p20319658
/
monkey
forked from p34709852/monkey
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge pull request #494 from VakarisZ/readme_updates 

Readme updates
This commit is contained in:
Daniel Goldberg 2019-11-26 13:19:26 +02:00 committed by GitHub
parent 86e03afedf bcd0046a09
commit d053aaf629
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
8 changed files with 231 additions and 200 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
deployment_scripts/deploy_linux.sh
View File

@ -70,6 +70,7 @@ fi
if [[ ${python_cmd} == "" ]]; then if [[ ${python_cmd} == "" ]]; then
log_message "Python 3.7 command not found. Installing python 3.7." log_message "Python 3.7 command not found. Installing python 3.7."
sudo add-apt-repository ppa:deadsnakes/ppa sudo add-apt-repository ppa:deadsnakes/ppa
sudo apt-get update
sudo apt install python3.7 sudo apt install python3.7
log_message "Python 3.7 is now available with command 'python3.7'." log_message "Python 3.7 is now available with command 'python3.7'."
python_cmd="python3.7" python_cmd="python3.7"
@ -126,6 +127,7 @@ openssl x509 -req -days 366 -in cc/server.csr -signkey cc/server.key -out cc/ser
# Update node # Update node
log_message "Installing nodejs" log_message "Installing nodejs"
cd "$ISLAND_PATH/cc/ui" || handle_error cd "$ISLAND_PATH/cc/ui" || handle_error
sudo apt-get install curl
curl -sL https://deb.nodesource.com/setup_12.x | sudo -E bash - curl -sL https://deb.nodesource.com/setup_12.x | sudo -E bash -
sudo apt-get install -y nodejs sudo apt-get install -y nodejs
npm install sass-loader node-sass webpack --save-dev npm install sass-loader node-sass webpack --save-dev

