Refactored T1106 to use Usage enum and fixed SMB bugs

monkey/common/utils/attack_utils.py

@@ -15,6 +15,12 @@ class UsageEnum(Enum):
            ScanStatus.SCANNED.value: "SMB exploiter failed to run the monkey by creating a service via MS-SCMR."}
     MIMIKATZ = {ScanStatus.USED.value: "Windows module loader was used to load Mimikatz DLL.",
                 ScanStatus.SCANNED.value: "Monkey tried to load Mimikatz DLL, but failed."}
+    MIMIKATZ_FILE_COPY = {ScanStatus.USED.value: "WinAPI was called to load mimikatz.",
+                          ScanStatus.SCANNED.value: "Monkey tried to call WinAPI to load mimikatz, but failed."}
+    SINGLETON_FILE_COPY = {ScanStatus.USED.value: "WinAPI was called to acquire system singleton for monkey's process.",
+                           ScanStatus.SCANNED.value: "WinAPI call to acquire system singleton"
+                                                     " for monkey process wasn't successful."}
+    DROPPER_FILE_COPY = {ScanStatus.USED.value: "WinAPI was used to mark monkey files for deletion on next boot."}
 
 
 # Dict that describes what BITS job was used for

monkey/infection_monkey/dropper.py

@@ -15,7 +15,7 @@ from infection_monkey.exploit.tools.helpers import build_monkey_commandline_expl
 from infection_monkey.model import MONKEY_CMDLINE_WINDOWS, MONKEY_CMDLINE_LINUX, GENERAL_CMDLINE_LINUX
 from infection_monkey.system_info import SystemInfoCollector, OperatingSystem
 from infection_monkey.telemetry.attack.t1106_telem import T1106Telem
-from common.utils.attack_utils import ScanStatus
+from common.utils.attack_utils import ScanStatus, UsageEnum
 
 if "win32" == sys.platform:
     from win32process import DETACHED_PROCESS
@@ -158,7 +158,6 @@ class MonkeyDrops(object):
                     else:
                         LOG.debug("Dropper source file '%s' is marked for deletion on next boot",
                                   self._config['source_path'])
-                        T1106Telem(ScanStatus.USED, "WinAPI was used to mark monkey files"
+                        T1106Telem(ScanStatus.USED, UsageEnum.DROPPER_FILE_COPY).send()
-                                                    " for deletion on next boot.").send()
         except AttributeError:
             LOG.error("Invalid configuration options. Failing")

monkey/infection_monkey/exploit/sambacry.py

@@ -270,8 +270,8 @@ class SambaCryExploiter(HostExploiter):
         with monkeyfs.open(monkey_bin_64_src_path, "rb") as monkey_bin_file:
             smb_client.putFile(share, "\\%s" % self.SAMBACRY_MONKEY_FILENAME_64, monkey_bin_file.read)
         T1105Telem(ScanStatus.USED,
-                   get_interface_to_target(self.host.ip_addr[0]),
+                   get_interface_to_target(self.host.ip_addr),
-                   self.host.ip_addr[0],
+                   self.host.ip_addr,
                    monkey_bin_64_src_path).send()
         smb_client.disconnectTree(tree_id)
 

monkey/infection_monkey/exploit/tools/helpers.py

@@ -19,6 +19,7 @@ def get_interface_to_target(dst):
             s.connect((dst, 1))
             ip_to_dst = s.getsockname()[0]
         except KeyError:
+            LOG.debug("Couldn't get an interface to the target, presuming that target is localhost.")
             ip_to_dst = '127.0.0.1'
         finally:
             s.close()

monkey/infection_monkey/exploit/tools/smb_tools.py

@@ -140,8 +140,8 @@ class SmbTools(object):
 
