p34709852
/
monkey
forked from p15670423/monkey
1
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

Swimm: update unit Implement a new PBA — `ScheduleJobs` (id: VW4rf3AxRslfT7lwaug7).

This commit is contained in:
Swimm 2021-01-28 19:30:48 +02:00 committed by omerr
parent a76eacf240
commit 49d3766436
1 changed files with 35 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

53
.swm/VW4rf3AxRslfT7lwaug7.swm
View File

@ -1,31 +1,48 @@
{ {
"id": "VW4rf3AxRslfT7lwaug7", "id": "VW4rf3AxRslfT7lwaug7",
"name": "Implement a new PBA — `ScheduleJobs`", "name": "Implement a new PBA — `ScheduleJobs`",
"dod": "WW91JTIwc2hvdWxkJTIwaW1wbGVtZW50JTIwYSUyMG5ldyUyMFBCQSUyMGluJTIwTW9ua2V5JTIwd2hpY2glMjBzY2hlZHVsZXMlMjBqb2JzJTIwb24lMjB0aGUlMjBtYWNoaW5lLg==", "dod": "You should implement a new PBA in Monkey which schedules jobs on the machine.",
"description": "WW91JTIwbmVlZCUyMHRvJTIwaW1wbGVtZW50JTIwdGhlJTIwJTYwU2NoZWR1bGVKb2JzJTYwJTIwUEJBJTIwd2hpY2glMjBjcmVhdGVzJTIwc2NoZWR1bGVkJTIwam9icyUyMG9uJTIwdGhlJTIwbWFjaGluZS4lMjAlM0NiciUzRSUzQ2JyJTNFJTBBJTNDaW1nJTIwc3JjJTNEJTIyaHR0cHMlM0ElMkYlMkZtZWRpYS5naXBoeS5jb20lMkZtZWRpYSUyRmwwSzRtVkU1YjVXWjFzY3RXJTJGZ2lwaHkuZ2lmJTIyJTIwaGVpZ2h0JTNEMTc1JTNFJTNDYnIlM0UlM0NiciUzRSUwQVRoZSUyMGNvbW1hbmRzJTIwdGhhdCUyMGFkZCUyMHNjaGVkdWxlZCUyMGpvYnMlMjBmb3IlMjBXaW5kb3dzJTIwYW5kJTIwTGludXglMjBjYW4lMjBiZSUyMHJldHJpZXZlZCUyMGZyb20lMjAlNjBnZXRfY29tbWFuZHNfdG9fc2NoZWR1bGVfam9icyU2MCUyMCVFMiU4MCU5NCUyMG1ha2UlMjBzdXJlJTIweW91JTIwdW5kZXJzdGFuZCUyMGhvdyUyMHRvJTIwdXNlJTIwdGhpcyUyMGZ1bmN0aW9uJTIwY29ycmVjdGx5LiUwQSUwQSUyMyUyMyUyME1hbnVhbCUyMHRlc3QlMjAlMjAlMEFPbmNlJTIweW91JTIwdGhpbmslMjB5b3UncmUlMjBkb25lLi4uJTBBLSUyMFJ1biUyMHRoZSUyME1vbmtleSUyMElzbGFuZCUwQS0lMjBNYWtlJTIwc3VyZSUyMHRoZSUyMCUyMkpvYiUyMHNjaGVkdWxpbmclMjIlMjBQQkElMjBpcyUyMGVuYWJsZWQlMjBpbiUyMHRoZSUyMCUyMk1vbmtleSUyMiUyMHRhYiUyMGluJTIwdGhlJTIwY29uZmlndXJhdGlvbiUyMCVFMiU4MCU5NCUyMGZvciUyMHRoaXMlMjB0ZXN0JTJDJTIwZGlzYWJsZSUyMG5ldHdvcmslMjBzY2FubmluZyUyQyUyMGV4cGxvaXRpbmclMkMlMjBhbmQlMjBhbGwlMjBvdGhlciUyMFBCQXMlMEEtJTIwUnVuJTIwdGhlJTIwTW9ua2V5JTBBLSUyME1ha2UlMjBzdXJlJTIweW91JTIwc2VlJTIwdGhlJTIwUEJBJTIwd2l0aCUyMGl0cyUyMHJlc3VsdHMlMjBpbiUyMHRoZSUyMFNlY3VyaXR5JTIwcmVwb3J0JTIwYXMlMjB3ZWxsJTIwYXMlMjBpbiUyMHRoZSUyMEFUVCUyNkNLJTIwcmVwb3J0JTIwdW5kZXIlMjB0aGUlMjByZWxldmFudCUyME1JVFJFJTIwdGVjaG5pcXVlJTBBJTBBJTNDaW1nJTIwc3JjJTNEJTIyaHR0cHMlM0ElMkYlMkZmaXJlYmFzZXN0b3JhZ2UuZ29vZ2xlYXBpcy5jb20lMkZ2MCUyRmIlMkZzd2ltbWlvLWNvbnRlbnQlMkZvJTJGcmVwb3NpdG9yaWVzJTI1MkY2TmxiOTlOdFk1RmMzYlNkOHN1SCUyNTJGaW1nJTI1MkZmMGU1M2U2Yy05ZGJlLTQxZDgtOTQ1NC0yYjU3NjFjM2Y1M2EucG5nJTNGYWx0JTNEbWVkaWElMjZ0b2tlbiUzRDIxYWE0YmI4LTdlYmUtNGRhYi1hNzM5LWM3N2UwNTkxNDRkZCUyMiUyMGhlaWdodCUzRDQwMCUzRSUwQSUzQ2JyJTNFJTNDYnIlM0UlMEElM0NpbWclMjBzcmMlM0QlMjJodHRwcyUzQSUyRiUyRmZpcmViYXNlc3RvcmFnZS5nb29nbGVhcGlzLmNvbSUyRnYwJTJGYiUyRnN3aW1taW8tY29udGVudCUyRm8lMkZyZXBvc2l0b3JpZXMlMjUyRjZObGI5OU50WTVGYzNiU2Q4c3VIJTI1MkZpbWclMjUyRjUyODM4OWEwLTM1YzgtNDM4MC1iNmUyLTM1MzA2OGVkMDFlNC5wbmclM0ZhbHQlM0RtZWRpYSUyNnRva2VuJTNEMDg3NjdmNTUtODZlMi00ZjUxLThlY2YtMTNmZDZjYzI1YWQ1JTIyJTIwaGVpZ2h0JTNENDAwJTNF", "description": "You need to implement the `ScheduleJobs` PBA which creates scheduled jobs on the machine. <br><br>\n<img src=\"https://media.giphy.com/media/l0K4mVE5b5WZ1sctW/giphy.gif\" height=175><br><br>\nThe commands that add scheduled jobs for Windows and Linux can be retrieved from `get_commands_to_schedule_jobs` — make sure you understand how to use this function correctly.\n\n## Manual test \nOnce you think you're done...\n- Run the Monkey Island\n- Make sure the \"Job scheduling\" PBA is enabled in the \"Monkey\" tab in the configuration — for this test, disable network scanning, exploiting, and all other PBAs\n- Run the Monkey\n- Make sure you see the PBA with its results in the Security report as well as in the ATT&CK report under the relevant MITRE technique\n\n<img src=\"https://firebasestorage.googleapis.com/v0/b/swimmio-content/o/repositories%2F6Nlb99NtY5Fc3bSd8suH%2Fimg%2Ff0e53e6c-9dbe-41d8-9454-2b5761c3f53a.png?alt=media&token=21aa4bb8-7ebe-4dab-a739-c77e059144dd\" height=400>\n<br><br>\n<img src=\"https://firebasestorage.googleapis.com/v0/b/swimmio-content/o/repositories%2F6Nlb99NtY5Fc3bSd8suH%2Fimg%2F528389a0-35c8-4380-b6e2-353068ed01e4.png?alt=media&token=08767f55-86e2-4f51-8ecf-13fd6cc25ad5\" height=400>",
"summary": "TWFueSUyMG90aGVyJTIwUEJBcyUyMGFyZSUyMGFzJTIwc2ltcGxlJTIwYXMlMjB0aGlzJTIwb25lJTJDJTIwdXNpbmclMjBzaGVsbCUyMGNvbW1hbmRzJTIwb3IlMjBzY3JpcHRzJTIwJUUyJTgwJTk0JTIwc2VlJTIwJTYwVGltZXN0b21waW5nJTYwJTIwYW5kJTIwJTYwQWNjb3VudERpc2NvdmVyeSU2MC4lMjAlM0NiciUzRSUzQ2JyJTNFJTBBJTBBSG93ZXZlciUyQyUyMGZvciUyMGxlc3MlMjBzdHJhaWdodGZvcndhcmQlMjBvbmVzJTJDJTIweW91JTIwY2FuJTIwb3ZlcnJpZGUlMjBmdW5jdGlvbnMlMjBhbmQlMjBpbXBsZW1lbnQlMjBuZXclMjBjbGFzc2VzJTIwZGVwZW5kaW5nJTIwb24lMjB3aGF0JTIwaXMlMjByZXF1aXJlZCUyMCVFMiU4MCU5NCUyMHNlZSUyMCU2MFNpZ25lZFNjcmlwdFByb3h5RXhlY3V0aW9uJTYwJTIwYW5kJTIwJTYwTW9kaWZ5U2hlbGxTdGFydHVwRmlsZXMlNjAuJTNDYnIlM0UlM0NiciUzRSUwQSUwQVRoaXMlMjBQQkElMkMlMjBhbG9uZyUyMHdpdGglMjBhbGwlMjB0aGUlMjBvdGhlciUyMFBCQXMlMkMlMjB3aWxsJTIwcnVuJTIwb24lMjBhJTIwc3lzdGVtJTIwYWZ0ZXIlMjBpdCUyMGhhcyUyMGJlZW4lMjBicmVhY2hlZC4lMjBUaGUlMjBwdXJwb3NlJTIwb2YlMjB0aGlzJTIwY29kZSUyMGlzJTIwdG8lMjB0ZXN0JTIwd2hldGhlciUyMHRhcmdldCUyMHN5c3RlbXMlMjBhbGxvdyUyMGF0dGFja2VycyUyMHRvJTIwc2NoZWR1bGUlMjBqb2JzJTJDJTIwd2hpY2glMjB0aGV5JTIwY291bGQlMjB1c2UlMjB0byUyMHJ1biUyMG1hbGljaW91cyUyMGNvZGUlMjBhdCUyMHNvbWUlMjBzcGVjaWZpZWQlMjBkYXRlJTIwYW5kJTIwdGltZS4=", "summary": "Many