115
monkey/infection_monkey/readme.md Normal file
View File

@ -0,0 +1,115 @@
# Monkey island dev. env. setup guide
>To easily setup development environment for Monkey Island and the Monkey look into [deployment scripts](../../deployment_scripts) folder.
>If you want to setup dev. env. for the Monkey manually, refer to the instructions below.
The monkey is composed of three separate parts.
- The Infection Monkey itself - PyInstaller compressed python archives
- Sambacry binaries - Two linux binaries, 32/64 bit.
- Mimikatz binaries - Two windows binaries, 32/64 bit.
- Traceroute binaries - Two linux binaries, 32/64bit.
## Windows
1. Install python 3.7.4 and choose **ADD to PATH** option when installing.
Download and install from: <https://www.python.org/ftp/python/3.7.4/>
In case you still need to add python directories to path:
- Run the following command on a cmd console (Replace C:\Python37 with your python directory if it's different)
`setx /M PATH "%PATH%;C:\Python37;C:\Python37\Scripts`
- Close the console, make sure you execute all commands in a new cmd console from now on.
2. Install further dependencies
- if not installed, install Microsoft Visual C++ 2017 SP1 Redistributable Package
- 32bit: <https://aka.ms/vs/16/release/vc_redist.x86.exe>
- 64bit: <https://go.microsoft.com/fwlink/?LinkId=746572>
3. Download the dependent python packages using
`pip install -r requirements_windows.txt`
4. Download and extract UPX binary to monkey\infection_monkey\bin\upx.exe:
<https://github.com/upx/upx/releases/download/v3.94/upx394w.zip>
5. Build/Download Sambacry and Mimikatz binaries
- Build/Download according to sections at the end of this readme.
- Place the binaries under monkey\infection_monkey\bin
6. To build the final exe:
- `cd monkey\infection_monkey`
- `build_windows.bat`
- `output is placed under dist\monkey.exe`
## Linux
Tested on Ubuntu 16.04.
0. On older distributions of Ubuntu (16.04) you'll need to download python3.7 via ppa:
- `sudo add-apt-repository ppa:deadsnakes/ppa`
- `sudo apt-get update`
- `sudo apt install python3.7`
1. Install dependencies by running:
- `sudo apt install python3-pip`
- `python3.7 -m pip install pip`
- `sudo apt-get install python3.7-dev libffi-dev upx libssl-dev libc++1`
2. Install the python packages listed in requirements.txt using pip
- `cd [code location]/infection_monkey`
- `python3.7 -m pip install -r requirements_linux.txt`
3. Build Sambacry binaries
- Build/Download according to sections at the end of this readme.
- Place the binaries under [code location]\infection_monkey\bin, under the names 'sc_monkey_runner32.so', 'sc_monkey_runner64.so'
4. Build Traceroute binaries
- Build/Download according to sections at the end of this readme.
- Place the binaries under [code location]\infection_monkey\bin, under the names 'traceroute32', 'traceroute64'
5. To build, run in terminal:
- `cd [code location]/infection_monkey`
- `chmod +x build_linux.sh`
- `./build_linux.sh`
output is placed under dist/monkey
### Sambacry
Sambacry requires two standalone binaries to execute remotely.
1. Build sambacry binaries yourself
- Install gcc-multilib if it's not installed `sudo apt-get install gcc-multilib`
- Build the binaries
1. `cd [code location]/infection_monkey/exploit/sambacry_monkey_runner`
2. `./build.sh`
2. Download our pre-built sambacry binaries
- Available here:
- 32bit: <https://github.com/guardicore/monkey/releases/download/1.6/sc_monkey_runner32.so>
- 64bit: <https://github.com/guardicore/monkey/releases/download/1.6/sc_monkey_runner64.so>
### Mimikatz
Mimikatz is required for the Monkey to be able to steal credentials on Windows. It's possible to either compile binaries from source (requires Visual Studio 2013 and up) or download them from our repository.
1. Build Mimikatz yourself
- Building mimikatz requires Visual Studio 2013 and up
- Clone our version of mimikatz from <https://github.com/guardicore/mimikatz/tree/1.1.0>
- Build using Visual Studio.
- Put each version in a zip file
1. The zip should contain only the Mimikatz DLL named tmpzipfile123456.dll
2. It should be protected using the password 'VTQpsJPXgZuXhX6x3V84G'.
3. The zip file should be named mk32.zip/mk64.zip accordingly.
4. Zipping with 7zip has been tested. Other zipping software may not work.
2. Download our pre-built mimikatz binaries
- Download both 32 and 64 bit zipped DLLs from <https://github.com/guardicore/mimikatz/releases/tag/1.1.0>
- Place them under [code location]\infection_monkey\bin
### Traceroute
Traceroute requires two standalone binaries to execute remotely.
The monkey carries the standalone binaries since traceroute isn't built in all Linux distributions.
You can either build them yourself or download pre-built binaries.
1. Build traceroute yourself
- The sources of traceroute are available here with building instructions: <http://traceroute.sourceforge.net>
1. Download our pre-built traceroute binaries
- Available here:
- 32bit: <https://github.com/guardicore/monkey/releases/download/1.6/traceroute32>
- 64bit: <https://github.com/guardicore/monkey/releases/download/1.6/traceroute64>

