* Added missing findings

* switched to using the aws account id from the island's configuration page

monkey/monkey_island/cc/resources/aws_exporter.py

@@ -10,7 +10,8 @@ from cc.environment.environment import load_server_configuration_from_file
 logger = logging.getLogger(__name__)
 
 AWS_CRED_CONFIG_KEYS = [['cnc', 'aws_config', 'aws_access_key_id'],
-                        ['cnc', 'aws_config', 'aws_secret_access_key']]
+                        ['cnc', 'aws_config', 'aws_secret_access_key'],
+                        ['cnc', 'aws_config', 'aws_account_id']]
 
 
 class AWSExporter(Exporter):
@@ -34,7 +35,7 @@ class AWSExporter(Exporter):
     def _get_aws_keys():
         creds_dict = {}
         for key in AWS_CRED_CONFIG_KEYS:
-            creds_dict[key[2]] = ConfigService.get_config_value(key)
+            creds_dict[key[2]] = str(ConfigService.get_config_value(key))
 
         return creds_dict
 
@@ -56,16 +57,28 @@ class AWSExporter(Exporter):
             'smb_pth': AWSExporter._handle_smb_pth_issue,
             'sambacry': AWSExporter._handle_sambacry_issue,
             'shared_passwords': AWSExporter._handle_shared_passwords_issue,
+            'wmi_password': AWSExporter._handle_wmi_password_issue,
+            'wmi_pth': AWSExporter._handle_wmi_pth_issue,
+            'ssh_key': AWSExporter._handle_ssh_key_issue,
+            'rdp': AWSExporter._handle_rdp_issue,
+            'shared_passwords_domain': AWSExporter._handle_shared_passwords_domain_issue,
+            'shared_admins_domain': AWSExporter._handle_shared_admins_domain_issue,
+            'strong_users_on_crit': AWSExporter._handle_strong_users_on_crit_issue,
+            'struts2': AWSExporter._handle_struts2_issue,
+            'weblogic': AWSExporter._handle_weblogic_issue,
+            'hadoop': AWSExporter._handle_hadoop_issue,
+            # azure and conficker are not relevant issues for an AWS env
         }
 
         product_arn = load_server_configuration_from_file()['aws'].get('sec_hub_product_arn', '')
+        account_id = AWSExporter._get_aws_keys().get('aws_account_id', '')
 
         finding = {
             "SchemaVersion": "2018-10-08",
             "Id": uuid.uuid4().hex,
             "ProductArn": product_arn,
             "GeneratorId": issue['type'],
-            "AwsAccountId": "324264561773",
+            "AwsAccountId": account_id,
             "Types": [
                 "Software and Configuration Checks/Vulnerabilities/CVE"
             ],
@@ -93,144 +106,140 @@ class AWSExporter(Exporter):
 
     @staticmethod
     def _handle_tunnel_issue(issue):
-        finding =\
+        finding = \
-            {
+            {"Severity": {
-                "Severity": {
                 "Product": 5,
                 "Normalized": 100
-                },
+            }, "Resources": [{
-                "Resources": [{
                 "Type": "AwsEc2Instance",
                 "Id": issue['aws_instance_id']
-                }],
+            }], "RecordState": "ACTIVE",
-                "RecordState": "ACTIVE",
+                "Title": "Weak segmentation - Machines were able to communicate over unused ports.",
-            }
+                "Description": "Use micro-segmentation policies to disable communication other than the required.",
-
+                "Remediation": {
-        finding["Title"] = "Weak segmentation - Machines were able to communicate over unused ports."
-        finding["Description"] = "Use micro-segmentation policies to disable communication other than the required."
-        finding["Remediation"] = {
                     "Recommendation": {
                         "Text": "Machines are not locked down at port level. Network tunnel was set up from {0} to {1}"
                             .format(issue['machine'], issue['dest'])
                     }
-        }
+                }}
+
         return finding
 
