diff --git a/monkey/infection_monkey/transport/attack_telems/base_telem.py b/monkey/infection_monkey/transport/attack_telems/base_telem.py index 054927a0d..f90a53256 100644 --- a/monkey/infection_monkey/transport/attack_telems/base_telem.py +++ b/monkey/infection_monkey/transport/attack_telems/base_telem.py @@ -1,9 +1,10 @@ from enum import Enum -from infection_monkey.config import WormConfiguration, GUID +from infection_monkey.config import WormConfiguration import requests import json from infection_monkey.control import ControlClient import logging +from infection_monkey.utils import get_host_info __author__ = "VakarisZ" @@ -21,22 +22,26 @@ class ScanStatus(Enum): class AttackTelem(object): - def __init__(self, technique, status, data=None): + def __init__(self, technique, status, data=None, machine=False): """ Default ATT&CK telemetry constructor :param technique: Technique ID. E.g. T111 :param status: int from ScanStatus Enum :param data: Other data relevant to the attack technique + :param machine: Boolean. Should we pass current machine's info or not """ self.technique = technique self.result = status - self.data = {'status': status, 'id': GUID} + self.data = {'status': status} if data: self.data.update(data) + if machine: + self.data.update({'machine': get_host_info()}) def send(self): """ Sends telemetry to island + :return: """ if not WormConfiguration.current_server: return diff --git a/monkey/infection_monkey/transport/attack_telems/victim_host_telem.py b/monkey/infection_monkey/transport/attack_telems/victim_host_telem.py index 4ed88ef95..c549bde1e 100644 --- a/monkey/infection_monkey/transport/attack_telems/victim_host_telem.py +++ b/monkey/infection_monkey/transport/attack_telems/victim_host_telem.py @@ -1,5 +1,4 @@ from infection_monkey.transport.attack_telems.base_telem import AttackTelem -from infection_monkey.config import GUID __author__ = "VakarisZ" @@ -14,7 +13,7 @@ class VictimHostTelem(AttackTelem): :param machine: VictimHost obj from model/host.py :param data: Other data relevant to the attack technique """ - super(VictimHostTelem, self).__init__(technique, status, data) + super(VictimHostTelem, self).__init__(technique, status, data, machine=False) victim_host = {'hostname': machine.domain_name, 'ip': machine.ip_addr} if data: self.data.update(data) diff --git a/monkey/infection_monkey/utils.py b/monkey/infection_monkey/utils.py index 741d7c950..05d0cf807 100644 --- a/monkey/infection_monkey/utils.py +++ b/monkey/infection_monkey/utils.py @@ -2,9 +2,13 @@ import os import sys import shutil import struct +import socket from infection_monkey.config import WormConfiguration +LOCAL_IP = '127.0.0.1' +MOCK_IP = '10.255.255.255' + def get_monkey_log_path(): return os.path.expandvars(WormConfiguration.monkey_log_path_windows) if sys.platform == "win32" \ @@ -32,6 +36,26 @@ def is_windows_os(): return sys.platform.startswith("win") +def get_host_info(): + return {'hostname': socket.gethostname(), 'ip': get_primary_ip()} + + +def get_primary_ip(): + """ + :return: Primary (default route) IP address + """ + s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) + try: + # doesn't even have to be reachable + s.connect((MOCK_IP, 1)) + ip = s.getsockname()[0] + except: + ip = LOCAL_IP + finally: + s.close() + return ip + + def utf_to_ascii(string): # Converts utf string to ascii. Safe to use even if string is already ascii. udata = string.decode("utf-8") diff --git a/monkey/monkey_island/cc/resources/attack_telem.py b/monkey/monkey_island/cc/resources/attack_telem.py index 0dfa013e8..a206d21d0 100644 --- a/monkey/monkey_island/cc/resources/attack_telem.py +++ b/monkey/monkey_island/cc/resources/attack_telem.py @@ -1,7 +1,7 @@ import flask_restful from flask import request import json -from cc.services.attack.attack_telem import set_results +from cc.services.attack.attack_results import set_results import logging __author__ = 'VakarisZ' diff --git a/monkey/monkey_island/cc/services/attack/attack_telem.py b/monkey/monkey_island/cc/services/attack/attack_results.py similarity index 76% rename from monkey/monkey_island/cc/services/attack/attack_telem.py rename to monkey/monkey_island/cc/services/attack/attack_results.py index a55ab2f99..fb8b1cd82 100644 --- a/monkey/monkey_island/cc/services/attack/attack_telem.py +++ b/monkey/monkey_island/cc/services/attack/attack_results.py @@ -1,6 +1,3 @@ -""" -File that contains ATT&CK telemetry storing/retrieving logic -""" import logging from cc.database import mongo