forked from p15670423/monkey
Agent: Change the logic of depth to represent current depth
Based on the previous logic the depth parameter represented hops remaining, not current depth.
This commit is contained in:
parent
e8001d8cf7
commit
df77ca4f96
|
@ -60,7 +60,7 @@ class Configuration(object):
|
|||
###########################
|
||||
|
||||
# depth of propagation
|
||||
depth = 2
|
||||
depth = 0
|
||||
max_depth = None
|
||||
|
||||
keep_tunnel_open_time = 30
|
||||
|
|
|
@ -104,7 +104,7 @@ class HadoopExploiter(WebRCE):
|
|||
|
||||
def _build_command(self, path, http_path):
|
||||
# Build command to execute
|
||||
monkey_cmd = build_monkey_commandline(self.host, self.current_depth - 1)
|
||||
monkey_cmd = build_monkey_commandline(self.host, self.current_depth + 1)
|
||||
if "linux" in self.host.os["type"]:
|
||||
base_command = HADOOP_LINUX_COMMAND
|
||||
else:
|
||||
|
|
|
@ -114,7 +114,7 @@ class Log4ShellExploiter(WebRCE):
|
|||
|
||||
def _build_command(self, path: PurePath, http_path) -> str:
|
||||
# Build command to execute
|
||||
monkey_cmd = build_monkey_commandline(self.host, self.current_depth - 1, location=path)
|
||||
monkey_cmd = build_monkey_commandline(self.host, self.current_depth + 1, location=path)
|
||||
if "linux" in self.host.os["type"]:
|
||||
base_command = LOG4SHELL_LINUX_COMMAND
|
||||
else:
|
||||
|
|
|
@ -178,7 +178,7 @@ class MSSQLExploiter(HostExploiter):
|
|||
|
||||
def _build_agent_launch_command(self, agent_path_on_victim: PureWindowsPath) -> str:
|
||||
agent_args = build_monkey_commandline(
|
||||
self.host, self.current_depth - 1, agent_path_on_victim
|
||||
self.host, self.current_depth + 1, agent_path_on_victim
|
||||
)
|
||||
|
||||
return f"{agent_path_on_victim} {DROPPER_ARG} {agent_args}"
|
||||
|
|
|
@ -168,7 +168,7 @@ class PowerShellExploiter(HostExploiter):
|
|||
|
||||
def _run_monkey_executable_on_victim(self, executable_path):
|
||||
monkey_execution_command = build_monkey_execution_command(
|
||||
self.host, self.current_depth - 1, executable_path
|
||||
self.host, self.current_depth + 1, executable_path
|
||||
)
|
||||
|
||||
logger.info(
|
||||
|
|
|
@ -91,13 +91,13 @@ class SMBExploiter(HostExploiter):
|
|||
"dropper_path": remote_full_path
|
||||
} + build_monkey_commandline(
|
||||
self.host,
|
||||
self.current_depth - 1,
|
||||
self.current_depth + 1,
|
||||
str(dest_path),
|
||||
)
|
||||
else:
|
||||
cmdline = MONKEY_CMDLINE_DETACHED_WINDOWS % {
|
||||
"monkey_path": remote_full_path
|
||||
} + build_monkey_commandline(self.host, self.current_depth - 1)
|
||||
} + build_monkey_commandline(self.host, self.current_depth + 1)
|
||||
|
||||
smb_conn = None
|
||||
for str_bind_format, port in SMBExploiter.KNOWN_PROTOCOLS.values():
|
||||
|
|
|
@ -242,7 +242,7 @@ class SSHExploiter(HostExploiter):
|
|||
|
||||
try:
|
||||
cmdline = f"{monkey_path_on_victim} {MONKEY_ARG}"
|
||||
cmdline += build_monkey_commandline(self.host, self.current_depth - 1)
|
||||
cmdline += build_monkey_commandline(self.host, self.current_depth + 1)
|
||||
cmdline += " > /dev/null 2>&1 &"
|
||||
ssh.exec_command(cmdline, timeout=SSH_EXEC_TIMEOUT)
|
||||
|
||||
|
|
|
@ -369,14 +369,14 @@ class WebRCE(HostExploiter):
|
|||
default_path = self.get_default_dropper_path()
|
||||
if default_path is False:
|
||||
return False
|
||||
monkey_cmd = build_monkey_commandline(self.host, self.current_depth - 1, default_path)
|
||||
monkey_cmd = build_monkey_commandline(self.host, self.current_depth + 1, default_path)
|
||||
command = RUN_MONKEY % {
|
||||
"monkey_path": path,
|
||||
"monkey_type": DROPPER_ARG,
|
||||
"parameters": monkey_cmd,
|
||||
}
|
