p34709852
/
monkey
forked from p15670423/monkey
1
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity
7,389 Commits 30 Branches 0 Tags 47 MiB
Commit Graph

7389 Commits

Author SHA1 Message Date
Mike Salvatore 040b37697b Agent: Add telemetry type for sending stolen credentials 2022-02-16 13:58:55 -05:00
Mike Salvatore 49f1675b38
Merge pull request #1717 from guardicore/1695-ssh-credential-collector 
1695 ssh credential collector
 2022-02-16 12:45:38 -05:00
Ilija Lazoroski 897bc11d7b Agent: Use distinct fields for SSH Keypair 2022-02-16 18:37:16 +01:00
Ilija Lazoroski 5f8e3e3d8e Agent: Use Telemetry messenger to send SSH collector telemetries 2022-02-16 18:23:29 +01:00
Ilija Lazoroski 63d632d142 Agent: Rework ssh credential collector to match credential architecture 
* Parametrize empty result unit test
* Apply small changes to ssh credential collector
 2022-02-16 17:37:12 +01:00
Ilija Lazoroski a97b8706ec Agent: Add SSH keypair credential type 2022-02-16 17:29:21 +01:00
Ilija Lazoroski b1b0840aed Agent: Rename SSH credentials collector to match class name 2022-02-16 17:28:11 +01:00
Ilija Lazoroski 3d64d0d2e4 Island: Refactor T1145 report according to the attack telemetry 2022-02-16 15:44:35 +01:00
Ilija Lazoroski 6b64b655ce Agent: Add T1145 attack telemetry 2022-02-16 15:44:35 +01:00
Ilija Lazoroski a03a5145a7 Agent: Remove known_hosts from SSH Credential Collector 
It is not used anywhere.
 2022-02-16 15:44:35 +01:00
Ilija Lazoroski e9e5e95f49 Agent, UT: Separate ssh_handler from SSH Credential Collector 
* Add different UTs based on what ssh_handler returns
* Fix logic in SSH Credential Collector
 2022-02-16 15:44:35 +01:00
Ilija Lazoroski 5aa5e33356 Agent, UT: Refactor SSH info collector to credential collector 2022-02-16 15:44:35 +01:00
Shreya Malviya 7787984f4a BB: Remove ProcessListCollector from BB config templates 2022-02-16 17:31:40 +05:30
Shreya Malviya 3017e6b250 UT: Remove references to process list collection system info collector in test data 2022-02-16 17:25:43 +05:30
Shreya Malviya 32cad45676 Island: Refactor post breach telemetry processing functions 2022-02-16 17:09:13 +05:30
Shreya Malviya 44a7b7e148 Island: Fix TODO comment in monkey_island/cc/services/telemetry/processing/post_breach.py 2022-02-16 17:09:13 +05:30
Shreya Malviya 123f0aab16 Changelog: Add entry for process list collection PBA 2022-02-16 17:09:13 +05:30
Shreya Malviya e674f9e0c0 Island: Move antivirus check for ZT report from system info processing to PBA processing 2022-02-16 17:09:10 +05:30
Shreya Malviya 9d3931c380 Island: Fix T1082's mongo query to get the right data 2022-02-16 17:06:17 +05:30
Shreya Malviya ff6fd52979 UI: Modify how process list collection PBA is shown in Security report 2022-02-16 17:06:17 +05:30
Shreya Malviya afa7d4fca4 Agent: Modify process list collection PBA to return dict of processes instead of string 2022-02-16 17:06:17 +05:30
Shreya Malviya 5ab7bc520e UI: Modify variable names in T1082.js as per changes to backend 2022-02-16 17:06:17 +05:30
Shreya Malviya 547d4fce54 Island: Modify T1082's reporting to get data from process collection PBA too 2022-02-16 17:06:17 +05:30
Shreya Malviya 417f40d62d Agent: Add TODOs in automated master and process collection list PBA 2022-02-16 17:06:17 +05:30
Shreya Malviya 7cee2e49a2 Agent: Improve exception catching logic in process list collection PBA 2022-02-16 17:06:17 +05:30
Shreya Malviya fcfa01223d Project: Remove ProcessListCollector from Vulture allowlist 2022-02-16 17:06:17 +05:30
Shreya Malviya 6ab62c6f56 Docs: Change adding system info collectors' documentation to refer to 
existing files
 2022-02-16 17:06:17 +05:30
Shreya Malviya a8059f021a Island: Change config schema for process list collection 2022-02-16 17:06:10 +05:30
Shreya Malviya 4839f099a4 Agent: Add process list collection PBA 
Instead of a system info collector, it is now a PBA.
