}},
+ ]
+ }])};
+
+ render() {
+ return (
+ {this.props.data.message}
+ + {this.props.data.status === ScanStatus.USED ? +
+
+ {this.props.data.status !== ScanStatus.UNSCANNED ? +
+ );
+ }
+}
+
+export default T1105;
diff --git a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1106.js b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1106.js
new file mode 100644
index 000000000..a3210b73c
--- /dev/null
+++ b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1106.js
@@ -0,0 +1,30 @@
+import React from 'react';
+import '../../../styles/Collapse.scss'
+import ReactTable from "react-table";
+import { getUsageColumns } from "./Helpers"
+
+
+class T1106 extends React.Component {
+
+ constructor(props) {
+ super(props);
+ }
+
+ render() {
+ return (
+ {this.props.data.message}
+ + {this.props.data.status !== ScanStatus.UNSCANNED ? +
+
+ {this.props.data.api_uses.length !== 0 ? +
+ );
+ }
+}
+
+export default T1106;
diff --git a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1107.js b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1107.js
new file mode 100644
index 000000000..d80dc3f0e
--- /dev/null
+++ b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1107.js
@@ -0,0 +1,47 @@
+import React from 'react';
+import '../../../styles/Collapse.scss'
+import ReactTable from "react-table";
+import { renderMachineFromSystemData, ScanStatus } from "./Helpers"
+
+
+class T1107 extends React.Component {
+
+ constructor(props) {
+ super(props);
+ }
+
+ static renderDelete(status){
+ if(status === ScanStatus.USED){
+ return Yes
+ } else {
+ return No
+ }
+ }
+
+ static getDeletedFileColumns() {
+ return ([{
+ columns: [
+ {Header: 'Machine', id: 'machine', accessor: x => renderMachineFromSystemData(x._id.machine), style: { 'whiteSpace': 'unset' }},
+ {Header: 'Path', id: 'path', accessor: x => x._id.path, style: { 'whiteSpace': 'unset' }},
+ {Header: 'Deleted?', id: 'deleted', accessor: x => this.renderDelete(x._id.status),
+ style: { 'whiteSpace': 'unset' }, width: 160}]
+ }])};
+
+ render() {
+ return (
+ {this.props.data.message}
+ + {this.props.data.api_uses.length !== 0 ? +
+
+ {this.props.data.deleted_files.length !== 0 ? +
+ );
+ }
+}
+
+export default T1107;
diff --git a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1110.js b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1110.js
new file mode 100644
index 000000000..da9682da3
--- /dev/null
+++ b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1110.js
@@ -0,0 +1,47 @@
+import React from 'react';
+import '../../../styles/Collapse.scss'
+import ReactTable from "react-table";
+import { renderMachine, ScanStatus } from "./Helpers"
+
+
+class T1110 extends React.Component {
+
+ constructor(props) {
+ super(props);
+ }
+
+ static getServiceColumns() {
+ return ([{
+ columns: [
+ {Header: 'Machine', id: 'machine', accessor: x => renderMachine(x.machine),
+ style: { 'whiteSpace': 'unset' }, width: 160},
+ {Header: 'Service', id: 'service', accessor: x => x.info.display_name, style: { 'whiteSpace': 'unset' }, width: 100},
+ {Header: 'Started', id: 'started', accessor: x => x.info.started, style: { 'whiteSpace': 'unset' }},
+ {Header: 'Finished', id: 'finished', accessor: x => x.info.finished, style: { 'whiteSpace': 'unset' }},
+ {Header: 'Attempts', id: 'attempts', accessor: x => x.attempt_cnt, style: { 'whiteSpace': 'unset' }, width: 160},
+ {Header: 'Successful credentials', id: 'credentials', accessor: x => this.renderCreds(x.successful_creds), style: { 'whiteSpace': 'unset' }},
+ ]
+ }])};
+
+ static renderCreds(creds) {
+ return {creds.map(cred => {this.props.data.message}
+ + {this.props.data.deleted_files.length !== 0 ? +
{cred}
)}
+ };
+
+ render() {
+ return (
+
+
+ {this.props.data.status !== ScanStatus.UNSCANNED ? +
+ );
+ }
+}
+
+export default T1110;
diff --git a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1129.js b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1129.js