||||
else:
|
||||
monkey_cmd = build_monkey_commandline(self.host, self.current_depth - 1)
|
||||
monkey_cmd = build_monkey_commandline(self.host, self.current_depth + 1)
|
||||
command = RUN_MONKEY % {
|
||||
"monkey_path": path,
|
||||
"monkey_type": MONKEY_ARG,
|
||||
|
|
|
@ -96,13 +96,13 @@ class WmiExploiter(HostExploiter):
|
|||
"dropper_path": remote_full_path
|
||||
} + build_monkey_commandline(
|
||||
self.host,
|
||||
self.current_depth - 1,
|
||||
self.current_depth + 1,
|
||||
DROPPER_TARGET_PATH_WIN64,
|
||||
)
|
||||
else:
|
||||
cmdline = MONKEY_CMDLINE_WINDOWS % {
|
||||
"monkey_path": remote_full_path
|
||||
} + build_monkey_commandline(self.host, self.current_depth - 1)
|
||||
} + build_monkey_commandline(self.host, self.current_depth + 1)
|
||||
|
||||
# execute the remote monkey
|
||||
result = WmiTools.get_object(wmi_connection, "Win32_Process").Create(
|
||||
|
|
|
@ -169,10 +169,10 @@ class AutomatedMaster(IMaster):
|
|||
# still running.
|
||||
credential_collector_thread.join()
|
||||
|
||||
current_depth = self._current_depth if self._current_depth is not None else config["depth"]
|
||||
current_depth = self._current_depth if self._current_depth is not None else 0
|
||||
logger.info(f"Current depth is {current_depth}")
|
||||
|
||||
if self._can_propagate() and current_depth > 0:
|
||||
if self._can_propagate() and current_depth < config["depth"]:
|
||||
self._propagator.propagate(config["propagation"], current_depth, self._stop)
|
||||
|
||||
payload_thread = create_daemon_thread(
|
||||
|
|
|
@ -166,7 +166,7 @@ class InfectionMonkey:
|
|||
firewall.add_firewall_rule()
|
||||
|
||||
self._monkey_inbound_tunnel = self._control_client.create_control_tunnel()
|
||||
if self._monkey_inbound_tunnel and self._propagation_enabled():
|
||||
if self._monkey_inbound_tunnel:
|
||||
self._monkey_inbound_tunnel.start()
|
||||
|
||||
StateTelem(is_done=False, version=get_version()).send()
|
||||
|
@ -353,7 +353,7 @@ class InfectionMonkey:
|
|||
|
||||
reset_signal_handlers()
|
||||
|
||||
if self._monkey_inbound_tunnel and self._propagation_enabled():
|
||||
if self._monkey_inbound_tunnel:
|
||||
self._monkey_inbound_tunnel.stop()
|
||||
self._monkey_inbound_tunnel.join()
|
||||
|
||||
|
@ -378,12 +378,6 @@ class InfectionMonkey:
|
|||
|
||||
logger.info("Monkey is shutting down")
|
||||
|
||||
def _propagation_enabled(self) -> bool:
|
||||
# If self._current_depth is None, assume that propagation is desired.
|
||||
# The Master will ignore this value if it is None and pull the actual
|
||||
# maximum depth from the server
|
||||
return self._current_depth is None or self._current_depth > 0
|
||||
|
||||
def _close_tunnel(self):
|
||||
tunnel_address = (
|
||||
self._control_client.proxies.get("https", "").replace("http://", "").split(":")[0]
|
||||
|
|
|
@ -40,8 +40,6 @@ def build_monkey_commandline_explicitly(
|
|||
cmdline.append("-s")
|
||||
cmdline.append(str(server))
|
||||
if depth is not None:
|
||||
if int(depth) < 0:
|
||||
depth = 0
|
||||
cmdline.append("-d")
|
||||
cmdline.append(str(depth))
|
||||
if location is not None:
|
||||
|
|
|
@ -28,16 +28,6 @@ def test_build_monkey_commandline_explicitly_arguments():
|
|||
assert expected == actual
|
||||
|
||||
|
||||
def test_build_monkey_commandline_explicitly_depth_condition_less():
|
||||
expected = [
|
||||
"-d",
|
||||
"0",
|
||||
]
|
||||
actual = build_monkey_commandline_explicitly(depth=-50)
|
||||
|
||||
assert expected == actual
|
||||
|
||||
|
||||
def test_build_monkey_commandline_explicitly_depth_condition_greater():
|
||||
expected = [
|
||||
"-d",
|
||||
|
|
Loading…
Reference in New Issue