Merge pull request #365 from VakarisZ/attack_uncommon_port

T1065 Uncommonly used port

monkey/monkey_island/cc/services/attack/attack_report.py

@@ -1,7 +1,6 @@
 import logging
-
 from monkey_island.cc.models import Monkey
-from monkey_island.cc.services.attack.technique_reports import T1210, T1197, T1110, T1075, T1003, T1059, T1086, T1082, T1145
+from monkey_island.cc.services.attack.technique_reports import T1210, T1197, T1110, T1075, T1003, T1059, T1086, T1082, T1065
 from monkey_island.cc.services.attack.attack_config import AttackConfig
 from monkey_island.cc.database import mongo
 
@@ -18,7 +17,8 @@ TECHNIQUES = {'T1210': T1210.T1210,
               'T1059': T1059.T1059,
               'T1086': T1086.T1086,
               'T1082': T1082.T1082,
-              'T1145': T1145.T1145}
+              'T1145': T1145.T1145,
+              'T1065': T1065.T1065}
 
 REPORT_NAME = 'new_report'
 

monkey/monkey_island/cc/services/attack/attack_schema.py

@@ -131,5 +131,19 @@ SCHEMA = {
                 }
             }
         },
+        "command_and_control": {
+            "title": "Command and Control",
+            "type": "object",
+            "properties": {
+                "T1065": {
+                    "title": "T1065 Uncommonly used port",
+                    "type": "bool",
+                    "value": True,
+                    "necessary": True,
+                    "description": "Adversaries may conduct C2 communications over a non-standard "
+                                   "port to bypass proxies and firewalls that have been improperly configured."
+                }
+            }
+        },
     }
 }

monkey/monkey_island/cc/services/attack/technique_reports/T1065.py

@@ -0,0 +1,20 @@
+from monkey_island.cc.services.attack.technique_reports import AttackTechnique
+from common.utils.attack_utils import ScanStatus
+from monkey_island.cc.services.config import ConfigService
+
+__author__ = "VakarisZ"
+
+
+class T1065(AttackTechnique):
+
+    tech_id = "T1065"
+    unscanned_msg = ""
+    scanned_msg = ""
+    used_msg = ""
+    message = "Monkey used port %s to communicate to C2 server."
+
+    @staticmethod
+    def get_report_data():
+        port = ConfigService.get_config_value(['cnc', 'servers', 'current_server']).split(':')[1]
+        T1065.used_msg = T1065.message % port
+        return T1065.get_base_data_by_status(ScanStatus.USED)

monkey/monkey_island/cc/ui/src/components/attack/techniques/T1065.js

@@ -0,0 +1,16 @@
+import React from 'react';
+import '../../../styles/Collapse.scss'
+
+
+class T1065 extends React.Component {
+
+  render() {
+    return (
+      <div>
+        <div>{this.props.data.message}</div>
+      </div>
+    );
+  }
+}
+
+export default T1065;

monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js

@@ -14,6 +14,7 @@ import T1059 from "../attack/techniques/T1059";
 import T1086 from "../attack/techniques/T1086";
 import T1082 from "../attack/techniques/T1082";
 import T1145 from "../attack/techniques/T1145";
+import T1065 from "../attack/techniques/T1065";
 
 const tech_components = {
   'T1210': T1210,
@@ -24,7 +25,8 @@ const tech_components = {
   'T1059': T1059,
   'T1086': T1086,
   'T1082': T1082,
-  'T1145': T1145
+  'T1145': T1145,
+  'T1065': T1065
 };
 
 const classNames = require('classnames');