101
monkey/infection_monkey/readme.txt
View File

@ -1,101 +0,0 @@
To get development versions of Monkey Island and Monkey look into deployment scripts folder.
If you only want to build monkey from scratch you may reference instructions below.
The monkey is composed of three separate parts.
* The Infection Monkey itself - PyInstaller compressed python archives
* Sambacry binaries - Two linux binaries, 32/64 bit.
* Mimikatz binaries - Two windows binaries, 32/64 bit.
* Traceroute binaries - Two linux binaries, 32/64bit.
--- Windows ---
1. Install python 2.7.15
Download and install from: https://www.python.org/downloads/release/python-2715/
2. Add python directories to PATH environment variable (if you didn't install ActiveState Python)
a. Run the following command on a cmd console (Replace C:\Python27 with your python directory if it's different)
setx /M PATH "%PATH%;C:\Python27;C:\Python27\Scripts
b. Close the console, make sure you execute all commands in a new cmd console from now on.
3. Install further dependencies
a. install VCForPython27.msi
https://aka.ms/vcpython27
b. if not installed, install Microsoft Visual C++ 2010 SP1 Redistributable Package
32bit: http://www.microsoft.com/en-us/download/details.aspx?id=8328
64bit: http://www.microsoft.com/en-us/download/details.aspx?id=13523
4. Download the dependent python packages using
pip install -r requirements_windows.txt
5. Download and extract UPX binary to [source-path]\monkey\infection_monkey\bin\upx.exe:
https://github.com/upx/upx/releases/download/v3.94/upx394w.zip
6. Build/Download Sambacry and Mimikatz binaries
a. Build/Download according to sections at the end of this readme.
b. Place the binaries under [code location]\infection_monkey\bin
7. To build the final exe:
cd [code location]/infection_monkey
build_windows.bat
output is placed under dist\monkey.exe
--- Linux ---
Tested on Ubuntu 16.04 and 17.04.
1. Install dependencies by running:
sudo apt-get update
sudo apt-get install python-pip python-dev libffi-dev upx libssl-dev libc++1
Install the python packages listed in requirements.txt using pip
cd [code location]/infection_monkey
pip install -r requirements_linux.txt
2. Build Sambacry binaries
a. Build/Download according to sections at the end of this readme.
b. Place the binaries under [code location]\infection_monkey\bin, under the names 'sc_monkey_runner32.so', 'sc_monkey_runner64.so'
3. Build Traceroute binaries
a. Build/Download according to sections at the end of this readme.
b. Place the binaries under [code location]\infection_monkey\bin, under the names 'traceroute32', 'traceroute64'
4. To build, run in terminal:
cd [code location]/infection_monkey
chmod +x build_linux.sh
./build_linux.sh
output is placed under dist/monkey
-- Sambacry --
Sambacry requires two standalone binaries to execute remotely.
a. Build sambacry binaries yourself
a.1. Install gcc-multilib if it's not installed
sudo apt-get install gcc-multilib
a.2. Build the binaries
cd [code location]/infection_monkey/exploit/sambacry_monkey_runner
./build.sh
b. Download our pre-built sambacry binaries
b.1. Available here:
32bit: https://github.com/guardicore/monkey/releases/download/1.6/sc_monkey_runner32.so
64bit: https://github.com/guardicore/monkey/releases/download/1.6/sc_monkey_runner64.so
-- Mimikatz --
Mimikatz is required for the Monkey to be able to steal credentials on Windows. It's possible to either compile binaries from source (requires Visual Studio 2013 and up) or download them from our repository.
a. Build Mimikatz yourself
a.0. Building mimikatz requires Visual Studio 2013 and up
a.1. Clone our version of mimikatz from https://github.com/guardicore/mimikatz/tree/1.1.0
a.2. Build using Visual Studio.
a.3. Put each version in a zip file
a.3.1. The zip should contain only the Mimikatz DLL named tmpzipfile123456.dll
a.3.2. It should be protected using the password 'VTQpsJPXgZuXhX6x3V84G'.
a.3.3. The zip file should be named mk32.zip/mk64.zip accordingly.
a.3.4. Zipping with 7zip has been tested. Other zipping software may not work.
b. Download our pre-built mimikatz binaries
b.1. Download both 32 and 64 bit zipped DLLs from https://github.com/guardicore/mimikatz/releases/tag/1.1.0
b.2. Place them under [code location]\infection_monkey\bin
-- Traceroute --
Traceroute requires two standalone binaries to execute remotely.
The monkey carries the standalone binaries since traceroute isn't built in all Linux distributions.
You can either build them yourself or download pre-built binaries.
a. Build traceroute yourself
a.1. The sources of traceroute are available here with building instructions: http://traceroute.sourceforge.net
b. Download our pre-built traceroute binaries
b.1. Available here:
32bit: https://github.com/guardicore/monkey/releases/download/1.6/traceroute32
64bit: https://github.com/guardicore/monkey/releases/download/1.6/traceroute64

