- Oracle WebLogic server at {issue.machine} ({issue.machine} ({issue.ip_address}) is vulnerable to remote code execution attack.
@@ -867,7 +869,23 @@ class ReportPageComponent extends AuthComponent {
);
}
-
+generateMSSQLIssue(issue) {
+ return(
+
+ Disable the xp_cmdshell option.
+
+ The machine {issue.machine} ({issue.ip_address}) is vulnerable to a MSSQL exploit attack.
+
+ The attack was made possible because the target machine used an outdated MSSQL server configuration allowing
+ the usage of the xp_cmdshell command. To learn more about how to disable this feature, read
+ Microsoft's documentation.
+
+
+ );
+ }
generateIssue = (issue) => {
let data;
@@ -935,6 +953,9 @@ class ReportPageComponent extends AuthComponent {
case 'hadoop':
data = this.generateHadoopIssue(issue);
break;
+ case 'mssql':
+ data = this.generateMSSQLIssue(issue);
+ break;
}
return data;
};
diff --git a/monkey/monkey_island/cc/ui/src/components/pages/RunMonkeyPage.js b/monkey/monkey_island/cc/ui/src/components/pages/RunMonkeyPage.js
index 4543a5c34..5c93065c4 100644
--- a/monkey/monkey_island/cc/ui/src/components/pages/RunMonkeyPage.js
+++ b/monkey/monkey_island/cc/ui/src/components/pages/RunMonkeyPage.js
@@ -52,7 +52,7 @@ class RunMonkeyPageComponent extends AuthComponent {
generateLinuxCmd(ip, is32Bit) {
let bitText = is32Bit ? '32' : '64';
- return `curl -O -k https://${ip}:5000/api/monkey/download/monkey-linux-${bitText}; chmod +x monkey-linux-${bitText}; ./monkey-linux-${bitText} m0nk3y -s ${ip}:5000`
+ return `wget --no-check-certificate https://${ip}:5000/api/monkey/download/monkey-linux-${bitText}; chmod +x monkey-linux-${bitText}; ./monkey-linux-${bitText} m0nk3y -s ${ip}:5000`
}
generateWindowsCmd(ip, is32Bit) {
diff --git a/monkey/monkey_island/cc/ui/src/components/report-components/BreachedServers.js b/monkey/monkey_island/cc/ui/src/components/report-components/BreachedServers.js
index d23a14c38..16f445ce9 100644
--- a/monkey/monkey_island/cc/ui/src/components/report-components/BreachedServers.js
+++ b/monkey/monkey_island/cc/ui/src/components/report-components/BreachedServers.js
@@ -5,12 +5,17 @@ let renderArray = function(val) {
return ;
};
+let renderIpAddresses = function (val) {
+ return {renderArray(val.ip_addresses)} {(val.domain_name ? " (".concat(val.domain_name, ")") : "")}
;
+};
+
const columns = [
{
Header: 'Breached Servers',
columns: [
{Header: 'Machine', accessor: 'label'},
- {Header: 'IP Addresses', id: 'ip_addresses', accessor: x => renderArray(x.ip_addresses)},
+ {Header: 'IP Addresses', id: 'ip_addresses',
+ accessor: x => renderIpAddresses(x)},
{Header: 'Exploits', id: 'exploits', accessor: x => renderArray(x.exploits)}
]
}
diff --git a/monkey/monkey_island/cc/ui/src/components/report-components/ScannedServers.js b/monkey/monkey_island/cc/ui/src/components/report-components/ScannedServers.js
index 9b62bbdc5..57418e415 100644
--- a/monkey/monkey_island/cc/ui/src/components/report-components/ScannedServers.js
+++ b/monkey/monkey_island/cc/ui/src/components/report-components/ScannedServers.js
@@ -5,12 +5,17 @@ let renderArray = function(val) {
return ;
};
+let renderIpAddresses = function (val) {
+ return {renderArray(val.ip_addresses)} {(val.domain_name ? " (".concat(val.domain_name, ")") : "")}
;
+};
+
const columns = [
{
Header: 'Scanned Servers',
columns: [
{ Header: 'Machine', accessor: 'label'},
- { Header: 'IP Addresses', id: 'ip_addresses', accessor: x => renderArray(x.ip_addresses)},
+ { Header: 'IP Addresses', id: 'ip_addresses',
+ accessor: x => renderIpAddresses(x)},
{ Header: 'Accessible From', id: 'accessible_from_nodes', accessor: x => renderArray(x.accessible_from_nodes)},
{ Header: 'Services', id: 'services', accessor: x => renderArray(x.services)}
]
diff --git a/monkey/monkey_island/cc/ui/src/styles/App.css b/monkey/monkey_island/cc/ui/src/styles/App.css
index 7f487694c..1b857a1ec 100644
--- a/monkey/monkey_island/cc/ui/src/styles/App.css
+++ b/monkey/monkey_island/cc/ui/src/styles/App.css
@@ -138,12 +138,11 @@ body {
padding-left: 40px;
}
}
+
.main .page-header {
margin-top: 0;
}
-
-
.index img {
margin: 40px auto;
border-radius: 4px;
@@ -172,6 +171,9 @@ body {
display: none;
}
+.nav-tabs > li > a {
+ height: 63px
+}
/*
* Run Monkey Page
*/
@@ -491,4 +493,5 @@ body {
.label-danger {
background-color: #d9534f !important;
}
+
}
diff --git a/monkey/monkey_island/deb-package/monkey_island_pip_requirements.txt b/monkey/monkey_island/deb-package/monkey_island_pip_requirements.txt
index 446414ecf..3691ca490 100644
--- a/monkey/monkey_island/deb-package/monkey_island_pip_requirements.txt
+++ b/monkey/monkey_island/deb-package/monkey_island_pip_requirements.txt
@@ -14,4 +14,6 @@ netifaces
ipaddress
enum34
PyCrypto
+boto3
+awscli
virtualenv
\ No newline at end of file
diff --git a/monkey/monkey_island/linux/run.sh b/monkey/monkey_island/linux/run.sh
index 6770e2922..c72b5f3b9 100644
--- a/monkey/monkey_island/linux/run.sh
+++ b/monkey/monkey_island/linux/run.sh
@@ -2,4 +2,4 @@
cd /var/monkey
/var/monkey/monkey_island/bin/mongodb/bin/mongod --quiet --dbpath /var/monkey/monkey_island/db &
-/var/monkey/monkey_island/bin/python/bin/python monkey_island/cc/main.py
\ No newline at end of file
+/var/monkey/monkey_island/bin/python/bin/python monkey_island.py
\ No newline at end of file
diff --git a/monkey/monkey_island/readme.txt b/monkey/monkey_island/readme.txt
index 82deb43b6..64cefcd36 100644
--- a/monkey/monkey_island/readme.txt
+++ b/monkey/monkey_island/readme.txt
@@ -1,3 +1,6 @@
+To get development versions of Monkey Island and Monkey look into deployment scripts folder.