 2022-02-16 17:02:06 +05:30
Shreya Malviya 5d01f12d45 Common: Add PBA const and remove system info collector const for process list collection 2022-02-16 17:02:01 +05:30
Mike Salvatore 976c46cf86
Merge pull request #1715 from guardicore/1695-credential-collectors 
Agent: define credential collector, credentials interfaces
 2022-02-15 14:34:47 -05:00
Mike Salvatore a9bb2dee70 Agent: Renumber the CredentialType Enum 2022-02-15 14:26:15 -05:00
Mike Salvatore 879abf3df0 Agent: Export MimikatzCredentialCollector from credential_collectors 2022-02-15 14:21:07 -05:00
Mike Salvatore 0583cab8e0 Agent: Rename mimikatz_cred_collector.py to match the class name 2022-02-15 14:17:28 -05:00
Mike Salvatore 569159b11a Agent: Move the definition of ICredentialCollector to i_puppet 
Low-level components plug into high-level components. i_puppet defines
all of the interfaces that puppets can use, while the concrete
implementations of these things rely on the definitions in i_puppet.
 2022-02-15 14:07:59 -05:00
Mike Salvatore c39fb6746d Agent: Rename ICredentialComponent.type -> credential_type 
"type" is built-in function in Python. To avoid confusion or a potential
name collision, this commit renames the ICredentialComponent.type field
to ICredentialComponent.credential_type
 2022-02-15 13:47:01 -05:00
Mike Salvatore 236b545816 UT: Extract function collect_credentials() to reduce code duplication 2022-02-15 13:30:13 -05:00
Mike Salvatore 86f2c7b08c UT: Parametrize test_mimikatz_collector.test_empty_results() 2022-02-15 13:28:38 -05:00
Mike Salvatore ebd5642b52 Agent: Refactor credentials and credential_components as dataclasses 
Using frozen dataclasses for Credentials and ICredentialComponents
automatically creates a useful __eq__() function that allows us to
easily compare credentials-related objects.
 2022-02-15 12:27:56 -05:00
vakarisz 811434ff22 Agent: improved type hints in mimikatz_cred_collector.py 2022-02-15 18:41:19 +02:00
vakarisz ac376a0014 Agent: change the interface of Credentials 
Refactor from dataclass to object with tuples. This enforces read only identities and secrets so users don't modify them
 2022-02-15 18:39:17 +02:00
vakarisz 8868fb9b0c Agent: change ICredentialComponent interface 
Interface changed from dataclass (dataclasses are not inheritable) to simple class with type abstract property
 2022-02-15 18:35:32 +02:00
vakarisz 26806392ec Agent: split up nt and lm hash credential types 2022-02-15 18:33:04 +02:00
vakarisz d392de4a02 Agent: remove ssh_keypair, as it's not used anywhere 2022-02-15 18:32:00 +02:00
vakarisz ae9fed3c2b Agent: fixup typehints in ICredentialCollector 2022-02-15 16:16:43 +02:00
vakarisz 01612c402a Agent: add options to ICredentialCollector interface 2022-02-15 15:25:42 +02:00
vakarisz 0fae933477 Agent: refactor content dict out of credential component 
Content dict serves no purpose, because dataclasses can be serialized without explicit conversion to dict
 2022-02-15 14:46:21 +02:00
vakarisz b7003bc231 Agent: split up nt and lm hashes into separate credential components 2022-02-15 14:19:53 +02:00
vakarisz 9037dfdf99 Agent: rename CredentialTypes enum to CredentialType 2022-02-15 12:42:36 +02:00
vakarisz 02cdebb88b Agent: fix ICredentialCollector return type-hint 2022-02-15 12:41:19 +02:00