forked from p15670423/monkey
Merge remote-tracking branch 'upstream/develop' into attack_bugfixes
This commit is contained in:
commit
99fd62928d
monkey
common/utils
infection_monkey
monkey_island/cc/services/attack/technique_reports
|
@ -15,12 +15,13 @@ class UsageEnum(Enum):
|
||||||
ScanStatus.SCANNED.value: "SMB exploiter failed to run the monkey by creating a service via MS-SCMR."}
|
ScanStatus.SCANNED.value: "SMB exploiter failed to run the monkey by creating a service via MS-SCMR."}
|
||||||
MIMIKATZ = {ScanStatus.USED.value: "Windows module loader was used to load Mimikatz DLL.",
|
MIMIKATZ = {ScanStatus.USED.value: "Windows module loader was used to load Mimikatz DLL.",
|
||||||
ScanStatus.SCANNED.value: "Monkey tried to load Mimikatz DLL, but failed."}
|
ScanStatus.SCANNED.value: "Monkey tried to load Mimikatz DLL, but failed."}
|
||||||
MIMIKATZ_FILE_COPY = {ScanStatus.USED.value: "WinAPI was called to load mimikatz.",
|
MIMIKATZ_WINAPI = {ScanStatus.USED.value: "WinAPI was called to load mimikatz.",
|
||||||
ScanStatus.SCANNED.value: "Monkey tried to call WinAPI to load mimikatz, but failed."}
|
ScanStatus.SCANNED.value: "Monkey tried to call WinAPI to load mimikatz."}
|
||||||
SINGLETON_FILE_COPY = {ScanStatus.USED.value: "WinAPI was called to acquire system singleton for monkey's process.",
|
DROPPER = {ScanStatus.USED.value: "WinAPI was used to mark monkey files for deletion on next boot."}
|
||||||
ScanStatus.SCANNED.value: "WinAPI call to acquire system singleton"
|
SINGLETON_WINAPI = {ScanStatus.USED.value: "WinAPI was called to acquire system singleton for monkey's process.",
|
||||||
" for monkey process wasn't successful."}
|
ScanStatus.SCANNED.value: "WinAPI call to acquire system singleton"
|
||||||
DROPPER_FILE_COPY = {ScanStatus.USED.value: "WinAPI was used to mark monkey files for deletion on next boot."}
|
" for monkey process wasn't successful."}
|
||||||
|
DROPPER_WINAPI = {ScanStatus.USED.value: "WinAPI was used to mark monkey files for deletion on next boot."}
|
||||||
|
|
||||||
|
|
||||||
# Dict that describes what BITS job was used for
|
# Dict that describes what BITS job was used for
|
||||||
|
|
|
@ -125,6 +125,7 @@ class ControlClient(object):
|
||||||
@staticmethod
|
@staticmethod
|
||||||
def send_telemetry(telem_category, data):
|
def send_telemetry(telem_category, data):
|
||||||
if not WormConfiguration.current_server:
|
if not WormConfiguration.current_server:
|
||||||
|
LOG.error("Trying to send %s telemetry before current server is established, aborting." % telem_category)
|
||||||
return
|
return
|
||||||
try:
|
try:
|
||||||
telemetry = {'monkey_guid': GUID, 'telem_category': telem_category, 'data': data}
|
telemetry = {'monkey_guid': GUID, 'telem_category': telem_category, 'data': data}
|
||||||
|
|
|
@ -158,6 +158,6 @@ class MonkeyDrops(object):
|
||||||
else:
|
else:
|
||||||
LOG.debug("Dropper source file '%s' is marked for deletion on next boot",
|
LOG.debug("Dropper source file '%s' is marked for deletion on next boot",
|
||||||
self._config['source_path'])
|
self._config['source_path'])
|
||||||
T1106Telem(ScanStatus.USED, UsageEnum.DROPPER_FILE_COPY).send()
|
T1106Telem(ScanStatus.USED, UsageEnum.DROPPER_WINAPI).send()
|
||||||
except AttributeError:
|
except AttributeError:
|
||||||
LOG.error("Invalid configuration options. Failing")
|
LOG.error("Invalid configuration options. Failing")
|
||||||
|
|
|
@ -55,8 +55,8 @@ class MimikatzCollector(object):
|
||||||
except Exception:
|
except Exception:
|
||||||
LOG.exception("Error initializing mimikatz collector")
|
LOG.exception("Error initializing mimikatz collector")
|
||||||
status = ScanStatus.SCANNED
|
status = ScanStatus.SCANNED
|
||||||
|
T1106Telem(status, UsageEnum.MIMIKATZ_WINAPI).send()
|
||||||
T1129Telem(status, UsageEnum.MIMIKATZ).send()
|
T1129Telem(status, UsageEnum.MIMIKATZ).send()
|
||||||
T1106Telem(status, UsageEnum.MIMIKATZ_FILE_COPY).send()
|
|
||||||
|
|
||||||
def get_logon_info(self):
|
def get_logon_info(self):
|
||||||
"""
|
"""
|
||||||
|
|
|
@ -59,7 +59,7 @@ class WindowsSystemSingleton(_SystemSingleton):
|
||||||
|
|
||||||
if not status:
|
if not status:
|
||||||
status = ScanStatus.USED
|
status = ScanStatus.USED
|
||||||
T1106Telem(status, UsageEnum.SINGLETON_FILE_COPY).send()
|
T1106Telem(status, UsageEnum.SINGLETON_WINAPI).send()
|
||||||
if status == ScanStatus.SCANNED:
|
if status == ScanStatus.SCANNED:
|
||||||
return False
|
return False
|
||||||
|
|
||||||
|
|
|
@ -4,8 +4,8 @@ from infection_monkey.telemetry.attack.usage_telem import UsageTelem
|
||||||
class T1106Telem(UsageTelem):
|
class T1106Telem(UsageTelem):
|
||||||
def __init__(self, status, usage):
|
def __init__(self, status, usage):
|
||||||
"""
|
"""
|
||||||
T1129 telemetry.