new file mode 100644
index 000000000..64db13f81
--- /dev/null
+++ b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1129.js
@@ -0,0 +1,29 @@
+import React from 'react';
+import '../../../styles/Collapse.scss'
+import ReactTable from "react-table";
+import {getUsageColumns} from "./Helpers";
+
+class T1129 extends React.Component {
+
+ constructor(props) {
+ super(props);
+ }
+
+ render() {
+ return (
+ {this.props.data.message}
+ + {this.props.data.status !== ScanStatus.UNSCANNED ? +
+
+ {this.props.data.dlls.length !== 0 ? +
+ );
+ }
+}
+
+export default T1129;
diff --git a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1145.js b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1145.js
new file mode 100644
index 000000000..641602dc5
--- /dev/null
+++ b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1145.js
@@ -0,0 +1,53 @@
+import React from 'react';
+import '../../../styles/Collapse.scss'
+import ReactTable from "react-table";
+import { renderMachineFromSystemData, ScanStatus } from "./Helpers"
+
+
+class T1145 extends React.Component {
+
+ constructor(props) {
+ super(props);
+ }
+
+ static renderSSHKeys(keys){
+ let output = [];
+ keys.forEach(function(keyInfo){
+ output.push({this.props.data.message}
+ + {this.props.data.dlls.length !== 0 ? +
+ SSH key pair used by {keyInfo['name']} user found in {keyInfo['home_dir']}
)
+ });
+ return ({output}
);
+ }
+
+ static getKeysInfoColumns() {
+ return ([{
+ columns: [
+ {Header: 'Machine',
+ id: 'machine',
+ accessor: x => renderMachineFromSystemData(x.machine),
+ style: { 'whiteSpace': 'unset' }},
+ {Header: 'Keys found',
+ id: 'keys',
+ accessor: x => T1145.renderSSHKeys(x.ssh_info),
+ style: { 'whiteSpace': 'unset' }},
+ ]
+ }])};
+
+ render() {
+ return (
+
+
+ {this.props.data.status === ScanStatus.USED ? +
+ );
+ }
+}
+
+export default T1145;
diff --git a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1188.js b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1188.js
new file mode 100644
index 000000000..31be117a9
--- /dev/null
+++ b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1188.js
@@ -0,0 +1,49 @@
+import React from 'react';
+import '../../../styles/Collapse.scss'
+import ReactTable from "react-table";
+import { renderMachineFromSystemData, ScanStatus } from "./Helpers"
+
+
+class T1188 extends React.Component {
+
+ constructor(props) {
+ super(props);
+ }
+
+ static getHopColumns() {
+ return ([{
+ Header: "Communications through multi-hop proxies",
+ columns: [
+ {Header: 'From',
+ id: 'from',
+ accessor: x => renderMachineFromSystemData(x.from),
+ style: { 'whiteSpace': 'unset' }},
+ {Header: 'To',
+ id: 'to',
+ accessor: x => renderMachineFromSystemData(x.to),
+ style: { 'whiteSpace': 'unset' }},
+ {Header: 'Hops',
+ id: 'hops',
+ accessor: x => x.count,
+ style: { 'whiteSpace': 'unset' }},
+ ]
+ }])};
+
+ render() {
+ return (
+ {this.props.data.message}
+ + {this.props.data.status === ScanStatus.USED ? +
+
+ {this.props.data.status === ScanStatus.USED ? +
+ );
+ }
+}
+
+export default T1188;
diff --git a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1197.js b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1197.js
new file mode 100644
index 000000000..8dc655aee
--- /dev/null
+++ b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1197.js
@@ -0,0 +1,52 @@
+import React from 'react';
+import '../../../styles/Collapse.scss'
+import ReactTable from "react-table";
+import { renderMachine } from "./Helpers"
+
+
+class T1210 extends React.Component {
+
+ constructor(props) {
+ super(props);
+ this.columns = [ {Header: 'Machine',
+ id: 'machine', accessor: x => renderMachine(x),
+ style: { 'whiteSpace': 'unset' },
+ width: 200},
+ {Header: 'Time',
+ id: 'time', accessor: x => x.time,
+ style: { 'whiteSpace': 'unset' },
+ width: 170},
+ {Header: 'Usage',
+ id: 'usage', accessor: x => x.usage,