other PBAs are as simple as this one, using shell commands or scripts — see `Timestomping` and `AccountDiscovery`. <br><br>\n\nHowever, for less straightforward ones, you can override functions and implement new classes depending on what is required — see `SignedScriptProxyExecution` and `ModifyShellStartupFiles`.<br><br>\n\nThis PBA, along with all the other PBAs, will run on a system after it has been breached. The purpose of this code is to test whether target systems allow attackers to schedule jobs, which they could use to run malicious code at some specified date and time.",
"diff": "ZGlmZiUyMC0tZ2l0JTIwYSUyRm1vbmtleSUyRmluZmVjdGlvbl9tb25rZXklMkZwb3N0X2JyZWFjaCUyRmFjdGlvbnMlMkZzY2hlZHVsZV9qb2JzLnB5JTIwYiUyRm1vbmtleSUyRmluZmVjdGlvbl9tb25rZXklMkZwb3N0X2JyZWFjaCUyRmFjdGlvbnMlMkZzY2hlZHVsZV9qb2JzLnB5JTBBaW5kZXglMjBkNmNkZDI3Ni4uNzlhNzcyNGQlMjAxMDA2NDQlMEEtLS0lMjBhJTJGbW9ua2V5JTJGaW5mZWN0aW9uX21vbmtleSUyRnBvc3RfYnJlYWNoJTJGYWN0aW9ucyUyRnNjaGVkdWxlX2pvYnMucHklMEElMkIlMkIlMkIlMjBiJTJGbW9ua2V5JTJGaW5mZWN0aW9uX21vbmtleSUyRnBvc3RfYnJlYWNoJTJGYWN0aW9ucyUyRnNjaGVkdWxlX2pvYnMucHklMEElNDAlNDAlMjAtMTAlMkMxMCUyMCUyQjEwJTJDNSUyMCU0MCU0MCUyMGNsYXNzJTIwU2NoZWR1bGVKb2JzKFBCQSklM0ElMEElMjAlMjAlMjAlMjAlMjAlMjIlMjIlMjIlMEElMjAlMEElMjAlMjAlMjAlMjAlMjBkZWYlMjBfX2luaXRfXyhzZWxmKSUzQSUwQS0lMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjBsaW51eF9jbWRzJTJDJTIwd2luZG93c19jbWRzJTIwJTNEJTIwZ2V0X2NvbW1hbmRzX3RvX3NjaGVkdWxlX2pvYnMoKSUwQS0lMEEtJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwc3VwZXIoU2NoZWR1bGVKb2JzJTJDJTIwc2VsZikuX19pbml0X18obmFtZSUzRFBPU1RfQlJFQUNIX0pPQl9TQ0hFRFVMSU5HJTJDJTBBLSUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMGxpbnV4X2NtZCUzRCclMjAnLmpvaW4obGludXhfY21kcyklMkMlMEEtJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwd2luZG93c19jbWQlM0R3aW5kb3dzX2NtZHMpJTBBLSUwQS0lMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjByZW1vdmVfc2NoZWR1bGVkX2pvYnMoKSUwQSUyQiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMHBhc3MlMEElMkIlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjMlMjBTd2ltbWVyJTNBJTIwSU1QTEVNRU5UJTIwSEVSRSElMEE=", "hunksOrder": [
"monkey/infection_monkey/post_breach/actions/schedule_jobs.py_0"
],
"tests": [], "tests": [],
"hints": [ "hints": [
"Check out the `Timestomping` PBA to get an idea about the implementation.", "Check out the `Timestomping` PBA to get an idea about the implementation.",
"Don't forget to add code to remove the scheduled jobs!" "Don't forget to add code to remove the scheduled jobs!"