     @staticmethod
     def _handle_sambacry_issue(issue):
         finding = \
-            {
+            {"Severity": {
-                "Severity": {
                 "Product": 10,
                 "Normalized": 100
-                },
+            }, "Resources": [{
-                "Resources": [{
                 "Type": "AwsEc2Instance",
                 "Id": issue['aws_instance_id']
-                }],
+            }], "RecordState": "ACTIVE", "Title": "Samba servers are vulnerable to 'SambaCry'",
-                "RecordState": "ACTIVE",
+                "Description": "Change {0} password to a complex one-use password that is not shared with other computers on the network. Update your Samba server to 4.4.14 and up, 4.5.10 and up, or 4.6.4 and up." \
-            }
+                    .format(issue['username']), "Remediation": {
-
-        finding["Title"] = "Samba servers are vulnerable to 'SambaCry'"
-        finding["Description"] = "Change {0} password to a complex one-use password that is not shared with other computers on the network. Update your Samba server to 4.4.14 and up, 4.5.10 and up, or 4.6.4 and up."\
-            .format(issue['username'])
-        finding["Remediation"] = {
                 "Recommendation": {
-                "Text": "The machine {0} ({1}) is vulnerable to a SambaCry attack. The Monkey authenticated over the SMB protocol with user {2} and its password, and used the SambaCry vulnerability.".format(issue['machine'], issue['ip_address'], issue['username'])
+                    "Text": "The machine {0} ({1}) is vulnerable to a SambaCry attack. The Monkey authenticated over the SMB protocol with user {2} and its password, and used the SambaCry vulnerability.".format(
-            }
+                        issue['machine'], issue['ip_address'], issue['username'])
                 }
+            }}
+
         return finding
 
     @staticmethod
     def _handle_smb_pth_issue(issue):
         finding = \
-            {
+            {"Severity": {
-                "Severity": {
                 "Product": 5,
                 "Normalized": 100
-                },
+            }, "Resources": [{
-                "Resources": [{
                 "Type": "AwsEc2Instance",
                 "Id": issue['aws_instance_id']
-                }],
+            }], "RecordState": "ACTIVE",
-                "RecordState": "ACTIVE",
+                "Title": "Machines are accessible using passwords supplied by the user during the Monkey's configuration.",
-            }
+                "Description": "Change {0}'s password to a complex one-use password that is not shared with other computers on the network.".format(
-
+                    issue['username']), "Remediation": {
-        finding["Title"] = "Machines are accessible using passwords supplied by the user during the Monkey's configuration."
-        finding["Description"] = "Change {0}'s password to a complex one-use password that is not shared with other computers on the network.".format(issue['username'])
-        finding["Remediation"] = {
                 "Recommendation": {
-                "Text": "The machine {0}({1}) is vulnerable to a SMB attack. The Monkey used a pass-the-hash attack over SMB protocol with user {2}.".format(issue['machine'], issue['ip_address'], issue['username'])
+                    "Text": "The machine {0}({1}) is vulnerable to a SMB attack. The Monkey used a pass-the-hash attack over SMB protocol with user {2}.".format(
-            }
+                        issue['machine'], issue['ip_address'], issue['username'])
                 }
+            }}
+
         return finding
 
