forked from p15670423/monkey
56 lines
2.5 KiB
Python
56 lines
2.5 KiB
Python
import copy
|
|
|
|
import dateutil
|
|
|
|
from monkey_island.cc.encryptor import encryptor
|
|
from monkey_island.cc.models import Monkey
|
|
from monkey_island.cc.models.edge import Edge
|
|
from monkey_island.cc.services.edge.displayed_edge import EdgeService
|
|
from monkey_island.cc.services.node import NodeService
|
|
from monkey_island.cc.services.telemetry.processing.utils import get_edge_by_scan_or_exploit_telemetry
|
|
from monkey_island.cc.services.telemetry.zero_trust_tests.machine_exploited import test_machine_exploited
|
|
|
|
|
|
def process_exploit_telemetry(telemetry_json):
|
|
encrypt_exploit_creds(telemetry_json)
|
|
edge = get_edge_by_scan_or_exploit_telemetry(telemetry_json)
|
|
update_network_with_exploit(edge, telemetry_json)
|
|
update_node_credentials_from_successful_attempts(edge, telemetry_json)
|
|
|
|
test_machine_exploited(
|
|
current_monkey=Monkey.get_single_monkey_by_guid(telemetry_json['monkey_guid']),
|
|
exploit_successful=telemetry_json['data']['result'],
|
|
exploiter=telemetry_json['data']['exploiter'],
|
|
target_ip=telemetry_json['data']['machine']['ip_addr'],
|
|
timestamp=telemetry_json['timestamp'])
|
|
|
|
|
|
def update_node_credentials_from_successful_attempts(edge: EdgeService, telemetry_json):
|
|
for attempt in telemetry_json['data']['attempts']:
|
|
if attempt['result']:
|
|
found_creds = {'user': attempt['user']}
|
|
for field in ['password', 'lm_hash', 'ntlm_hash', 'ssh_key']:
|
|
if len(attempt[field]) != 0:
|
|
found_creds[field] = attempt[field]
|
|
NodeService.add_credentials_to_node(edge.dst_node_id, found_creds)
|
|
|
|
|
|
def update_network_with_exploit(edge: EdgeService, telemetry_json):
|
|
telemetry_json['data']['info']['started'] = dateutil.parser.parse(telemetry_json['data']['info']['started'])
|
|
telemetry_json['data']['info']['finished'] = dateutil.parser.parse(telemetry_json['data']['info']['finished'])
|
|
new_exploit = copy.deepcopy(telemetry_json['data'])
|
|
new_exploit.pop('machine')
|
|
new_exploit['timestamp'] = telemetry_json['timestamp']
|
|
edge.update_based_on_exploit(new_exploit)
|
|
if new_exploit['result']:
|
|
NodeService.set_node_exploited(edge.dst_node_id)
|
|
|
|
|
|
def encrypt_exploit_creds(telemetry_json):
|
|
attempts = telemetry_json['data']['attempts']
|
|
for i in range(len(attempts)):
|
|
for field in ['password', 'lm_hash', 'ntlm_hash']:
|
|
credential = attempts[i][field]
|
|
if len(credential) > 0:
|
|
attempts[i][field] = encryptor.enc(credential)
|