8
monkey/monkey_island/linux/create_certificate.sh
View File

@ -1,6 +1,6 @@
#!/bin/bash #!/bin/bash
cd /var/monkey/monkey_island openssl genrsa -out ./cc/server.key 2048
openssl genrsa -out cc/server.key 2048 openssl req -new -key ./cc/server.key -out ./cc/server.csr -subj "/OU=Monkey Department/CN=monkey.com"
openssl req -new -key cc/server.key -out cc/server.csr -subj "/C=GB/ST=London/L=London/O=Global Security/OU=Monkey Department/CN=monkey.com" openssl x509 -req -days 366 -in ./cc/server.csr -signkey ./cc/server.key -out ./cc/server.crt
openssl x509 -req -days 366 -in cc/server.csr -signkey cc/server.key -out cc/server.crt

106
monkey/monkey_island/readme.md Normal file
View File

@ -0,0 +1,106 @@
# Monkey island dev. env. setup guide
>To easily setup development environment for Monkey Island and the Monkey look into [deployment scripts](../../deployment_scripts) folder.
>If you want to setup dev. env. for Island manually, refer to the instructions below.
## How to set up the Monkey Island server
### On Windows
1. Exclude the folder you are planning to install the Monkey in from your AV software, as it might block or delete files from the installation.
2. Create folder "bin" under monkey\monkey_island
3. Place portable version of Python 3.7.4
- Download and install from: <https://www.python.org/ftp/python/3.7.4/>
4. Install Island's requirements
- `python -m pip install -r monkey\monkey_island\requirements.txt`
4. Setup mongodb (Use one of the following two options):
- Place portable version of mongodb
1. Download from: <https://fastdl.mongodb.org/win32/mongodb-win32-x86_64-2012plus-4.2.1.zip>
2. Extract contents of bin folder to \monkey\monkey_island\bin\mongodb.
3. Create monkey_island\db folder.
OR
- Use already running instance of mongodb
1. Run 'set MONKEY_MONGO_URL="mongodb://<SERVER ADDR>:27017/monkeyisland"'. Replace '<SERVER ADDR>' with address of mongo server
5. Place portable version of OpenSSL
- Download from: <https://indy.fulgan.com/SSL/Archive/openssl-1.0.2p-i386-win32.zip>
- Extract contents to monkey_island\bin\openssl
6. Download and install Microsoft Visual C++ redistributable for Visual Studio 2017
- Download and install from: <https://go.microsoft.com/fwlink/?LinkId=746572>
7. Generate SSL Certificate
- run `./windows/create_certificate.bat` when your current working directory is monkey_island
8. Put Infection Monkey binaries inside monkey_island/cc/binaries (binaries can be found in releases on github or build from source)
monkey-linux-64 - monkey binary for linux 64bit
monkey-linux-32 - monkey binary for linux 32bit
monkey-windows-32.exe - monkey binary for windows 32bit
monkey-windows-64.exe - monkey binary for windows 64bit
9. Install npm
- Download and install from: <https://www.npmjs.com/get-npm>
10. Build Monkey Island frontend
- cd to 'monkey_island\cc\ui'
- run 'npm update'
- run 'npm run dist'
#### How to run
1. When your current working directory is monkey_island, run monkey_island\windows\run_server_py.bat
### On Linux
1. Get python 3.7 and pip if your linux distribution doesn't have it built in (following steps are for Ubuntu 16):
- `sudo add-apt-repository ppa:deadsnakes/ppa`
- `sudo apt-get update`
- `sudo apt install python3.7 python3-pip python3.7-dev`
- `python3.7 -m pip install pip`
2. Install required packages:
- `sudo apt-get install libffi-dev upx libssl-dev libc++1 openssl`
3. Create the following directories in monkey island folder (execute from ./monkey):
- `mkdir -p ./monkey_island/bin/mongodb`
- `mkdir -p ./monkey_island/db`
- `mkdir -p ./monkey_island/cc/binaries`
4. Install the packages from monkey_island/requirements.txt:
- `sudo python3.7 -m pip install -r ./monkey_island/requirements.txt`
5. Put monkey binaries in /monkey_island/cc/binaries (binaries can be found in releases on github).
monkey-linux-64 - monkey binary for linux 64bit
monkey-linux-32 - monkey binary for linux 32bit
monkey-windows-32.exe - monkey binary for windows 32bit
monkey-windows-64.exe - monkey binary for windows 64bit
Also, if you're going to run monkeys on local machine execute:
- `chmod 755 ./monkey_island/cc/binaries/monkey-linux-64`
- `chmod 755 ./monkey_island/cc/binaries/monkey-linux-32`
6. Setup MongoDB (Use one of the two following options):
- Download MongoDB and extract it to monkey/monkey_island/bin/mongodb:
1. Run `./monkey_island/linux/install_mongo.sh ./monkey_island/bin/mongodb`. This will download and extract the relevant mongoDB for your OS.
OR
- Use already running instance of mongodb
1. Run `set MONKEY_MONGO_URL="mongodb://<SERVER ADDR>:27017/monkeyisland"`. Replace '<SERVER ADDR>' with address of mongo server
7. Generate SSL Certificate:
- `cd ./monkey_island`
- `chmod 755 ./linux/create_certificate.sh`
- `./linux/create_certificate.sh`
8. Install npm and node by running:
- `sudo apt-get install curl`
- `curl -sL https://deb.nodesource.com/setup_12.x | sudo -E bash -`
- `sudo apt-get install -y nodejs`
9. Build Monkey Island frontend
- cd to 'monkey_island/cc/ui'
- `npm install sass-loader node-sass webpack --save-dev`
- `npm update`
- `npm run dist`
#### How to run
1. When your current working directory is monkey, run ./monkey_island/linux/run.sh (located under /linux)