                 file_uploaded = True
                 T1105Telem(ScanStatus.USED,
-                           get_interface_to_target(host.ip_addr[0]),
+                           get_interface_to_target(host.ip_addr),
-                           host.ip_addr[0],
+                           host.ip_addr,
                            dst_path).send()
                 LOG.info("Copied monkey file '%s' to remote share '%s' [%s] on victim %r",
                          src_path, share_name, share_path, host)
@@ -151,8 +151,8 @@ class SmbTools(object):
                 LOG.debug("Error uploading monkey to share '%s' on victim %r: %s",
                           share_name, host, exc)
                 T1105Telem(ScanStatus.SCANNED,
-                           get_interface_to_target(host.ip_addr[0]),
+                           get_interface_to_target(host.ip_addr),
-                           host.ip_addr[0],
+                           host.ip_addr,
                            dst_path).send()
                 continue
             finally:

monkey/infection_monkey/system_info/mimikatz_collector.py

@@ -47,7 +47,6 @@ class MimikatzCollector(object):
             collect_proto = ctypes.WINFUNCTYPE(ctypes.c_int)
             get_proto = ctypes.WINFUNCTYPE(MimikatzCollector.LogonData)
             get_text_output_proto = ctypes.WINFUNCTYPE(ctypes.c_wchar_p)
-            T1106Telem(ScanStatus.USED, "WinAPI was called to load mimikatz.").send()
             self._collect = collect_proto(("collect", self._dll))
             self._get = get_proto(("get", self._dll))
             self._get_text_output_proto = get_text_output_proto(("getTextOutput", self._dll))
@@ -57,7 +56,7 @@ class MimikatzCollector(object):
             LOG.exception("Error initializing mimikatz collector")
             status = ScanStatus.SCANNED
         T1129Telem(status, UsageEnum.MIMIKATZ).send()
-        T1106Telem(ScanStatus.SCANNED, "Monkey tried to call WinAPI to load mimikatz.").send()
+        T1106Telem(status, UsageEnum.MIMIKATZ_FILE_COPY).send()
 
     def get_logon_info(self):
         """

monkey/infection_monkey/system_singleton.py

@@ -5,7 +5,7 @@ from abc import ABCMeta, abstractmethod
 
 from infection_monkey.config import WormConfiguration
 from infection_monkey.telemetry.attack.t1106_telem import T1106Telem
-from common.utils.attack_utils import ScanStatus
+from common.utils.attack_utils import ScanStatus, UsageEnum
 
 __author__ = 'itamar'
 
@@ -45,22 +45,25 @@ class WindowsSystemSingleton(_SystemSingleton):
                                                      ctypes.c_bool(True),
                                                      ctypes.c_char_p(self._mutex_name))
         last_error = ctypes.windll.kernel32.GetLastError()
+
+        status = None
         if not handle:
             LOG.error("Cannot acquire system singleton %r, unknown error %d",
                       self._mutex_name, last_error)
-            T1106Telem(ScanStatus.SCANNED, "WinAPI call to acquire system singleton "
+            status = ScanStatus.SCANNED
-                                           "for monkey process wasn't successful.").send()
-
-            return False
 
         if winerror.ERROR_ALREADY_EXISTS == last_error:
+            status = ScanStatus.SCANNED
             LOG.debug("Cannot acquire system singleton %r, mutex already exist",
                       self._mutex_name)
 
+        if not status:
+            status = ScanStatus.USED
+        T1106Telem(status, UsageEnum.SINGLETON_FILE_COPY).send()
+        if status == ScanStatus.SCANNED:
             return False
 
         self._mutex_handle = handle
-        T1106Telem(ScanStatus.USED, "WinAPI was called to acquire system singleton for monkey's process.").send()
         LOG.debug("Global singleton mutex %r acquired",
                   self._mutex_name)
 

monkey/infection_monkey/telemetry/attack/t1106_telem.py

@@ -6,6 +6,6 @@ class T1106Telem(UsageTelem):
         """
         T1129 telemetry.
         :param status: ScanStatus of technique
-        :param usage: Usage string
+        :param usage: UsageEnum type value
         """
         super(T1106Telem, self).__init__("T1106", status, usage)