p20319658
/
monkey
forked from p34709852/monkey
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Add T1168 (linux PBA)

This commit is contained in:
Shreya 2020-06-26 16:17:48 +05:30
parent 37b4717eb1
commit 73c4070f54
10 changed files with 145 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
monkey/common/data/post_breach_consts.py
View File

@ -5,3 +5,4 @@ POST_BREACH_SHELL_STARTUP_FILE_MODIFICATION = "Modify shell startup file"
POST_BREACH_HIDDEN_FILES = "Hide files and directories"
POST_BREACH_TRAP_COMMAND = "Execute command when a particular signal is received"
POST_BREACH_SETUID_SETGID = "Setuid and Setgid"
POST_BREACH_JOB_SCHEDULING = "Schedule jobs"

16
monkey/infection_monkey/post_breach/actions/schedule_jobs.py Normal file
View File

@ -0,0 +1,16 @@
from common.data.post_breach_consts import POST_BREACH_JOB_SCHEDULING
from infection_monkey.post_breach.pba import PBA
from infection_monkey.post_breach.job_scheduling.job_scheduling import\
get_commands_to_schedule_jobs
class ScheduleJobs(PBA):
"""
This PBA attempts to schedule jobs on the system.
"""
def __init__(self):
linux_cmds, windows_cmds = get_commands_to_schedule_jobs()
super(ScheduleJobs, self).__init__(name=POST_BREACH_JOB_SCHEDULING,
linux_cmd=' '.join(linux_cmds),
windows_cmd=windows_cmds)

10
monkey/infection_monkey/post_breach/job_scheduling/job_scheduling.py Normal file
View File

@ -0,0 +1,10 @@
from infection_monkey.post_breach.job_scheduling.linux.job_scheduling import\
get_linux_commands_to_schedule_jobs
from infection_monkey.post_breach.job_scheduling.windows.job_scheduling import\
get_windows_commands_to_schedule_jobs
def get_commands_to_schedule_jobs():
linux_cmds = get_linux_commands_to_schedule_jobs()
windows_cmds = get_windows_commands_to_schedule_jobs()
return linux_cmds, windows_cmds

11
monkey/infection_monkey/post_breach/job_scheduling/linux/job_scheduling.py Normal file
View File

@ -0,0 +1,11 @@
TEMP_CRON = "$HOME/monkey-schedule-jobs"
def get_linux_commands_to_schedule_jobs():
return [
'touch {} &&'.format(TEMP_CRON),
'crontab -l > {} &&'.format(TEMP_CRON),
'echo \"# Successfully scheduled a job using crontab\" |',
'tee -a {} &&'.format(TEMP_CRON),
'crontab {}'.format(TEMP_CRON)
]

2
monkey/infection_monkey/post_breach/job_scheduling/windows/job_scheduling.py Normal file
View File

@ -0,0 +1,2 @@
def get_windows_commands_to_schedule_jobs():
return ''

5
monkey/monkey_island/cc/services/attack/attack_report.py
View File

@ -4,7 +4,7 @@ from monkey_island.cc.models import Monkey
from monkey_island.cc.services.attack.technique_reports import T1210, T1197, T1110, T1075, T1003, T1059, T1086, T1082
from monkey_island.cc.services.attack.technique_reports import T1145, T1105, T1065, T1035, T1129, T1106, T1107, T1188
from monkey_island.cc.services.attack.technique_reports import T1090, T1041, T1222, T1005, T1018, T1016, T1021, T1064
from monkey_island.cc.services.attack.technique_reports import T1136, T1156, T1504, T1158, T1154, T1166
from monkey_island.cc.services.attack.technique_reports import T1136, T1156, T1504, T1158, T1154, T1166, T1168
from monkey_island.cc.services.attack.attack_config import AttackConfig
from monkey_island.cc.database import mongo
from monkey_island.cc.services.reporting.report_generation_synchronisation import safe_generate_attack_report
@ -42,7 +42,8 @@ TECHNIQUES = {'T1210': T1210.T1210,
'T1504': T1504.T1504,
'T1158': T1158.T1158,
'T1154': T1154.T1154,
'T1166': T1166.T1166
'T1166': T1166.T1166,
'T1168': T1168.T1168
}
REPORT_NAME = 'new_report'