], ],
"files": { "play_mode": "all",
"swimmPatch": {
"monkey/infection_monkey/post_breach/actions/schedule_jobs.py": { "monkey/infection_monkey/post_breach/actions/schedule_jobs.py": {
"index": [ "diffType": "MODIFIED",
"d6cdd276..79a7724d", "fileDiffHeader": "diff --git a/monkey/infection_monkey/post_breach/actions/schedule_jobs.py b/monkey/infection_monkey/post_breach/actions/schedule_jobs.py\nindex f7d8d805..06839463 100644\n--- a/monkey/infection_monkey/post_breach/actions/schedule_jobs.py\n+++ b/monkey/infection_monkey/post_breach/actions/schedule_jobs.py",
"100644" "hunks": [
], {
"fileA": "monkey/infection_monkey/post_breach/actions/schedule_jobs.py", "swimmHunkMetadata": {
"fileB": "monkey/infection_monkey/post_breach/actions/schedule_jobs.py", "hunkComments": []
"status": "MODIFIED", },
"numLineDeletions": 7, "hunkDiffLines": [
"numLineAdditions": 2, "@@ -10,12 +10,6 @@",
"hunkContainers": [ " \"\"\"",
"JTdCJTIyaHVuayUyMiUzQSU3QiUyMmhlYWRlciUyMiUzQSUyMiU0MCU0MCUyMC0xMCUyQzEwJTIwJTJCMTAlMkM1JTIwJTQwJTQwJTIwY2xhc3MlMjBTY2hlZHVsZUpvYnMoUEJBKSUzQSUyMiUyQyUyMmNoYW5nZXMlMjIlM0ElNUIlN0IlMjJ0eXBlJTIyJTNBJTIyY29udGV4dCUyMiUyQyUyMmRhdGElMjIlM0ElMjIlMjAlMjAlMjAlMjAlMjAlNUMlMjIlNUMlMjIlNUMlMjIlMjIlMkMlMjJsaW5lTnVtYmVycyUyMiUzQSU3QiUyMmElMjIlM0ExMCUyQyUyMmIlMjIlM0ExMCU3RCU3RCUyQyU3QiUyMnR5cGUlMjIlM0ElMjJjb250ZXh0JTIyJTJDJTIyZGF0YSUyMiUzQSUyMiUyMCUyMiUyQyUyMmxpbmVOdW1iZXJzJTIyJTNBJTdCJTIyYSUyMiUzQTExJTJDJTIyYiUyMiUzQTExJTdEJTdEJTJDJTdCJTIydHlwZSUyMiUzQSUyMmNvbnRleHQlMjIlMkMlMjJkYXRhJTIyJTNBJTIyJTIwJTIwJTIwJTIwJTIwZGVmJTIwX19pbml0X18oc2VsZiklM0ElMjIlMkMlMjJsaW5lTnVtYmVycyUyMiUzQSU3QiUyMmElMjIlM0ExMiUyQyUyMmIlMjIlM0ExMiU3RCU3RCUyQyU3QiUyMnR5cGUlMjIlM0ElMjJkZWwlMjIlMkMlMjJtYXJrJTIyJTNBJTIyLSUyMiUyQyUyMmRhdGElMjIlM0ElMjIlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjBsaW51eF9jbWRzJTJDJTIwd2luZG93c19jbWRzJTIwJTNEJTIwZ2V0X2NvbW1hbmRzX3RvX3NjaGVkdWxlX2pvYnMoKSUyMiUyQyUyMmxpbmVOdW1iZXJzJTIyJTNBJTdCJTIyYSUyMiUzQTEzJTdEJTdEJTJDJTdCJTIydHlwZSUyMiUzQSUyMmRlbCUyMiUyQyUyMm1hcmslMjIlM0ElMjItJTIyJTJDJTIyZGF0YSUyMiUzQSUyMiUyMiUyQyUyMmxpbmVOdW1iZXJzJTIyJTNBJTdCJTIyYSUyMiUzQTE0JTdEJTdEJTJDJTdCJTIydHlwZSUyMiUzQSUyMmRlbCUyMiUyQyUyMm1hcmslMjIlM0ElMjItJTIyJTJDJTIyZGF0YSUyMiUzQSUyMiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMHN1cGVyKFNjaGVkdWxlSm9icyUyQyUyMHNlbGYpLl9faW5pdF9fKG5hbWUlM0RQT1NUX0JSRUFDSF9KT0JfU0NIRURVTElORyUyQyUyMiUyQyUyMmxpbmVOdW1iZXJzJTIyJTNBJTdCJTIyYSUyMiUzQTE1JTdEJTdEJTJDJTdCJTIydHlwZSUyMiUzQSUyMmRlbCUyMiUyQyUyMm1hcmslMjIlM0ElMjItJTIyJTJDJTIyZGF0YSUyMiUzQSUyMiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMGxpbnV4X2NtZCUzRCclMjAnLmpvaW4obGludXhfY21kcyklMkMlMjIlMkMlMjJsaW5lTnVtYmVycyUyMiUzQSU3QiUyMmElMjIlM0ExNiU3RCU3RCUyQyU3QiUyMnR5cGUlMjIlM0ElMjJkZWwlMjIlMkMlMjJtYXJrJTIyJTNBJTIyLSUyMiUyQyUyMmRhdGElMjIlM0ElMjIlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjB3aW5kb3dzX2NtZCUzRHdpbmRvd3NfY21kcyklMjIlMkMlMjJsaW5lTnVtYmVycyUyMiUzQSU3QiUyMmElMjIlM0ExNyU3RCU3RCUyQyU3QiUyMnR5cGUlMjIlM0ElMjJkZWwlMjIlMkMlMjJtYXJrJTIyJTNBJTIyLSUyMiUyQyUyMmRhdGElMjIlM0ElMjIlMjIlMkMlMjJsaW5lTnVtYmVycyUyMiUzQSU3QiUyMmElMjIlM0ExOCU3RCU3RCUyQyU3QiUyMnR5cGUlMjIlM0ElMjJkZWwlMjIlMkMlMjJtYXJrJTIyJTNBJTIyLSUyMiUyQyUyMmRhdGElMjIlM0ElMjIlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjByZW1vdmVfc2NoZWR1bGVkX2pvYnMoKSUyMiUyQyUyMmxpbmVOdW1iZXJzJTIyJTNBJTdCJTIyYSUyMiUzQTE5JTdEJTdEJTJDJTdCJTIydHlwZSUyMiUzQSUyMmFkZCUyMiUyQyUyMm1hcmslMjIlM0ElMjIlMkIlMjIlMkMlMjJkYXRhJTIyJTNBJTIyJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwcGFzcyUyMiUyQyUyMmxpbmVOdW1iZXJzJTIyJTNBJTdCJTIyYiUyMiUzQTEzJTdEJTdEJTJDJTdCJTIydHlwZSUyMiUzQSUyMmFkZCUyMiUyQyUyMm1hcmslMjIlM0ElMjIlMkIlMjIlMkMlMjJkYXRhJTIyJTNBJTIyJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIzJTIwU3dpbW1lciUzQSUyMElNUExFTUVOVCUyMEhFUkUhJTIyJTJDJTIybGluZU51bWJlcnMlMjIlM0ElN0IlMjJiJTIyJTNBMTQlN0QlN0QlNUQlMkMlMjJsaW5lTnVtYmVycyUyMiUzQSU3QiUyMmElMjIlM0ElN0IlMjJzdGFydExpbmUlMjIlM0ExMCUyQyUyMmxpbmVzQ291bnQlMjIlM0ExMCU3RCUyQyUyMmIlMjIlM0ElN0IlMjJzdGFydExpbmUlMjIlM0ExMCUyQyUyMmxpbmVzQ291bnQlMjIlM0E1JTdEJTdEJTdEJTdE" " ",
" def __init__(self):",
"- linux_cmds, windows_cmds = get_commands_to_schedule_jobs()",
"+ pass",
" ",
"- super(ScheduleJobs, self).__init__(name=POST_BREACH_JOB_SCHEDULING,",
"+ # Swimmer: IMPLEMENT HERE!",
"- linux_cmd=' '.join(linux_cmds),",
"- windows_cmd=windows_cmds)",
"- ",
"- def run(self):",
"- super(ScheduleJobs, self).run()",
"- remove_scheduled_jobs()"
]
}
] ]
} }
}, },
"app_version": "0.1.90", "app_version": "0.3.5-1",
"file_version": "1.0.2" "file_version": "1.0.4"
} }