Monkey, Island: use process start timestamp to track monkey start time instead of datetime string of wakeup call

This change allows us to avoid the issues where agents are on a different timezone than island and process start time is more precise than
This commit is contained in:
VakarisZ 2021-12-03 15:09:17 +02:00
parent 52369f0fae
commit 9d7c7073c3
5 changed files with 21 additions and 5 deletions

View File

@ -1,7 +1,6 @@
import json import json
import logging import logging
import platform import platform
from datetime import datetime
from pprint import pformat from pprint import pformat
from socket import gethostname from socket import gethostname
from urllib.parse import urljoin from urllib.parse import urljoin
@ -12,12 +11,12 @@ from requests.exceptions import ConnectionError
import infection_monkey.monkeyfs as monkeyfs import infection_monkey.monkeyfs as monkeyfs
import infection_monkey.tunnel as tunnel import infection_monkey.tunnel as tunnel
from common.common_consts.api_url_consts import T1216_PBA_FILE_DOWNLOAD_PATH from common.common_consts.api_url_consts import T1216_PBA_FILE_DOWNLOAD_PATH
from common.common_consts.time_formats import DEFAULT_TIME_FORMAT
from common.common_consts.timeouts import LONG_REQUEST_TIMEOUT, MEDIUM_REQUEST_TIMEOUT from common.common_consts.timeouts import LONG_REQUEST_TIMEOUT, MEDIUM_REQUEST_TIMEOUT
from infection_monkey.config import GUID, WormConfiguration from infection_monkey.config import GUID, WormConfiguration
from infection_monkey.network.info import local_ips from infection_monkey.network.info import local_ips
from infection_monkey.transport.http import HTTPConnectProxy from infection_monkey.transport.http import HTTPConnectProxy
from infection_monkey.transport.tcp import TcpProxy from infection_monkey.transport.tcp import TcpProxy
from infection_monkey.utils import agent_process
from infection_monkey.utils.environment import is_windows_os from infection_monkey.utils.environment import is_windows_os
requests.packages.urllib3.disable_warnings() requests.packages.urllib3.disable_warnings()
@ -52,7 +51,7 @@ class ControlClient(object):
"description": " ".join(platform.uname()), "description": " ".join(platform.uname()),
"config": WormConfiguration.as_dict(), "config": WormConfiguration.as_dict(),
"parent": parent, "parent": parent,
"launch_time": str(datetime.now().strftime(DEFAULT_TIME_FORMAT)), "launch_time": agent_process.get_start_time(),
} }
if ControlClient.proxies: if ControlClient.proxies:

View File

@ -0,0 +1,8 @@
import os
import psutil
def get_start_time() -> float:
agent_process = psutil.Process(os.getpid())
return agent_process.create_time()

View File

@ -9,6 +9,7 @@ from mongoengine import (
DoesNotExist, DoesNotExist,
DynamicField, DynamicField,
EmbeddedDocumentField, EmbeddedDocumentField,
FloatField,
ListField, ListField,
ReferenceField, ReferenceField,
StringField, StringField,
@ -38,7 +39,7 @@ class Monkey(Document):
description = StringField() description = StringField()
hostname = StringField() hostname = StringField()
ip_addresses = ListField(StringField()) ip_addresses = ListField(StringField())
launch_time = StringField() launch_time = FloatField()
keepalive = DateTimeField() keepalive = DateTimeField()
modifytime = DateTimeField() modifytime = DateTimeField()
# TODO make "parent" an embedded document, so this can be removed and the schema explained ( # TODO make "parent" an embedded document, so this can be removed and the schema explained (

View File

@ -3,6 +3,7 @@ from typing import List
from monkey_island.cc.database import mongo from monkey_island.cc.database import mongo
from monkey_island.cc.services.node import NodeService from monkey_island.cc.services.node import NodeService
from monkey_island.cc.services.utils.formatting import timestamp_to_date
@dataclass @dataclass
@ -27,5 +28,5 @@ def monkey_to_manual_exploitation(monkey: dict) -> ManualExploitation:
return ManualExploitation( return ManualExploitation(
hostname=monkey["hostname"], hostname=monkey["hostname"],
ip_addresses=monkey["ip_addresses"], ip_addresses=monkey["ip_addresses"],
start_time=monkey["launch_time"], start_time=timestamp_to_date(monkey["launch_time"]),
) )

View File

@ -0,0 +1,7 @@
from datetime import datetime
from common.common_consts.time_formats import DEFAULT_TIME_FORMAT
def timestamp_to_date(timestamp: int) -> str:
return datetime.fromtimestamp(timestamp).strftime(DEFAULT_TIME_FORMAT)