p34709852
/
monkey
forked from p15670423/monkey
1
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

Agent: Publish PasswordRestorationEvent in zerologon

This commit is contained in:
Shreya Malviya 2022-10-06 17:05:48 +05:30 committed by Ilija Lazoroski
parent a50554f115
commit a5e31ee998
1 changed files with 14 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
monkey/infection_monkey/exploit/zerologon.py
View File

@ -15,7 +15,7 @@ import impacket
from impacket.dcerpc.v5 import epm, nrpc, rpcrt, transport from impacket.dcerpc.v5 import epm, nrpc, rpcrt, transport
from impacket.dcerpc.v5.dtypes import NULL from impacket.dcerpc.v5.dtypes import NULL
from common.agent_events import CredentialsStolenEvent from common.agent_events import CredentialsStolenEvent, PasswordRestorationEvent
from common.common_consts.timeouts import LONG_REQUEST_TIMEOUT from common.common_consts.timeouts import LONG_REQUEST_TIMEOUT
from common.credentials import Credentials, LMHash, NTHash, Username from common.credentials import Credentials, LMHash, NTHash, Username
from common.tags import ( from common.tags import (
@ -46,6 +46,8 @@ CREDENTIALS_STOLEN_EVENT_TAGS = frozenset(
} }
) )
PASSWORD_RESTORATION_EVENT_TAGS = frozenset(ZEROLOGON_EXPLOITER_TAG)
class ZerologonExploiter(HostExploiter): class ZerologonExploiter(HostExploiter):
_EXPLOITED_SERVICE = "Netlogon" _EXPLOITED_SERVICE = "Netlogon"
@ -105,6 +107,8 @@ class ZerologonExploiter(HostExploiter):
self.exploit_info["password_restored"] = False self.exploit_info["password_restored"] = False
logger.info("System exploited but couldn't restore password!") logger.info("System exploited but couldn't restore password!")
self._publish_password_restoration_event(success=self.exploit_info["password_restored"])
self.store_extracted_creds_for_exploitation() self.store_extracted_creds_for_exploitation()
else: else:
logger.info("System was not exploited.") logger.info("System was not exploited.")
@ -313,6 +317,15 @@ class ZerologonExploiter(HostExploiter):
"nt_hash": nthash, "nt_hash": nthash,
} }
def _publish_password_restoration_event(self, success: bool):
password_restoration_event = PasswordRestorationEvent(
source=get_agent_id(),
target=self.host.ip_addr,
tags=PASSWORD_RESTORATION_EVENT_TAGS,
success=success,
)
self.agent_event_queue.publish(password_restoration_event)
def store_extracted_creds_for_exploitation(self) -> None: def store_extracted_creds_for_exploitation(self) -> None:
for user in self._extracted_creds.keys(): for user in self._extracted_creds.keys():
self.send_extracted_creds_as_credential_telemetry( self.send_extracted_creds_as_credential_telemetry(