p59342861
/
monkey
forked from p15670423/monkey
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Revert "Revert "Added post breach processing dict and extracted consts to common"" 

This reverts commit 36ad6fc441.
This commit is contained in:
Shay Nehmad 2019-09-02 10:08:52 +03:00
parent c60f393dbe
commit 30b74675a5
4 changed files with 17 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
monkey/common/data/post_breach_consts.py Normal file
View File

@ -0,0 +1,2 @@
POST_BREACH_BACKDOOR_USER = "Backdoor user"
POST_BREACH_FILE_EXECUTION = "File execution"

5
monkey/infection_monkey/post_breach/actions/add_user.py
View File

@ -1,8 +1,9 @@
import datetime import datetime
from common.data.post_breach_consts import POST_BREACH_BACKDOOR_USER
from infection_monkey.post_breach.pba import PBA from infection_monkey.post_breach.pba import PBA
from infection_monkey.config import WormConfiguration from infection_monkey.config import WormConfiguration
__author__ = 'danielg' __author__ = 'danielg'
LINUX_COMMANDS = ['useradd', '-M', '--expiredate', LINUX_COMMANDS = ['useradd', '-M', '--expiredate',
@ -16,6 +17,6 @@ WINDOWS_COMMANDS = ['net', 'user', WormConfiguration.user_to_add,
class BackdoorUser(PBA): class BackdoorUser(PBA):
def __init__(self): def __init__(self):
super(BackdoorUser, self).__init__("Backdoor user", super(BackdoorUser, self).__init__(POST_BREACH_BACKDOOR_USER,
linux_cmd=' '.join(LINUX_COMMANDS), linux_cmd=' '.join(LINUX_COMMANDS),
windows_cmd=WINDOWS_COMMANDS) windows_cmd=WINDOWS_COMMANDS)

3
monkey/infection_monkey/post_breach/actions/users_custom_pba.py
View File

@ -1,6 +1,7 @@
import os import os
import logging import logging
from common.data.post_breach_consts import POST_BREACH_FILE_EXECUTION
from infection_monkey.utils import is_windows_os from infection_monkey.utils import is_windows_os
from infection_monkey.post_breach.pba import PBA from infection_monkey.post_breach.pba import PBA
from infection_monkey.control import ControlClient from infection_monkey.control import ControlClient
@ -27,7 +28,7 @@ class UsersPBA(PBA):
Defines user's configured post breach action. Defines user's configured post breach action.
""" """
def __init__(self): def __init__(self):
super(UsersPBA, self).__init__("File execution") super(UsersPBA, self).__init__(POST_BREACH_FILE_EXECUTION)
self.filename = '' self.filename = ''
if not is_windows_os(): if not is_windows_os():
# Add linux commands to PBA's # Add linux commands to PBA's

10
monkey/monkey_island/cc/services/telemetry/processing/post_breach.py
View File

@ -1,7 +1,17 @@
from monkey_island.cc.database import mongo from monkey_island.cc.database import mongo
from common.data.post_breach_consts import *
POST_BREACH_TELEMETRY_PROCESSING_FUNCS = {
# `lambda *args, **kwargs: None` is a no-op.
POST_BREACH_BACKDOOR_USER: lambda *args, **kwargs: None,
POST_BREACH_FILE_EXECUTION: lambda *args, **kwargs: None,
}
def process_post_breach_telemetry(telemetry_json): def process_post_breach_telemetry(telemetry_json):
mongo.db.monkey.update( mongo.db.monkey.update(
{'guid': telemetry_json['monkey_guid']}, {'guid': telemetry_json['monkey_guid']},
{'$push': {'pba_results': telemetry_json['data']}}) {'$push': {'pba_results': telemetry_json['data']}})
if telemetry_json["name"] in POST_BREACH_TELEMETRY_PROCESSING_FUNCS:
POST_BREACH_TELEMETRY_PROCESSING_FUNCS[telemetry_json["name"]](telemetry_json)