+ style: { 'whiteSpace': 'unset' }}
+ ]
+ }
+
+ renderExploitedMachines(){
+ if (this.props.data.bits_jobs.length === 0){
+ return ()
+ } else {
+ return ({this.props.data.message}
+ + {this.props.data.status === ScanStatus.USED ? +
+
+ {this.renderExploitedMachines()} +
+ );
+ }
+}
+
+export default T1210;
diff --git a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1210.js b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1210.js
new file mode 100644
index 000000000..9b6266efa
--- /dev/null
+++ b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1210.js
@@ -0,0 +1,96 @@
+import React from 'react';
+import '../../../styles/Collapse.scss'
+import ReactTable from "react-table";
+import { renderMachine } from "./Helpers"
+
+
+class T1210 extends React.Component {
+
+ constructor(props) {
+ super(props);
+ }
+
+ static getScanColumns() {
+ return ([{
+ Header: "Found services",
+ columns: [
+ {Header: 'Machine', id: 'machine', accessor: x => renderMachine(x.machine),
+ style: { 'whiteSpace': 'unset' }, width: 200},
+ {Header: 'Time', id: 'time', accessor: x => x.time, style: { 'whiteSpace': 'unset' }},
+ {Header: 'Port', id: 'port', accessor: x =>x.service.port, style: { 'whiteSpace': 'unset' }, width: 100},
+ {Header: 'Service', id: 'service', accessor: x => x.service.display_name, style: { 'whiteSpace': 'unset' }}
+ ]
+ }])}
+
+ static getExploitColumns() {
+ return ([{
+ Header: "Exploited services",
+ columns: [
+ {Header: 'Machine', id: 'machine', accessor: x => renderMachine(x.machine),
+ style: { 'whiteSpace': 'unset' }, width: 200},
+ {Header: 'Time', id: 'time', accessor: x => x.time, style: { 'whiteSpace': 'unset' }},
+ {Header: 'Port/url', id: 'port', accessor: x =>this.renderEndpoint(x.service), style: { 'whiteSpace': 'unset' },
+ width: 170},
+ {Header: 'Service', id: 'service', accessor: x => x.service.display_name, style: { 'whiteSpace': 'unset' }}
+ ]
+ }])};
+
+ static renderEndpoint(val){
+ return (
+ {(val.vulnerable_urls.length !== 0 ? val.vulnerable_urls[0] : val.vulnerable_ports[0])}
+ )
+ };
+
+ static formatScanned(data){
+ let result = [];
+ for(let service in data.machine.services){
+ let scanned_service = {'machine': data.machine,
+ 'time': data.time,
+ 'service': {'port': [data.machine.services[service].port],
+ 'display_name': data.machine.services[service].display_name}};
+ result.push(scanned_service)
+ }
+ return result
+ };
+
+ renderScannedServices(data) {
+ return (
+
+
+ {this.props.data.message}
+ {this.props.data.bits_jobs.length > 0 ? BITS jobs were used in these machines:
: ''}
+ + {this.renderExploitedMachines()} +
+
+
)
+ }
+
+ renderExploitedServices(data) {
+ return (
+ +
+
+
)
+ }
+
+ render() {
+ let scanned_services = this.props.data.scanned_services.map(T1210.formatScanned).flat();
+ return (
+ +
+
+ );
+ }
+}
+
+export default T1210;
diff --git a/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1222.js b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1222.js
new file mode 100644
index 000000000..712512bcb
--- /dev/null
+++ b/monkey/monkey_island/cc/ui/src/components/attack/techniques/T1222.js
@@ -0,0 +1,39 @@
+import React from 'react';
+import '../../../styles/Collapse.scss'
+import ReactTable from "react-table";
+import { renderMachine, ScanStatus } from "./Helpers"
+
+
+class T1222 extends React.Component {
+
+ constructor(props) {
+ super(props);
+ }
+
+ static getCommandColumns() {
+ return ([{
+ Header: "Permission modification commands",
+ columns: [
+ {Header: 'Machine', id: 'machine', accessor: x => renderMachine(x.machine), style: { 'whiteSpace': 'unset' }},
+ {Header: 'Command', id: 'command', accessor: x => x.command, style: { 'whiteSpace': 'unset' }},
+ ]
+ }])};
+
+ render() {
+ return (
+ {this.props.data.message}
+ {scanned_services.length > 0 ?
+ this.renderScannedServices(scanned_services) : ''}
+ {this.props.data.exploited_services.length > 0 ?
