Merge branch 'attack_pass_the_hash' into attack_comand_line_interface

# Conflicts:
#	monkey/monkey_island/cc/services/attack/attack_report.py

monkey/monkey_island/cc/services/attack/technique_reports/T1075.py

@@ -16,7 +16,7 @@ class T1075(AttackTechnique):
                                                                     {'lm_hash': {'$ne': ''}}]}}}
 
     # Gets data about successful PTH logins
-    query = [{'$match': {'telem_type': 'exploit',
+    query = [{'$match': {'telem_category': 'exploit',
                          'data.attempts': {'$not': {'$size': 0},
                                            '$elemMatch': {'$and': [{'$or': [{'ntlm_hash': {'$ne': ''}},
                                                                             {'lm_hash': {'$ne': ''}}]},
@@ -35,9 +35,10 @@ class T1075(AttackTechnique):
         successful_logins = list(mongo.db.telemetry.aggregate(T1075.query))
         data.update({'successful_logins': successful_logins})
         if successful_logins:
-            data.update({'message': T1075.used_msg, 'status': ScanStatus.USED.name})
+            status = ScanStatus.USED
         elif mongo.db.telemetry.count_documents(T1075.login_attempt_query):
-            data.update({'message': T1075.scanned_msg, 'status': ScanStatus.SCANNED.name})
+            status = ScanStatus.SCANNED
         else:
-            data.update({'message': T1075.unscanned_msg, 'status': ScanStatus.UNSCANNED.name})
+            status = ScanStatus.UNSCANNED
+        data.update(T1075.get_message_and_status(status))
         return data

monkey/monkey_island/cc/services/attack/technique_reports/T1110.py

@@ -35,12 +35,12 @@ class T1110(AttackTechnique):
                 result['successful_creds'].append(T1110.parse_creds(attempt))
 
         if succeeded:
-            data = T1110.get_message_and_status(T1110, ScanStatus.USED)
+            status = ScanStatus.USED
         elif attempts:
-            data = T1110.get_message_and_status(T1110, ScanStatus.SCANNED)
+            status = ScanStatus.SCANNED
         else:
-            data = T1110.get_message_and_status(T1110, ScanStatus.UNSCANNED)
+            status = ScanStatus.UNSCANNED
-
+        data = T1110.get_message_and_status(status)
         # Remove data with no successful brute force attempts
         attempts = [attempt for attempt in attempts if attempt['attempts']]
 

monkey/monkey_island/cc/services/attack/technique_reports/T1197.py

@@ -12,7 +12,7 @@ class T1197(AttackTechnique):
 
     @staticmethod
     def get_report_data():
-        data = T1197.get_tech_base_data(T1197)
+        data = T1197.get_tech_base_data()
         bits_results = mongo.db.telemetry.aggregate([{'$match': {'telem_catagory': 'attack', 'data.technique': T1197.tech_id}},
                                                           {'$group': {'_id': {'ip_addr': '$data.machine.ip_addr', 'usage': '$data.usage'},
                                                                       'ip_addr': {'$first': '$data.machine.ip_addr'},

monkey/monkey_island/cc/services/attack/technique_reports/T1210.py

@@ -18,11 +18,12 @@ class T1210(AttackTechnique):
         scanned_services = T1210.get_scanned_services()
         exploited_services = T1210.get_exploited_services()
         if exploited_services:
-            data.update({'status': ScanStatus.USED.name, 'message': T1210.used_msg})
+            status = ScanStatus.USED
         elif scanned_services:
-            data.update({'status': ScanStatus.SCANNED.name, 'message': T1210.scanned_msg})
+            status = ScanStatus.SCANNED
         else:
-            data.update({'status': ScanStatus.UNSCANNED.name, 'message': T1210.unscanned_msg})
+            status = ScanStatus.UNSCANNED.name
+        data.update(T1210.get_message_and_status(status))
         data.update({'scanned_services': scanned_services, 'exploited_services': exploited_services})
         return data
 

monkey/monkey_island/cc/services/attack/technique_reports/__init__.py

@@ -46,52 +46,63 @@ class AttackTechnique(object):
         """
         pass
 
-    @staticmethod
+    @classmethod
-    def technique_status(technique):
+    def technique_status(cls):
         """
         Gets the status of a certain attack technique.
-        :param technique: technique's id.
         :return: ScanStatus Enum object
         """
-        if mongo.db.telemetry.find_one({'telem_catagory': 'attack', 'data.status': ScanStatus.USED.value, 'data.technique': technique}):
+        if mongo.db.attack_results.find_one({'telem_catagory': 'attack',
+                                             'status': ScanStatus.USED.value,
+                                             'technique': cls.tech_id}):
             return ScanStatus.USED
-        elif mongo.db.telemetry.find_one({'telem_catagory': 'attack', 'data.status': ScanStatus.SCANNED.value, 'data.technique': technique}):
+        elif mongo.db.attack_results.find_one({'telem_catagory': 'attack',
+                                               'status': ScanStatus.SCANNED.value,
+                                               'technique': cls.tech_id}):
             return ScanStatus.SCANNED
         else:
             return ScanStatus.UNSCANNED
 