|
T1106 telemetry.
|
||||||
:param status: ScanStatus of technique
|
:param status: ScanStatus of technique
|
||||||
:param usage: UsageEnum type value
|
:param usage: Enum name of UsageEnum
|
||||||
"""
|
"""
|
||||||
super(T1106Telem, self).__init__("T1106", status, usage)
|
super(T1106Telem, self).__init__("T1106", status, usage)
|
||||||
|
|
|
@ -7,10 +7,10 @@ class UsageTelem(AttackTelem):
|
||||||
"""
|
"""
|
||||||
:param technique: Id of technique
|
:param technique: Id of technique
|
||||||
:param status: ScanStatus of technique
|
:param status: ScanStatus of technique
|
||||||
:param usage: Enum of UsageEnum type
|
:param usage: Usage string
|
||||||
"""
|
"""
|
||||||
super(UsageTelem, self).__init__(technique, status)
|
super(UsageTelem, self).__init__(technique, status)
|
||||||
self.usage = usage.name
|
self.usage = usage
|
||||||
|
|
||||||
def get_data(self):
|
def get_data(self):
|
||||||
data = super(UsageTelem, self).get_data()
|
data = super(UsageTelem, self).get_data()
|
||||||
|
|
|
@ -13,7 +13,5 @@ class T1035(UsageTechnique):
|
||||||
@staticmethod
|
@staticmethod
|
||||||
def get_report_data():
|
def get_report_data():
|
||||||
data = T1035.get_tech_base_data()
|
data = T1035.get_tech_base_data()
|
||||||
services = list(mongo.db.telemetry.aggregate(T1035.get_usage_query()))
|
data.update({'services': T1035.get_usage_data()})
|
||||||
services = list(map(T1035.parse_usages, services))
|
|
||||||
data.update({'services': services})
|
|
||||||
return data
|
return data
|
||||||
|
|
|
@ -1,10 +1,9 @@
|
||||||
from monkey_island.cc.database import mongo
|
from monkey_island.cc.services.attack.technique_reports import UsageTechnique
|
||||||
from monkey_island.cc.services.attack.technique_reports import AttackTechnique
|
|
||||||
|
|
||||||
__author__ = "VakarisZ"
|
__author__ = "VakarisZ"
|
||||||
|
|
||||||
|
|
||||||
class T1106(AttackTechnique):
|
class T1106(UsageTechnique):
|
||||||
tech_id = "T1106"
|
tech_id = "T1106"
|
||||||
unscanned_msg = "Monkey didn't try to directly use WinAPI."
|
unscanned_msg = "Monkey didn't try to directly use WinAPI."
|
||||||
scanned_msg = "Monkey tried to use WinAPI, but failed."
|
scanned_msg = "Monkey tried to use WinAPI, but failed."
|
||||||
|
@ -13,5 +12,5 @@ class T1106(AttackTechnique):
|
||||||
@staticmethod
|
@staticmethod
|
||||||
def get_report_data():
|
def get_report_data():
|
||||||
data = T1106.get_tech_base_data()
|
data = T1106.get_tech_base_data()
|
||||||
data.update({'api_uses': list(mongo.db.telemetry.aggregate(T1106.get_usage_query()))})
|
data.update({'api_uses': T1106.get_usage_data()})
|
||||||
return data
|
return data
|
||||||
|
|
|
@ -13,7 +13,5 @@ class T1129(UsageTechnique):
|
||||||
@staticmethod
|
@staticmethod
|
||||||
def get_report_data():
|
def get_report_data():
|
||||||
data = T1129.get_tech_base_data()
|
data = T1129.get_tech_base_data()
|
||||||
dlls = list(mongo.db.telemetry.aggregate(T1129.get_usage_query()))
|
data.update({'dlls': T1129.get_usage_data()})
|
||||||
dlls = list(map(T1129.parse_usages, dlls))
|
|
||||||
data.update({'dlls': dlls})
|
|
||||||
return data
|
return data
|
||||||
|
|
|
@ -134,6 +134,11 @@ class UsageTechnique(AttackTechnique):
|
||||||
"Check if usage enum field exists and covers all telem. statuses.")
|
"Check if usage enum field exists and covers all telem. statuses.")
|
||||||
return usage
|
return usage
|
||||||
|
|
||||||
|
@classmethod
|
||||||
|
def get_usage_data(cls):
|
||||||
|
data = list(mongo.db.telemetry.aggregate(cls.get_usage_query()))
|
||||||
|
return list(map(cls.parse_usages, data))
|
||||||
|
|
||||||
@classmethod
|
@classmethod
|
||||||
def get_usage_query(cls):
|
def get_usage_query(cls):
|
||||||
"""
|
"""
|
||||||
|
|
Loading…
Reference in New Issue