p41275903
/
monkey
forked from p15670423/monkey
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Use mongo search for report data

This commit is contained in:
Shreya 2020-06-22 14:25:36 +05:30
parent 37d37b6f9f
commit a91e65e49a
1 changed files with 15 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
monkey/monkey_island/cc/services/attack/technique_reports/T1158.py
View File

@ -1,5 +1,5 @@
from monkey_island.cc.services.attack.technique_reports import AttackTechnique from monkey_island.cc.services.attack.technique_reports import AttackTechnique
from monkey_island.cc.services.reporting.report import ReportService from monkey_island.cc.database import mongo
from common.utils.attack_utils import ScanStatus from common.utils.attack_utils import ScanStatus
from common.data.post_breach_consts import POST_BREACH_HIDDEN_FILES from common.data.post_breach_consts import POST_BREACH_HIDDEN_FILES
@ -13,26 +13,25 @@ class T1158(AttackTechnique):
scanned_msg = "Monkey tried creating hidden files and folders on the system but failed." scanned_msg = "Monkey tried creating hidden files and folders on the system but failed."
used_msg = "Monkey created hidden files and folders on the system." used_msg = "Monkey created hidden files and folders on the system."
query = [{'$match': {'telem_category': 'post_breach',
'data.name': POST_BREACH_HIDDEN_FILES}},
{'$project': {'_id': 0,
'machine': {'hostname': '$data.hostname',
'ips': ['$data.ip']},
'result': '$data.result'}}]
@staticmethod @staticmethod
def get_report_data(): def get_report_data():
data = {'title': T1158.technique_title(), 'info': []} data = {'title': T1158.technique_title(), 'info': []}
scanned_nodes = ReportService.get_scanned() hidden_file_info = list(mongo.db.telemetry.aggregate(T1158.query))
status = []
for node in scanned_nodes: status = []
if node['pba_results'] != 'None': for pba_node in hidden_file_info:
for pba in node['pba_results']: status.append(pba_node['result'][1])
if pba['name'] == POST_BREACH_HIDDEN_FILES:
status.append(pba['result'][1])
data['info'].append({
'machine': {
'hostname': pba['hostname'],
'ips': node['ip_addresses']
},
'result': pba['result'][0]
})
status = (ScanStatus.USED.value if any(status) else ScanStatus.SCANNED.value)\ status = (ScanStatus.USED.value if any(status) else ScanStatus.SCANNED.value)\
if status else ScanStatus.UNSCANNEDvalue if status else ScanStatus.UNSCANNED.value
data.update(T1158.get_base_data_by_status(status)) data.update(T1158.get_base_data_by_status(status))
data.update({'info': hidden_file_info})
return data return data