     @staticmethod
     def _handle_ssh_issue(issue):
         finding = \
-            {
+            {"Severity": {
-                "Severity": {
                 "Product": 1,
                 "Normalized": 100
-                },
+            }, "Resources": [{
-                "Resources": [{
                 "Type": "AwsEc2Instance",
                 "Id": issue['aws_instance_id']
-                }],
+            }], "RecordState": "ACTIVE",
-                "RecordState": "ACTIVE",
+                "Title": "Machines are accessible using SSH passwords supplied by the user during the Monkey's configuration.",
-            }
+                "Description": "Change {0}'s password to a complex one-use password that is not shared with other computers on the network.".format(
-
+                    issue['username']), "Remediation": {
-        finding["Title"] = "Machines are accessible using SSH passwords supplied by the user during the Monkey's configuration."
-        finding["Description"] = "Change {0}'s password to a complex one-use password that is not shared with other computers on the network.".format(issue['username'])
-        finding["Remediation"] = {
                 "Recommendation": {
-                "Text": "The machine {0} ({1}) is vulnerable to a SSH attack. The Monkey authenticated over the SSH protocol with user {2} and its password.".format(issue['machine'], issue['ip_address'], issue['username'])
+                    "Text": "The machine {0} ({1}) is vulnerable to a SSH attack. The Monkey authenticated over the SSH protocol with user {2} and its password.".format(
+                        issue['machine'], issue['ip_address'], issue['username'])
                 }
+            }}
+
+        return finding
+
+    @staticmethod
+    def _handle_ssh_key_issue(issue):
+        finding = \
+            {"Severity": {
+                "Product": 1,
+                "Normalized": 100
+            }, "Resources": [{
+                "Type": "AwsEc2Instance",
+                "Id": issue['aws_instance_id']
+            }], "RecordState": "ACTIVE",
+                "Title": "Machines are accessible using SSH passwords supplied by the user during the Monkey's configuration.",
+                "Description": "Protect {ssh_key} private key with a pass phrase.".format(ssh_key=issue['ssh_key']),
+                "Remediation": {
+                    "Recommendation": {
+                        "Text": "The machine {machine} ({ip_address}) is vulnerable to a SSH attack. The Monkey authenticated over the SSH protocol with private key {ssh_key}.".format(
+                            machine=issue['machine'], ip_address=issue['ip_address'], ssh_key=issue['ssh_key'])
                     }
+                }}
+
         return finding
 
     @staticmethod
     def _handle_elastic_issue(issue):
         finding = \
-            {
+            {"Severity": {
-                "Severity": {
                 "Product": 10,
                 "Normalized": 100
-                },
+            }, "Resources": [{
-                "Resources": [{
                 "Type": "AwsEc2Instance",
                 "Id": issue['aws_instance_id']
-                }],
+            }], "RecordState": "ACTIVE", "Title": "Elasticsearch servers are vulnerable to CVE-2015-1427",
-                "RecordState": "ACTIVE",
+                "Description": "Update your Elastic Search server to version 1.4.3 and up.", "Remediation": {
-            }
-
-        finding["Title"] = "Elasticsearch servers are vulnerable to CVE-2015-1427"
-        finding["Description"] = "Update your Elastic Search server to version 1.4.3 and up."
-        finding["Remediation"] = {
                 "Recommendation": {
-                "Text": "The machine {0}({1}) is vulnerable to an Elastic Groovy attack. The attack was made possible because the Elastic Search server was not patched against CVE-2015-1427.".format(issue['machine'], issue['ip_address'])
+                    "Text": "The machine {0}({1}) is vulnerable to an Elastic Groovy attack. The attack was made possible because the Elastic Search server was not patched against CVE-2015-1427.".format(
-            }
+                        issue['machine'], issue['ip_address'])
                 }
+            }}
+
         return finding
 
     @staticmethod
     def _handle_island_cross_segment_issue(issue):
         finding = \
-            {
+            {"Severity": {
-                "Severity": {
                 "Product": 1,
                 "Normalized": 100
-                },
+            }, "Resources": [{
-                "Resources": [{
                 "Type": "AwsEc2Instance",
                 "Id": issue['aws_instance_id']
-                }],
+            }], "RecordState": "ACTIVE",
-                "RecordState": "ACTIVE",
+                "Title": "Weak segmentation - Machines from different segments are able to communicate.",
-            }
+                "Description": "Segment your network and make sure there is no communication between machines from different segments.",
-
+                "Remediation": {
-        finding["Title"] = "Weak segmentation - Machines from different segments are able to communicate."
-        finding["Description"] = "egment your network and make sure there is no communication between machines from different segments."
-        finding["Remediation"] = {
                     "Recommendation": {
                         "Text": "The network can probably be segmented. A monkey instance on \
                         {0} in the networks {1} \
@@ -238,77 +247,252 @@ class AWSExporter(Exporter):
                                                                                                     issue['networks'],
                                                                                                     issue['server_networks'])
                     }
-        }
+                }}
+
         return finding
 