+ this.renderExploitedServices(this.props.data.exploited_services) : ''}
+
+
+ {this.props.data.status === ScanStatus.USED ? +
+ );
+ }
+}
+
+export default T1222;
diff --git a/monkey/monkey_island/cc/ui/src/components/pages/ConfigurePage.js b/monkey/monkey_island/cc/ui/src/components/pages/ConfigurePage.js
index a97447df0..43dac797c 100644
--- a/monkey/monkey_island/cc/ui/src/components/pages/ConfigurePage.js
+++ b/monkey/monkey_island/cc/ui/src/components/pages/ConfigurePage.js
@@ -1,54 +1,137 @@
import React from 'react';
import Form from 'react-jsonschema-form';
-import {Col, Nav, NavItem} from 'react-bootstrap';
+import {Col, Modal, Nav, NavItem} from 'react-bootstrap';
import fileDownload from 'js-file-download';
import AuthComponent from '../AuthComponent';
+import { FilePond } from 'react-filepond';
+import 'filepond/dist/filepond.min.css';
+import MatrixComponent from "../attack/MatrixComponent";
+
+const ATTACK_URL = '/api/attack';
+const CONFIG_URL = '/api/configuration/island';
class ConfigurePageComponent extends AuthComponent {
+
constructor(props) {
super(props);
-
- this.currentSection = 'basic';
+ this.PBAwindowsPond = null;
+ this.PBAlinuxPond = null;
+ this.currentSection = 'attack';
this.currentFormData = {};
- this.sectionsOrder = ['basic', 'basic_network', 'monkey', 'cnc', 'network', 'exploits', 'internal'];
-
+ this.initialConfig = {};
+ this.initialAttackConfig = {};
+ this.sectionsOrder = ['attack', 'basic', 'basic_network', 'monkey', 'cnc', 'network', 'exploits', 'internal'];
+ this.uiSchemas = this.getUiSchemas();
// set schema from server
this.state = {
schema: {},
configuration: {},
+ attackConfig: {},
lastAction: 'none',
sections: [],
- selectedSection: 'basic',
- allMonkeysAreDead: true
+ selectedSection: 'attack',
+ allMonkeysAreDead: true,
+ PBAwinFile: [],
+ PBAlinuxFile: [],
+ showAttackAlert: false
};
}
- componentDidMount() {
- this.authFetch('/api/configuration')
- .then(res => res.json())
- .then(res => {
+ getUiSchemas(){
+ return ({
+ basic: {"ui:order": ["general", "credentials"]},
+ basic_network: {},
+ monkey: {
+ behaviour: {
+ custom_PBA_linux_cmd: {
+ "ui:widget": "textarea",
+ "ui:emptyValue": ""
+ },
+ PBA_linux_file: {
+ "ui:widget": this.PBAlinux
+ },
+ custom_PBA_windows_cmd: {
+ "ui:widget": "textarea",
+ "ui:emptyValue": ""
+ },
+ PBA_windows_file: {
+ "ui:widget": this.PBAwindows
+ },
+ PBA_linux_filename: {
+ classNames: "linux-pba-file-info",
+ "ui:emptyValue": ""
+ },
+ PBA_windows_filename: {
+ classNames: "windows-pba-file-info",
+ "ui:emptyValue": ""
+ }
+ }
+ },
+ cnc: {},
+ network: {},
+ exploits: {},
+ internal: {}
+ })
+ }
+
+ setInitialConfig(config) {
+ // Sets a reference to know if config was changed
+ this.initialConfig = JSON.parse(JSON.stringify(config));
+ }
+
+ setInitialAttackConfig(attackConfig) {
+ // Sets a reference to know if attack config was changed
+ this.initialAttackConfig = JSON.parse(JSON.stringify(attackConfig));
+ }
+
+ componentDidMount = () => {
+ let urls = [CONFIG_URL, ATTACK_URL];
+ Promise.all(urls.map(url => this.authFetch(url).then(res => res.json())))
+ .then(data => {
let sections = [];
+ let attackConfig = data[1];
+ let monkeyConfig = data[0];
+ this.setInitialConfig(monkeyConfig.configuration);
+ this.setInitialAttackConfig(attackConfig.configuration);
for (let sectionKey of this.sectionsOrder) {
- sections.push({key: sectionKey, title: res.schema.properties[sectionKey].title});
+ if (sectionKey === 'attack') {sections.push({key:sectionKey, title: "ATT&CK"})}
+ else {sections.push({key: sectionKey, title: monkeyConfig.schema.properties[sectionKey].title});}
}
this.setState({