+If you only want to run the software from source you may refer to the instructions below.
+
How to set up the Monkey Island server:
---------------- On Windows ----------------:
@@ -9,10 +12,20 @@ How to set up the Monkey Island server:
2.3. Copy contents from installation path (Usually C:\Python27) to monkey_island\bin\Python27
2.4. Copy Python27.dll from System32 folder (Usually C:\Windows\System32 or C:\Python27) to monkey_island\bin\Python27
2.5. (Optional) You may uninstall Python27 if you like.
-3. Place portable version of mongodb
- 3.1. Download from: https://downloads.mongodb.org/win32/mongodb-win32-x86_64-2008plus-ssl-latest.zip
- 3.2. Extract contents from bin folder to monkey_island\bin\mongodb.
- 3.3. Create monkey_island\db folder.
+3. Setup mongodb (Use one of the following two options):
+ 3.1 Place portable version of mongodb
+ 3.1.1 Download from: https://downloads.mongodb.org/win32/mongodb-win32-x86_64-2008plus-ssl-latest.zip
+ 3.2.1 Extract contents from bin folder to monkey_island\bin\mongodb.
+ 3.3.1 Create monkey_island\db folder.
+
+ OR
+
+ 3.1 If you have an instance of mongodb running on a different host, set the MONKEY_MONGO_URL environment variable:
+
+ example for mongodb running on host with IP address 192.168.10.10:
+
+ set MONKEY_MONGO_URL="mongodb://192.168.10.10:27107/monkeyisland"
+
4. Place portable version of OpenSSL
4.1. Download from: https://indy.fulgan.com/SSL/Archive/openssl-1.0.2l-i386-win32.zip
4.2. Extract content from bin folder to monkey_island\bin\openssl
@@ -53,13 +66,24 @@ How to run:
monkey-windows-32.exe - monkey binary for windows 32bit
monkey-windows-64.exe - monkey binary for windows 64bi
-4. Download MongoDB and extract it to /var/monkey_island/bin/mongodb
- for debian64 - https://downloads.mongodb.org/linux/mongodb-linux-x86_64-debian81-latest.tgz
- for ubuntu64 16.10 - https://downloads.mongodb.org/linux/mongodb-linux-x86_64-ubuntu1604-latest.tgz
- find more at - https://www.mongodb.org/downloads#production
- untar.gz with: tar -zxvf filename.tar.gz -C /var/monkey_island/bin/mongodb
- (make sure the content of the mongo folder is in this directory, meaning this path exists:
- /var/monkey_island/bin/mongodb/bin)
+4. Setup MongoDB (Use one of the two following options):
+
+ 4.1 Download MongoDB and extract it to /var/monkey_island/bin/mongodb
+ for debian64 - https://downloads.mongodb.org/linux/mongodb-linux-x86_64-debian81-latest.tgz
+ for ubuntu64 16.10 - https://downloads.mongodb.org/linux/mongodb-linux-x86_64-ubuntu1604-latest.tgz
+ find more at - https://www.mongodb.org/downloads#production
+ untar.gz with: tar -zxvf filename.tar.gz -C /var/monkey_island/bin/mongodb
+ (make sure the content of the mongo folder is in this directory, meaning this path exists:
+ /var/monkey_island/bin/mongodb/bin)
+
+ OR
+
+ 4.1 If you have an instance of mongodb running on a different host, set the MONKEY_MONGO_URL environment variable:
+
+ example for mongodb running on host with IP address 192.168.10.10:
+
+ set MONKEY_MONGO_URL="mongodb://192.168.10.10:27107/monkeyisland"
+
5. install OpenSSL
sudo apt-get install openssl
diff --git a/monkey/monkey_island/requirements.txt b/monkey/monkey_island/requirements.txt
index 29c364c9f..858642d19 100644
--- a/monkey/monkey_island/requirements.txt
+++ b/monkey/monkey_island/requirements.txt
@@ -14,3 +14,5 @@ netifaces
ipaddress
enum34
PyCrypto
+boto3
+awscli
\ No newline at end of file