Moved user add+delete commands into `utils/users`

This commit is contained in:
Shay Nehmad 2019-09-16 13:53:33 +03:00
parent edc2d49307
commit 889c8a2378
7 changed files with 62 additions and 58 deletions

View File

@ -1,61 +1,16 @@
import datetime
from common.data.post_breach_consts import POST_BREACH_BACKDOOR_USER from common.data.post_breach_consts import POST_BREACH_BACKDOOR_USER
from infection_monkey.post_breach.pba import PBA from infection_monkey.post_breach.pba import PBA
from infection_monkey.config import WormConfiguration from infection_monkey.config import WormConfiguration
from infection_monkey.utils.users import get_commands_to_add_user
class BackdoorUser(PBA): class BackdoorUser(PBA):
def __init__(self): def __init__(self):
linux_cmds, windows_cmds = BackdoorUser.get_commands_to_add_user( linux_cmds, windows_cmds = get_commands_to_add_user(
WormConfiguration.user_to_add, WormConfiguration.remote_user_pass) WormConfiguration.user_to_add,
WormConfiguration.remote_user_pass)
super(BackdoorUser, self).__init__( super(BackdoorUser, self).__init__(
POST_BREACH_BACKDOOR_USER, POST_BREACH_BACKDOOR_USER,
linux_cmd=' '.join(linux_cmds), linux_cmd=' '.join(linux_cmds),
windows_cmd=windows_cmds) windows_cmd=windows_cmds)
@staticmethod
def get_commands_to_add_user(username, password):
linux_cmds = BackdoorUser.get_linux_commands_to_add_user(username)
windows_cmds = BackdoorUser.get_windows_commands_to_add_user(username, password)
return linux_cmds, windows_cmds
@staticmethod
def get_linux_commands_to_add_user(username):
return [
'useradd',
'-M', # Do not create homedir
'--expiredate',
datetime.datetime.today().strftime('%Y-%m-%d'),
'--inactive',
'0',
'-c', # Comment
'MONKEY_USER', # Comment
username]
@staticmethod
def get_linux_commands_to_delete_user(username):
return [
'deluser',
username
]
@staticmethod
def get_windows_commands_to_add_user(username, password, should_be_active=False):
windows_cmds = [
'net',
'user',
username,
password,
'/add']
if not should_be_active:
windows_cmds.append('/ACTIVE:NO')
return windows_cmds
@staticmethod
def get_windows_commands_to_delete_user(username):
return [
'net',
'user',
username,
'/delete']

View File

@ -5,12 +5,12 @@ import string
import subprocess import subprocess
import time import time
from infection_monkey.utils.windows.auto_new_user import AutoNewUser, NewUserError
from common.data.post_breach_consts import POST_BREACH_COMMUNICATE_AS_NEW_USER from common.data.post_breach_consts import POST_BREACH_COMMUNICATE_AS_NEW_USER
from infection_monkey.utils.windows.new_user import NewUser, NewUserError
from infection_monkey.post_breach.actions.add_user import BackdoorUser
from infection_monkey.post_breach.pba import PBA from infection_monkey.post_breach.pba import PBA
from infection_monkey.telemetry.post_breach_telem import PostBreachTelem from infection_monkey.telemetry.post_breach_telem import PostBreachTelem
from infection_monkey.utils.environment import is_windows_os from infection_monkey.utils.environment import is_windows_os
from infection_monkey.utils.linux.users import get_linux_commands_to_delete_user, get_linux_commands_to_add_user
PING_TEST_DOMAIN = "google.com" PING_TEST_DOMAIN = "google.com"
@ -44,7 +44,7 @@ class CommunicateAsNewUser(PBA):
def communicate_as_new_user_linux(self, username): def communicate_as_new_user_linux(self, username):
try: try:
# add user + ping # add user + ping
linux_cmds = BackdoorUser.get_linux_commands_to_add_user(username) linux_cmds = get_linux_commands_to_add_user(username)
commandline = "ping -c 1 {}".format(PING_TEST_DOMAIN) commandline = "ping -c 1 {}".format(PING_TEST_DOMAIN)
linux_cmds.extend([";", "sudo", "-u", username, commandline]) linux_cmds.extend([";", "sudo", "-u", username, commandline])
final_command = ' '.join(linux_cmds) final_command = ' '.join(linux_cmds)
@ -52,7 +52,7 @@ class CommunicateAsNewUser(PBA):
self.send_ping_result_telemetry(exit_status, commandline, username) self.send_ping_result_telemetry(exit_status, commandline, username)
# delete the user, async in case it gets stuck. # delete the user, async in case it gets stuck.
_ = subprocess.Popen( _ = subprocess.Popen(
BackdoorUser.get_linux_commands_to_delete_user(username), stderr=subprocess.STDOUT, shell=True) get_linux_commands_to_delete_user(username), stderr=subprocess.STDOUT, shell=True)
# Leaking the process on purpose - nothing we can do if it's stuck. # Leaking the process on purpose - nothing we can do if it's stuck.
except subprocess.CalledProcessError as e: except subprocess.CalledProcessError as e:
PostBreachTelem(self, (e.output, False)).send() PostBreachTelem(self, (e.output, False)).send()
@ -64,7 +64,7 @@ class CommunicateAsNewUser(PBA):
import win32api import win32api
try: try:
with NewUser(username, PASSWORD) as new_user: with AutoNewUser(username, PASSWORD) as new_user:
# Using os.path is OK, as this is on windows for sure # Using os.path is OK, as this is on windows for sure
ping_app_path = os.path.join(os.environ["WINDIR"], "system32", "PING.exe") ping_app_path = os.path.join(os.environ["WINDIR"], "system32", "PING.exe")
if not os.path.exists(ping_app_path): if not os.path.exists(ping_app_path):