- schema: res.schema,
- configuration: res.configuration,
+ schema: monkeyConfig.schema,
+ configuration: monkeyConfig.configuration,
+ attackConfig: attackConfig.configuration,
sections: sections,
- selectedSection: 'basic'
+ selectedSection: 'attack'
})
});
this.updateMonkeysRunning();
- }
+ };
- onSubmit = ({formData}) => {
- this.currentFormData = formData;
- this.updateConfigSection();
- this.authFetch('/api/configuration',
+ updateConfig = () => {
+ this.authFetch(CONFIG_URL)
+ .then(res => res.json())
+ .then(data => {
+ this.setInitialConfig(data.configuration);
+ this.setState({configuration: data.configuration})
+ })
+ };
+
+ onSubmit = () => {
+ if (this.state.selectedSection === 'attack'){
+ this.matrixSubmit()
+ } else {
+ this.configSubmit()
+ }
+ };
+
+ matrixSubmit = () => {
+ // Submit attack matrix
+ this.authFetch(ATTACK_URL,
{
method: 'POST',
headers: {'Content-Type': 'application/json'},
- body: JSON.stringify(this.state.configuration)
+ body: JSON.stringify(this.state.attackConfig)
})
.then(res => {
if (!res.ok)
@@ -57,6 +140,18 @@ class ConfigurePageComponent extends AuthComponent {
}
return res;
})
+ .then(() => {this.setInitialAttackConfig(this.state.attackConfig);})
+ .then(this.updateConfig())
+ .then(this.setState({lastAction: 'saved'}))
+ .catch(error => {
+ this.setState({lastAction: 'invalid_configuration'});
+ });
+ };
+
+ configSubmit = () => {
+ // Submit monkey configuration
+ this.updateConfigSection();
+ this.sendConfig()
.then(res => res.json())
.then(res => {
this.setState({
@@ -64,6 +159,7 @@ class ConfigurePageComponent extends AuthComponent {
schema: res.schema,
configuration: res.configuration
});
+ this.setInitialConfig(res.configuration);
this.props.onStatusChange();
}).catch(error => {
console.log('bad configuration');
@@ -71,6 +167,32 @@ class ConfigurePageComponent extends AuthComponent {
});
};
+ // Alters attack configuration when user toggles technique
+ attackTechniqueChange = (technique, value, mapped=false) => {
+ // Change value in attack configuration
+ // Go trough each column in matrix, searching for technique
+ Object.entries(this.state.attackConfig).forEach(techType => {
+ if(techType[1].properties.hasOwnProperty(technique)){
+ let tempMatrix = this.state.attackConfig;
+ tempMatrix[techType[0]].properties[technique].value = value;
+ this.setState({attackConfig: tempMatrix});
+
+ // Toggle all mapped techniques
+ if (! mapped ){
+ // Loop trough each column and each row
+ Object.entries(this.state.attackConfig).forEach(otherType => {
+ Object.entries(otherType[1].properties).forEach(otherTech => {
+ // If this technique depends on a technique that was changed
+ if (otherTech[1].hasOwnProperty('depends_on') && otherTech[1]['depends_on'].includes(technique)){
+ this.attackTechniqueChange(otherTech[0], value, true)
+ }
+ })
+ });
+ }
+ }
+ });
+ };
+
onChange = ({formData}) => {
this.currentFormData = formData;
};
@@ -81,10 +203,48 @@ class ConfigurePageComponent extends AuthComponent {
newConfig[this.currentSection] = this.currentFormData;
this.currentFormData = {};
}
- this.setState({configuration: newConfig});
+ this.setState({configuration: newConfig, lastAction: 'none'});
};
+ renderAttackAlertModal = () => {
+ return ({this.props.data.message}
+ + {this.props.data.status === ScanStatus.USED ? +
Warning
+ + You have unsubmitted changes. Submit them before proceeding. +
+
+
+
+ Monkey Configuration
- - { - this.state.selectedSection === 'basic_network' ? -
-
- The Monkey scans its subnet if "Local network scan" is ticked. Additionally the monkey scans machines
- according to its range class.
-
- :
- }
- { this.state.selectedSection ?
-