     @staticmethod
     def _handle_shared_passwords_issue(issue):
         finding = \
-            {
+            {"Severity": {
-                "Severity": {
                 "Product": 1,
                 "Normalized": 100
-                },
+            }, "Resources": [{
-                "Resources": [{
                 "Type": "AwsEc2Instance",
                 "Id": issue['aws_instance_id']
-                }],
+            }], "RecordState": "ACTIVE", "Title": "Multiple users have the same password",
-                "RecordState": "ACTIVE",
+                "Description": "Some users are sharing passwords, this should be fixed by changing passwords.",
-            }
+                "Remediation": {
-
-        finding["Title"] = "Multiple users have the same password"
-        finding["Description"] = "Some users are sharing passwords, this should be fixed by changing passwords."
-        finding["Remediation"] = {
                     "Recommendation": {
                         "Text": "These users are sharing access password: {0}.".format(issue['shared_with'])
                     }
-        }
+                }}
+
         return finding
 
     @staticmethod
     def _handle_shellshock_issue(issue):
         finding = \
-            {
+            {"Severity": {
-                "Severity": {
                 "Product": 10,
                 "Normalized": 100
-                },
+            }, "Resources": [{
-                "Resources": [{
                 "Type": "AwsEc2Instance",
                 "Id": issue['aws_instance_id']
-                }],
+            }], "RecordState": "ACTIVE", "Title": "Machines are vulnerable to 'Shellshock'",
-                "RecordState": "ACTIVE",
+                "Description": "Update your Bash to a ShellShock-patched version.", "Remediation": {
-            }
-
-        finding["Title"] = "Machines are vulnerable to 'Shellshock'"
-        finding["Description"] = "Update your Bash to a ShellShock-patched version."
-        finding["Remediation"] = {
                 "Recommendation": {
-                "Text": "The machine {0} ({1}) is vulnerable to a ShellShock attack. The attack was made possible because the HTTP server running on TCP port {2} was vulnerable to a shell injection attack on the paths: {3}.".format(issue['machine'], issue['ip_address'], issue['port'], issue['paths'])
+                    "Text": "The machine {0} ({1}) is vulnerable to a ShellShock attack. "
-            }
+                            "The attack was made possible because the HTTP server running on TCP port {2} was vulnerable to a shell injection attack on the paths: {3}.".format(
+                        issue['machine'], issue['ip_address'], issue['port'], issue['paths'])
                 }
+            }}
+
         return finding
 
