Island: remove system_info processing file

No system info telemetries need to be processed anymore
This commit is contained in:
vakarisz 2022-02-17 17:28:05 +02:00
parent 5471e9854c
commit 73434537fe
2 changed files with 3 additions and 98 deletions

View File

@ -2,22 +2,22 @@ import logging
from common.common_consts.telem_categories import TelemCategoryEnum from common.common_consts.telem_categories import TelemCategoryEnum
from monkey_island.cc.services.telemetry.processing.aws_info import process_aws_telemetry from monkey_island.cc.services.telemetry.processing.aws_info import process_aws_telemetry
from monkey_island.cc.services.telemetry.processing.credentials.credentials_parser import\
parse_credentials
from monkey_island.cc.services.telemetry.processing.exploit import process_exploit_telemetry from monkey_island.cc.services.telemetry.processing.exploit import process_exploit_telemetry
from monkey_island.cc.services.telemetry.processing.post_breach import process_post_breach_telemetry from monkey_island.cc.services.telemetry.processing.post_breach import process_post_breach_telemetry
from monkey_island.cc.services.telemetry.processing.scan import process_scan_telemetry from monkey_island.cc.services.telemetry.processing.scan import process_scan_telemetry
from monkey_island.cc.services.telemetry.processing.state import process_state_telemetry from monkey_island.cc.services.telemetry.processing.state import process_state_telemetry
from monkey_island.cc.services.telemetry.processing.system_info import process_system_info_telemetry
from monkey_island.cc.services.telemetry.processing.tunnel import process_tunnel_telemetry from monkey_island.cc.services.telemetry.processing.tunnel import process_tunnel_telemetry
logger = logging.getLogger(__name__) logger = logging.getLogger(__name__)
TELEMETRY_CATEGORY_TO_PROCESSING_FUNC = { TELEMETRY_CATEGORY_TO_PROCESSING_FUNC = {
TelemCategoryEnum.CREDENTIALS: process_credentials_telemetry, TelemCategoryEnum.CREDENTIALS: parse_credentials,
TelemCategoryEnum.TUNNEL: process_tunnel_telemetry, TelemCategoryEnum.TUNNEL: process_tunnel_telemetry,
TelemCategoryEnum.STATE: process_state_telemetry, TelemCategoryEnum.STATE: process_state_telemetry,
TelemCategoryEnum.EXPLOIT: process_exploit_telemetry, TelemCategoryEnum.EXPLOIT: process_exploit_telemetry,
TelemCategoryEnum.SCAN: process_scan_telemetry, TelemCategoryEnum.SCAN: process_scan_telemetry,
TelemCategoryEnum.SYSTEM_INFO: process_system_info_telemetry,
TelemCategoryEnum.POST_BREACH: process_post_breach_telemetry, TelemCategoryEnum.POST_BREACH: process_post_breach_telemetry,
TelemCategoryEnum.AWS_INFO: process_aws_telemetry, TelemCategoryEnum.AWS_INFO: process_aws_telemetry,
# `lambda *args, **kwargs: None` is a no-op. # `lambda *args, **kwargs: None` is a no-op.

View File

@ -1,95 +0,0 @@
import logging
from monkey_island.cc.server_utils.encryption import get_datastore_encryptor
from monkey_island.cc.services.config import ConfigService
from monkey_island.cc.services.telemetry.processing.system_info_collectors.system_info_telemetry_dispatcher import ( # noqa: E501
SystemInfoTelemetryDispatcher,
)
logger = logging.getLogger(__name__)
def process_system_info_telemetry(telemetry_json):
dispatcher = SystemInfoTelemetryDispatcher()
telemetry_processing_stages = [
process_ssh_info,
process_credential_info,
dispatcher.dispatch_collector_results_to_relevant_processors,
]
# Calling safe_process_telemetry so if one of the stages fail, we log and move on instead of
# failing the rest of
# them, as they are independent.
for stage in telemetry_processing_stages:
safe_process_telemetry(stage, telemetry_json)
def safe_process_telemetry(processing_function, telemetry_json):
# noinspection PyBroadException
try:
processing_function(telemetry_json)
except Exception as err:
logger.error(
"Error {} while in {} stage of processing telemetry.".format(
str(err), processing_function.__name__
),
exc_info=True,
)
def process_ssh_info(telemetry_json):
if "ssh_info" in telemetry_json["data"]:
ssh_info = telemetry_json["data"]["ssh_info"]
encrypt_system_info_ssh_keys(ssh_info)
if telemetry_json["data"]["network_info"]["networks"]:
# We use user_name@machine_ip as the name of the ssh key stolen, thats why we need ip
# from telemetry
add_ip_to_ssh_keys(telemetry_json["data"]["network_info"]["networks"][0], ssh_info)
add_system_info_ssh_keys_to_config(ssh_info)
def add_system_info_ssh_keys_to_config(ssh_info):
for user in ssh_info:
ConfigService.creds_add_username(user["name"])
# Public key is useless without private key
if user["public_key"] and user["private_key"]:
ConfigService.ssh_add_keys(
user["public_key"], user["private_key"], user["name"], user["ip"]
)
def add_ip_to_ssh_keys(ip, ssh_info):
for key in ssh_info:
key["ip"] = ip["addr"]
def encrypt_system_info_ssh_keys(ssh_info):
for idx, user in enumerate(ssh_info):
for field in ["public_key", "private_key", "known_hosts"]:
if ssh_info[idx][field]:
ssh_info[idx][field] = get_datastore_encryptor().encrypt(ssh_info[idx][field])
def process_credential_info(telemetry_json):
if "credentials" in telemetry_json["data"]:
creds = telemetry_json["data"]["credentials"]
add_system_info_creds_to_config(creds)
replace_user_dot_with_comma(creds)
def replace_user_dot_with_comma(creds):
for user in creds:
if -1 != user.find("."):
new_user = user.replace(".", ",")
creds[new_user] = creds.pop(user)
def add_system_info_creds_to_config(creds):
for user in creds:
ConfigService.creds_add_username(creds[user]["username"])
if "password" in creds[user] and creds[user]["password"]:
ConfigService.creds_add_password(creds[user]["password"])
if "lm_hash" in creds[user] and creds[user]["lm_hash"]:
ConfigService.creds_add_lm_hash(creds[user]["lm_hash"])
if "ntlm_hash" in creds[user] and creds[user]["ntlm_hash"]:
ConfigService.creds_add_ntlm_hash(creds[user]["ntlm_hash"])