p34709852
/
monkey
forked from p15670423/monkey
1
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

Agent: Update tags for hadoop events

This commit is contained in:
Kekoa Kaaikala 2022-10-04 19:43:14 +00:00 committed by Ilija Lazoroski
parent c31aed94ea
commit 54b551b728
1 changed files with 20 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
monkey/infection_monkey/exploit/hadoop.py
View File

@ -13,7 +13,11 @@ import string
import requests import requests
from common.common_consts.timeouts import LONG_REQUEST_TIMEOUT from common.common_consts.timeouts import LONG_REQUEST_TIMEOUT
from common.tags import T1203_ATTACK_TECHNIQUE_TAG from common.tags import (
T1203_ATTACK_TECHNIQUE_TAG,
T1210_ATTACK_TECHNIQUE_TAG,
T1570_ATTACK_TECHNIQUE_TAG,
)
from infection_monkey.exploit.tools.helpers import get_agent_dst_path from infection_monkey.exploit.tools.helpers import get_agent_dst_path
from infection_monkey.exploit.tools.http_tools import HTTPTools from infection_monkey.exploit.tools.http_tools import HTTPTools
from infection_monkey.exploit.web_rce import WebRCE from infection_monkey.exploit.web_rce import WebRCE
@ -28,6 +32,8 @@ from infection_monkey.utils.commands import build_monkey_commandline
logger = logging.getLogger(__name__) logger = logging.getLogger(__name__)
HADOOP_EXPLOITER_TAG = "hadoop-exploiter" HADOOP_EXPLOITER_TAG = "hadoop-exploiter"
EXPLOIT_TAGS = (HADOOP_EXPLOITER_TAG, T1203_ATTACK_TECHNIQUE_TAG, T1210_ATTACK_TECHNIQUE_TAG)
PROPAGATION_TAGS = (HADOOP_EXPLOITER_TAG, T1570_ATTACK_TECHNIQUE_TAG)
class HadoopExploiter(WebRCE): class HadoopExploiter(WebRCE):
@ -51,7 +57,7 @@ class HadoopExploiter(WebRCE):
target=self.host.ip_addr, target=self.host.ip_addr,
exploitation_success=False, exploitation_success=False,
error_message=self.exploit_result.error_message, error_message=self.exploit_result.error_message,
tags=(HADOOP_EXPLOITER_TAG,), tags=PROPAGATION_TAGS,
) )
return self.exploit_result return self.exploit_result
@ -61,7 +67,6 @@ class HadoopExploiter(WebRCE):
self.host, str(monkey_path_on_victim), self.agent_binary_repository self.host, str(monkey_path_on_victim), self.agent_binary_repository
) )
tags = (HADOOP_EXPLOITER_TAG, T1203_ATTACK_TECHNIQUE_TAG)
try: try:
command = self._build_command(monkey_path_on_victim, http_path) command = self._build_command(monkey_path_on_victim, http_path)
@ -73,16 +78,22 @@ class HadoopExploiter(WebRCE):
self._publish_propagation_event( self._publish_propagation_event(
target=self.host.ip_addr, target=self.host.ip_addr,
propagation_success=True, propagation_success=True,
tags=(HADOOP_EXPLOITER_TAG, T1203_ATTACK_TECHNIQUE_TAG), tags=PROPAGATION_TAGS,
) )
else: else:
error_message = f"Failed to exploit via {self.vulnerable_urls[0]}" error_message = f"Failed to exploit via {self.vulnerable_urls[0]}"
self._publish_exploitation_event(self.host.ip_addr, False, tags, error_message) self._publish_exploitation_event(
self._publish_propagation_event(self.host.ip_addr, False, tags, error_message) self.host.ip_addr, False, EXPLOIT_TAGS, error_message
)
self._publish_propagation_event(
self.host.ip_addr, False, PROPAGATION_TAGS, error_message
)
except requests.RequestException as err: except requests.RequestException as err:
error_message = str(err) error_message = str(err)
self._publish_exploitation_event(self.host.ip_addr, False, tags, error_message) self._publish_exploitation_event(self.host.ip_addr, False, EXPLOIT_TAGS, error_message)
self._publish_propagation_event(self.host.ip_addr, False, tags, error_message) self._publish_propagation_event(
self.host.ip_addr, False, PROPAGATION_TAGS, error_message
)
finally: finally:
http_thread.join(self.DOWNLOAD_TIMEOUT) http_thread.join(self.DOWNLOAD_TIMEOUT)
http_thread.stop() http_thread.stop()
@ -121,7 +132,7 @@ class HadoopExploiter(WebRCE):
self._publish_exploitation_event( self._publish_exploitation_event(
target=self.host.ip_addr, target=self.host.ip_addr,
exploitation_success=True, exploitation_success=True,
tags=(HADOOP_EXPLOITER_TAG, T1203_ATTACK_TECHNIQUE_TAG), tags=EXPLOIT_TAGS,
) )
return success return success