p34709852
/
monkey
forked from p15670423/monkey
1
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

Split test_machine_exploited into 2 functions

This commit is contained in:
Shay Nehmad 2019-09-02 11:05:57 +03:00
parent 107ac73366
commit 2d7829ca4b
1 changed files with 16 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
monkey/monkey_island/cc/services/telemetry/zero_trust_tests/machine_exploited.py
View File

@ -6,39 +6,44 @@ from monkey_island.cc.models.zero_trust.finding import Finding
def test_machine_exploited(telemetry_json):
current_monkey = Monkey.get_single_monkey_by_guid(telemetry_json['monkey_guid'])
target_ip = telemetry_json['data']['machine']['ip_addr']
exploiter = telemetry_json['data']['exploiter']
timestamp = telemetry_json['timestamp']
exploit_successful = telemetry_json['data']['result']
create_findings_from_exploit_data(current_monkey, exploit_successful, exploiter, target_ip, timestamp)
def create_findings_from_exploit_data(current_monkey, exploit_successful, exploiter, target_ip, timestamp):
events = [
Event.create_event(
title="Exploit attempt",
message="Monkey on {} attempted to exploit {} using {}.".format(
current_monkey.hostname,
telemetry_json['data']['machine']['ip_addr'],
telemetry_json['data']['exploiter']),
target_ip,
exploiter),
event_type=EVENT_TYPE_MONKEY_NETWORK,
timestamp=telemetry_json['timestamp']
timestamp=timestamp
)
]
status = STATUS_PASSED
if telemetry_json['data']['result']:
if exploit_successful:
events.append(
Event.create_event(
title="Exploit success!",
message="Monkey on {} successfully exploited {} using {}.".format(
current_monkey.hostname,
telemetry_json['data']['machine']['ip_addr'],
telemetry_json['data']['exploiter']),
target_ip,
exploiter),
event_type=EVENT_TYPE_MONKEY_NETWORK,
timestamp=telemetry_json['timestamp'])
timestamp=timestamp)
)
status = STATUS_FAILED
Finding.save_finding(
test=TEST_MACHINE_EXPLOITED,
status=status,
events=events
)
Finding.save_finding(
test=TEST_MALICIOUS_ACTIVITY_TIMELINE,
status=STATUS_INCONCLUSIVE,