View File

@ -0,0 +1,21 @@
import datetime
def get_linux_commands_to_add_user(username):
return [
'useradd',
'-M', # Do not create homedir
'--expiredate',
datetime.datetime.today().strftime('%Y-%m-%d'),
'--inactive',
'0',
'-c', # Comment
'MONKEY_USER', # Comment
username]
def get_linux_commands_to_delete_user(username):
return [
'deluser',
username
]

View File

@ -0,0 +1,10 @@
from infection_monkey.utils.linux.users import get_linux_commands_to_add_user
from infection_monkey.utils.windows.users import get_windows_commands_to_add_user
def get_commands_to_add_user(username, password):
linux_cmds = get_linux_commands_to_add_user(username)
windows_cmds = get_windows_commands_to_add_user(username, password)
return linux_cmds, windows_cmds

View File

@ -2,7 +2,7 @@ import logging
import subprocess import subprocess
from infection_monkey.post_breach.actions.add_user import BackdoorUser from infection_monkey.post_breach.actions.add_user import BackdoorUser
from infection_monkey.utils.windows.users import get_windows_commands_to_delete_user
logger = logging.getLogger(__name__) logger = logging.getLogger(__name__)
@ -11,7 +11,7 @@ class NewUserError(Exception):
pass pass
class NewUser(object): class AutoNewUser(object):
""" """
RAII object to use for creating and using a new user in Windows. Use with `with`. RAII object to use for creating and using a new user in Windows. Use with `with`.
User will be created when the instance is instantiated. User will be created when the instance is instantiated.
@ -20,7 +20,7 @@ class NewUser(object):
Example: Example:
# Created # Logged on # Created # Logged on
with NewUser("user", "pass") as new_user: with AutoNewUser("user", "pass") as new_user:
... ...
... ...
# Logged off and deleted # Logged off and deleted
@ -64,6 +64,6 @@ class NewUser(object):
# Try to delete user # Try to delete user
try: try:
_ = subprocess.Popen( _ = subprocess.Popen(
BackdoorUser.get_windows_commands_to_delete_user(self.username), stderr=subprocess.STDOUT, shell=True) get_windows_commands_to_delete_user(self.username), stderr=subprocess.STDOUT, shell=True)
except Exception as err: except Exception as err:
raise NewUserError("Can't delete user {}. Info: {}".format(self.username, err)) raise NewUserError("Can't delete user {}. Info: {}".format(self.username, err))

View File

@ -0,0 +1,18 @@
def get_windows_commands_to_add_user(username, password, should_be_active=False):
windows_cmds = [
'net',
'user',
username,
password,
'/add']
if not should_be_active:
windows_cmds.append('/ACTIVE:NO')
return windows_cmds
def get_windows_commands_to_delete_user(username):
return [
'net',
'user',
username,
'/delete']