91
monkey/monkey_island/readme.txt
View File

@ -1,91 +0,0 @@
To get development versions of Monkey Island and Monkey look into deployment scripts folder.
If you only want to run the software from source you may refer to the instructions below.
How to set up the Monkey Island server:
---------------- On Windows ----------------:
0. Exclude the folder you are planning to install the Monkey in from your AV software, as it might block or delete files from the installation.
1. Create folder "bin" under monkey_island
2. Place portable version of Python 2.7.15
2.1. Download and install from: https://www.python.org/downloads/release/python-2715/
2.2. Install virtualenv using "python -m pip install virtualenv"
2.3. Create a virtualenv using "python -m virtualenv --always-copy <PATH TO BIN>\Python27" Where <PATH TO BIN> is the path to the bin folder created on step 1.
2.4. Run "python -m virtualenv --relocatable <PATH TO BIN>\Python27"
2.5. Install the required python libraries using "<PATH TO BIN>\Python27\Scripts\python -m pip install -r monkey_island\requirements.txt"
2.6. Copy DLLs from installation path (Usually C:\Python27\DLLs) to <PATH TO BIN>\Python27\DLLs
2.7. (Optional) You may uninstall Python27 if you like.
3. Setup mongodb (Use one of the following two options):
3.a Place portable version of mongodb
3.a.1. Download from: https://downloads.mongodb.org/win32/mongodb-win32-x86_64-2008plus-ssl-latest.zip
3.a.2. Extract contents from bin folder to monkey_island\bin\mongodb.
3.a.3. Create monkey_island\db folder.
OR
3.b. Use already running instance of mongodb
3.b.1. Run 'set MONKEY_MONGO_URL="mongodb://<SERVER ADDR>:27017/monkeyisland"'. Replace '<SERVER ADDR>' with address of mongo server
4. Place portable version of OpenSSL
4.1. Download from: https://indy.fulgan.com/SSL/Archive/openssl-1.0.2l-i386-win32.zip
4.2. Extract content from bin folder to monkey_island\bin\openssl
5. Download and install Microsoft Visual C++ redistributable for Visual Studio 2017
5.1. Download and install from: https://go.microsoft.com/fwlink/?LinkId=746572
6. Generate SSL Certificate
6.1. run create_certificate.bat when your current working directory is monkey_island
7. Create the monkey_island\cc\binaries folder and put Infection Monkey binaries inside
monkey-linux-64 - monkey binary for linux 64bit
monkey-linux-32 - monkey binary for linux 32bit
monkey-windows-32.exe - monkey binary for windows 32bit
monkey-windows-64.exe - monkey binary for windows 64bit
8. Install npm
8.1. Download and install from: https://www.npmjs.com/get-npm
9. Build Monkey Island frontend
9.1. cd to 'monkey_island\cc\ui'
9.2. run 'npm update'
9.3. run 'npm run dist'
How to run:
1. When your current working directory is monkey_island, run monkey_island\windows\run_server.bat
---------------- On Linux ----------------:
1. Create the following directories:
sudo mkdir /var/monkey_island
sudo chmod 777 /var/monkey_island
mkdir -p /var/monkey_island/bin/mongodb
mkdir -p /var/monkey_island/db
mkdir -p /var/monkey_island/cc/binaries
2. Install the packages from monkey_island/requirements.txt:
sudo python -m pip install -r /var/monkey_island/requirements.txt
If pip is not installed, install the python-pip package. Make sure the server is running Python 2.7 and not Python 3+.
3. put monkey binaries in /var/monkey_island/cc/binaries
monkey-linux-64 - monkey binary for linux 64bit
monkey-linux-32 - monkey binary for linux 32bit
monkey-windows-32.exe - monkey binary for windows 32bit
monkey-windows-64.exe - monkey binary for windows 64bi
4. Setup MongoDB (Use one of the two following options):
4.a. Download MongoDB and extract it to /var/monkey_island/bin/mongodb
4.a.1. Run '/var/monkey_island/linux/install_mongo.sh /var/monkey_island/bin/mongodb'
This will download and extract the relevant mongoDB for your OS.
OR
4.b. Use already running instance of mongodb
4.b.1. Run 'set MONKEY_MONGO_URL="mongodb://<SERVER ADDR>:27017/monkeyisland"'. Replace '<SERVER ADDR>' with address of mongo server
5. install OpenSSL
sudo apt-get install openssl
6. Generate SSL Certificate, Run create_certificate.sh (located under /linux)
7. Copy monkey island server to /var/monkey_island:
cp -r [monkey_island_source]/cc /var/monkey_island/
8. Install npm
8.1. Download and install from: https://www.npmjs.com/get-npm
9. Build Monkey Island frontend
9.1. cd to 'monkey_island/cc/ui'
9.2. run 'npm update'
9.3. run 'npm run dist'
How to run:
1. When your current working directory is monkey, run ./monkey_island/linux/run.sh (located under /linux)