     @staticmethod
     def _handle_smb_password_issue(issue):
         finding = \
-            {
+            {"Severity": {
-                "Severity": {
                 "Product": 1,
                 "Normalized": 100
-                },
+            }, "Resources": [{
-                "Resources": [{
                 "Type": "AwsEc2Instance",
                 "Id": issue['aws_instance_id']
-                }],
+            }], "RecordState": "ACTIVE",
-                "RecordState": "ACTIVE",
+                "Title": "Machines are accessible using passwords supplied by the user during the Monkey's configuration.",
-            }
+                "Description": "Change {0}'s password to a complex one-use password that is not shared with other computers on the network.".format(
-
+                    issue['username']), "Remediation": {
-        finding["Title"] = "Machines are accessible using passwords supplied by the user during the Monkey's configuration."
-        finding["Description"] = "Change {0}'s password to a complex one-use password that is not shared with other computers on the network."
-        finding["Remediation"] = {
                 "Recommendation": {
-                "Text": "The machine {0} ({1}) is vulnerable to a SMB attack. The Monkey authenticated over the SMB protocol with user {2} and its password.".format(issue['machine'], issue['ip_address'], issue['username'])
+                    "Text": "The machine {0} ({1}) is vulnerable to a SMB attack. The Monkey authenticated over the SMB protocol with user {2} and its password.".format(
-            }
+                        issue['machine'], issue['ip_address'], issue['username'])
                 }
+            }}
+
+        return finding
+
+    @staticmethod
+    def _handle_wmi_password_issue(issue):
+        finding = \
+            {"Severity": {
+                "Product": 1,
+                "Normalized": 100
+            }, "Resources": [{
+                "Type": "AwsEc2Instance",
+                "Id": issue['aws_instance_id']
+            }], "RecordState": "ACTIVE",
+                "Title": "Machines are accessible using passwords supplied by the user during the Monkey's configuration.",
+                "Description": "Change {0}'s password to a complex one-use password that is not shared with other computers on the network.",
+                "Remediation": {
+                    "Recommendation": {
+                        "Text": "The machine machine ({ip_address}) is vulnerable to a WMI attack. The Monkey authenticated over the WMI protocol with user {username} and its password.".format(
+                            machine=issue['machine'], ip_address=issue['ip_address'], username=issue['username'])
+                    }
+                }}
+
+        return finding
+
+    @staticmethod
+    def _handle_wmi_pth_issue(issue):
+        finding = \
+            {"Severity": {
+                "Product": 1,
+                "Normalized": 100
+            }, "Resources": [{
+                "Type": "AwsEc2Instance",
+                "Id": issue['aws_instance_id']
+            }], "RecordState": "ACTIVE",
+                "Title": "Machines are accessible using passwords supplied by the user during the Monkey's configuration.",
+                "Description": "Change {0}'s password to a complex one-use password that is not shared with other computers on the network.".format(
+                    issue['username']), "Remediation": {
+                "Recommendation": {
+                    "Text": "The machine machine ({ip_address}) is vulnerable to a WMI attack. The Monkey used a pass-the-hash attack over WMI protocol with user {username}".format(
+                        machine=issue['machine'], ip_address=issue['ip_address'], username=issue['username'])
+                }
+            }}
+
+        return finding
+
+    @staticmethod
+    def _handle_rdp_issue(issue):
+        finding = \
+            {"Severity": {
+                "Product": 1,
+                "Normalized": 100
+            }, "Resources": [{
+                "Type": "AwsEc2Instance",
+                "Id": issue['aws_instance_id']
+            }], "RecordState": "ACTIVE",
+                "Title": "Machines are accessible using passwords supplied by the user during the Monkey's configuration.",
+                "Description": "Change {0}'s password to a complex one-use password that is not shared with other computers on the network.".format(
+                    issue['username']), "Remediation": {
+                "Recommendation": {
+                    "Text": "The machine machine ({ip_address}) is vulnerable to a RDP attack. The Monkey authenticated over the RDP protocol with user {username} and its password.".format(
+                        machine=issue['machine'], ip_address=issue['ip_address'], username=issue['username'])
+                }
+            }}
+
+        return finding
+
+    @staticmethod
+    def _handle_shared_passwords_domain_issue(issue):
+        finding = \
+            {"Severity": {
+                "Product": 1,
+                "Normalized": 100
+            }, "Resources": [{
+                "Type": "AwsEc2Instance",
+                "Id": issue['aws_instance_id']
+            }], "RecordState": "ACTIVE", "Title": "Multiple users have the same password.",
+                "Description": "Some domain users are sharing passwords, this should be fixed by changing passwords.",
+                "Remediation": {
+                    "Recommendation": {