13
monkey/monkey_island/cc/services/attack/attack_schema.py
View File

@ -129,6 +129,7 @@ SCHEMA = {
"in certain situations by abusing PowerShell profiles which "
"are scripts that run when PowerShell starts."
},
<<<<<<< HEAD
"T1053": {
"title": "Scheduled task",
"type": "bool",
@ -148,6 +149,18 @@ SCHEMA = {
"description": "Adversaries can set the setuid or setgid bits to get code running in "
"a different user’s context."
}
=======
# "T1053": {
# "title": "Scheduled task",
# "type": "bool",
# "value": True,
# "necessary": False,
# "link": "https://attack.mitre.org/techniques/T1053",
# "description": "Windows utilities can be used to schedule programs or scripts to "
# "be executed at a date and time. An adversary may use task scheduling to "
# "execute programs at system startup or on a scheduled basis for persistence."
# },
>>>>>>> Add T1168 (linux PBA)
}
},
"defence_evasion": {

34
monkey/monkey_island/cc/services/attack/technique_reports/T1168.py Normal file
View File

@ -0,0 +1,34 @@
from monkey_island.cc.services.attack.technique_reports import AttackTechnique
from monkey_island.cc.database import mongo
from common.utils.attack_utils import ScanStatus
from common.data.post_breach_consts import POST_BREACH_JOB_SCHEDULING
__author__ = "shreyamalviya"
class T1168(AttackTechnique):
tech_id = "T1168"
unscanned_msg = "Monkey did not try scheduling a job."
scanned_msg = "Monkey tried scheduling a job on the system but failed."
used_msg = "Monkey scheduled a job on the system."
query = [{'$match': {'telem_category': 'post_breach',
'data.name': POST_BREACH_JOB_SCHEDULING}},
{'$project': {'_id': 0,
'machine': {'hostname': '$data.hostname',
'ips': ['$data.ip']},
'result': '$data.result'}}]
@staticmethod
def get_report_data():
data = {'title': T1168.technique_title()}
job_scheduling_info = list(mongo.db.telemetry.aggregate(T1168.query))
status = (ScanStatus.USED.value if job_scheduling_info[0]['result'][1]
else ScanStatus.SCANNED.value) if job_scheduling_info else ScanStatus.UNSCANNED.value
data.update(T1168.get_base_data_by_status(status))
data.update({'info': job_scheduling_info})
return data

11
monkey/monkey_island/cc/services/config_schema.py
View File

@ -191,6 +191,14 @@ SCHEMA = {
],
"title": "Setuid and Setgid",
"attack_techniques": ["T1166"]
},
{
"type": "string",
"enum": [
"ScheduleJobs"
],
"title": "Job scheduling",
"attack_techniques": ["T1168"]
}
],
},
@ -415,7 +423,8 @@ SCHEMA = {
"ModifyShellStartupFiles",
"HiddenFiles",
"TrapCommand",
"ChangeSetuidSetgid"
"ChangeSetuidSetgid",
"ScheduleJobs"
],
"description": "List of actions the Monkey will run post breach"
},

45
monkey/monkey_island/cc/ui/src/components/attack/techniques/T1168.js Normal file
View File

@ -0,0 +1,45 @@
import React from 'react';
import ReactTable from 'react-table';
import {renderMachineFromSystemData, ScanStatus} from './Helpers';
import MitigationsComponent from './MitigationsComponent';
class T1168 extends React.Component {
constructor(props) {
super(props);
}
static getColumns() {
return ([{
columns: [
{ Header: 'Machine',
id: 'machine',
accessor: x => renderMachineFromSystemData(x.machine),
style: {'whiteSpace': 'unset'}},
{ Header: 'Result',
id: 'result',
accessor: x => x.result,
style: {'whiteSpace': 'unset'}}
]
}])
}
render() {
return (
<div>
<div>{this.props.data.message}</div>
<br/>
{this.props.data.status === ScanStatus.USED ?
<ReactTable
columns={T1168.getColumns()}
data={this.props.data.info}
showPagination={false}
defaultPageSize={this.props.data.info.length}
/> : ''}
<MitigationsComponent mitigations={this.props.data.mitigations}/>
</div>
);
}
}
export default T1168;