2
monkey/monkey_island/windows/create_certificate.bat
View File

@ -14,5 +14,5 @@ copy "%mydir%windows\openssl.cfg" "%mydir%bin\openssl\openssl.cfg"
@echo on @echo on
"%mydir%bin\openssl\openssl.exe" genrsa -out "%mydir%cc\server.key" 1024 "%mydir%bin\openssl\openssl.exe" genrsa -out "%mydir%cc\server.key" 1024
"%mydir%bin\openssl\openssl.exe" req -new -config "%mydir%bin\openssl\openssl.cfg" -key "%mydir%cc\server.key" -out "%mydir%cc\server.csr" -subj "/C=GB/ST=London/L=London/O=Global Security/OU=Monkey Department/CN=monkey.com" "%mydir%bin\openssl\openssl.exe" req -new -config "%mydir%bin\openssl\openssl.cfg" -key "%mydir%cc\server.key" -out "%mydir%cc\server.csr" -subj "/OU=Monkey Department/CN=monkey.com"
"%mydir%bin\openssl\openssl.exe" x509 -req -days 366 -in "%mydir%cc\server.csr" -signkey "%mydir%cc\server.key" -out "%mydir%cc\server.crt" "%mydir%bin\openssl\openssl.exe" x509 -req -days 366 -in "%mydir%cc\server.csr" -signkey "%mydir%cc\server.key" -out "%mydir%cc\server.crt"

2
monkey/monkey_island/windows/run_cc.bat
View File

@ -1,5 +1,5 @@
REM - Runs Monkey Island Server using python - REM - Runs Monkey Island Server using python -
@title C^&C Server @title C^&C Server
@pushd .. @pushd ..
@monkey_island\bin\Python27\Scripts\python monkey_island.py @python monkey_island.py
@popd @popd