+                        "Text": "These users are sharing access password: {shared_with}.".format(
+                            shared_with=issue['shared_with'])
+                    }
+                }}
+
+        return finding
+
+    @staticmethod
+    def _handle_shared_admins_domain_issue(issue):
+        finding = \
+            {"Severity": {
+                "Product": 1,
+                "Normalized": 100
+            }, "Resources": [{
+                "Type": "AwsEc2Instance",
+                "Id": issue['aws_instance_id']
+            }], "RecordState": "ACTIVE",
+                "Title": "Shared local administrator account - Different machines have the same account as a local administrator.",
+                "Description": "Make sure the right administrator accounts are managing the right machines, and that there isn\'t an unintentional local admin sharing.",
+                "Remediation": {
+                    "Recommendation": {
+                        "Text": "Here is a list of machines which the account {username} is defined as an administrator: {shared_machines}".format(
+                            username=issue['username'], shared_machines=issue['shared_machines'])
+                    }
+                }}
+
+        return finding
+
+    @staticmethod
+    def _handle_strong_users_on_crit_issue(issue):
+        finding = \
+            {"Severity": {
+                "Product": 1,
+                "Normalized": 100
+            }, "Resources": [{
+                "Type": "AwsEc2Instance",
+                "Id": issue['aws_instance_id']
+            }], "RecordState": "ACTIVE",
+                "Title": "Mimikatz found login credentials of a user who has admin access to a server defined as critical.",
+                "Description": "This critical machine is open to attacks via strong users with access to it.",
+                "Remediation": {
+                    "Recommendation": {
+                        "Text": "The services: {services} have been found on the machine thus classifying it as a critical machine. These users has access to it:{threatening_users}.".format(
+                            services=issue['services'], threatening_users=issue['threatening_users'])
+                    }
+                }}
+
+        return finding
+
+    @staticmethod
+    def _handle_struts2_issue(issue):
+        finding = \
+            {"Severity": {
+                "Product": 10,
+                "Normalized": 100
+            }, "Resources": [{
+                "Type": "AwsEc2Instance",
+                "Id": issue['aws_instance_id']
+            }], "RecordState": "ACTIVE", "Title": "Struts2 servers are vulnerable to remote code execution.",
+                "Description": "Upgrade Struts2 to version 2.3.32 or 2.5.10.1 or any later versions.", "Remediation": {
+                "Recommendation": {
+                    "Text": "Struts2 server at {machine} ({ip_address}) is vulnerable to remote code execution attack."
+                            " The attack was made possible because the server is using an old version of Jakarta based file upload Multipart parser.".format(
+                        machine=issue['machine'], ip_address=issue['ip_address'])
+                }
+            }}
+
+        return finding
+
+    @staticmethod
+    def _handle_weblogic_issue(issue):
+        finding = \
+            {"Severity": {
+                "Product": 10,
+                "Normalized": 100
+            }, "Resources": [{
+                "Type": "AwsEc2Instance",
+                "Id": issue['aws_instance_id']
+            }], "RecordState": "ACTIVE", "Title": "Oracle WebLogic servers are vulnerable to remote code execution.",
+                "Description": "Install Oracle critical patch updates. Or update to the latest version. " \
+                               "Vulnerable versions are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0.",
+                "Remediation": {
+                    "Recommendation": {
+                        "Text": "Oracle WebLogic server at {machine} ({ip_address}) is vulnerable to remote code execution attack."
+                                " The attack was made possible due to incorrect permission assignment in Oracle Fusion Middleware (subcomponent: WLS Security).".format(
+                            machine=issue['machine'], ip_address=issue['ip_address'])
+                    }
+                }}
+
+        return finding
+
+    @staticmethod
+    def _handle_hadoop_issue(issue):
+        finding = \
+            {"Severity": {
+                "Product": 10,
+                "Normalized": 100
+            }, "Resources": [{
+                "Type": "AwsEc2Instance",
+                "Id": issue['aws_instance_id']
+            }], "RecordState": "ACTIVE", "Title": "Hadoop/Yarn servers are vulnerable to remote code execution.",
+                "Description": "Run Hadoop in secure mode, add Kerberos authentication.", "Remediation": {
+                "Recommendation": {
+                    "Text": "The Hadoop server at {machine} ({ip_address}) is vulnerable to remote code execution attack."
+                            " The attack was made possible due to default Hadoop/Yarn configuration being insecure."
+                }
+            }}
+
         return finding

monkey/monkey_island/cc/services/config.py

@@ -907,6 +907,7 @@ ENCRYPTED_CONFIG_ARRAYS = \
 ENCRYPTED_CONFIG_STRINGS = \
     [
         ['cnc', 'aws_config', 'aws_access_key_id'],
+        ['cnc', 'aws_config', 'aws_account_id'],
         ['cnc', 'aws_config', 'aws_secret_access_key']
     ]