-    @staticmethod
+    @classmethod
-    def get_message_and_status(technique, status):
+    def get_message_and_status(cls, status):
-        return {'message': technique.get_message_by_status(technique, status), 'status': status.name}
+        """
-
+        Returns a dict with attack technique's message and status.
-    @staticmethod
+        :param status: Enum type value from common/attack_utils.py
-    def get_message_by_status(technique, status):
+        :return: Dict with message and status
-        if status == ScanStatus.UNSCANNED:
+        """
-            return technique.unscanned_msg
+        return {'message': cls.get_message_by_status(status), 'status': status.name}
-        elif status == ScanStatus.SCANNED:
+
-            return technique.scanned_msg
+    @classmethod
-        else:
+    def get_message_by_status(cls, status):
-            return technique.used_msg
+        """
-
+        Picks a message to return based on status.
-    @staticmethod
+        :param status: Enum type value from common/attack_utils.py
-    def technique_title(technique):
+        :return: message string
+        """
+        if status == ScanStatus.UNSCANNED:
+            return cls.unscanned_msg
+        elif status == ScanStatus.SCANNED:
+            return cls.scanned_msg
+        else:
+            return cls.used_msg
+
+    @classmethod
+    def technique_title(cls):
         """
-        :param technique: Technique's id. E.g. T1110
         :return: techniques title. E.g. "T1110 Brute force"
         """
-        return AttackConfig.get_technique(technique)['title']
+        return AttackConfig.get_technique(cls.tech_id)['title']
 
-    @staticmethod
+    @classmethod
-    def get_tech_base_data(technique):
+    def get_tech_base_data(cls):
         """
         Gathers basic attack technique data into a dict.
-        :param technique: Technique's id. E.g. T1110
         :return: dict E.g. {'message': 'Brute force used', 'status': 'Used', 'title': 'T1110 Brute force'}
         """
         data = {}
-        status = AttackTechnique.technique_status(technique.tech_id)
+        status = cls.technique_status()
-        title = AttackTechnique.technique_title(technique.tech_id)
+        title = cls.technique_title()
         data.update({'status': status.name,
                      'title': title,
-                     'message': technique.get_message_by_status(technique, status)})
+                     'message': cls.get_message_by_status(status)})
         return data

monkey/monkey_island/cc/ui/src/components/attack/techniques/Helpers.js

@@ -1,6 +1,6 @@
 import React from "react";
 
-export function RenderMachine(val){
+export function renderMachine(val){
     return (
       <span>{val.ip_addr} {(val.domain_name ? " (".concat(val.domain_name, ")") : "")}</span>
     )

monkey/monkey_island/cc/ui/src/components/attack/techniques/T1075.js

@@ -1,26 +1,28 @@
 import React from 'react';
 import '../../../styles/Collapse.scss'
 import ReactTable from "react-table";
-import { RenderMachine } from "./Helpers"
+import { renderMachine } from "./Helpers"
 
 
 class T1075 extends React.Component {
 
   constructor(props) {
     super(props);
-    this.props.data.successful_logins.forEach((login) => {
+    this.props.data.successful_logins.forEach((login) => this.setLoginHashType(login))
+  }
+
+  setLoginHashType(login){
     if(login.attempts[0].ntlm_hash !== ""){
       login.attempts[0].hashType = 'NTLM';
     } else if(login.attempts[0].lm_hash !== ""){
       login.attempts[0].hashType = 'LM';
     }
-    })
   }
 
   static getHashColumns() {
     return ([{
       columns: [
-        {Header: 'Machine', id: 'machine', accessor: x => RenderMachine(x.machine), style: { 'whiteSpace': 'unset' }},
+        {Header: 'Machine', id: 'machine', accessor: x => renderMachine(x.machine), style: { 'whiteSpace': 'unset' }},
         {Header: 'Service', id: 'service', accessor: x => x.info.display_name, style: { 'whiteSpace': 'unset' }},
         {Header: 'Username', id: 'username', accessor: x => x.attempts[0].user, style: { 'whiteSpace': 'unset' }},
         {Header: 'Hash type', id: 'hash', accessor: x => x.attempts[0].hashType, style: { 'whiteSpace': 'unset' }},

monkey/monkey_island/cc/ui/src/components/attack/techniques/T1110.js

@@ -1,7 +1,7 @@
 import React from 'react';
 import '../../../styles/Collapse.scss'
 import ReactTable from "react-table";
-import { RenderMachine } from "./Helpers"
+import { renderMachine } from "./Helpers"
 
 
 class T1110 extends React.Component {
@@ -13,7 +13,7 @@ class T1110 extends React.Component {
   static getServiceColumns() {
     return ([{
       columns: [
-        {Header: 'Machine', id: 'machine', accessor: x => RenderMachine(x.machine),
+        {Header: 'Machine', id: 'machine', accessor: x => renderMachine(x.machine),
           style: { 'whiteSpace': 'unset' }, width: 160},
         {Header: 'Service', id: 'service', accessor: x => x.info.display_name, style: { 'whiteSpace': 'unset' }, width: 100},
         {Header: 'Started', id: 'started', accessor: x => x.info.started, style: { 'whiteSpace': 'unset' }},

monkey/monkey_island/cc/ui/src/components/attack/techniques/T1197.js

@@ -1,7 +1,7 @@
 import React from 'react';
 import '../../../styles/Collapse.scss'
 import ReactTable from "react-table";
-import { RenderMachine } from "./Helpers"
+import { renderMachine } from "./Helpers"
 
 
 class T1210 extends React.Component {
@@ -9,7 +9,7 @@ class T1210 extends React.Component {
   constructor(props) {
     super(props);
     this.columns = [ {Header: 'Machine',
-                      id: 'machine', accessor: x => RenderMachine(x),
+                      id: 'machine', accessor: x => renderMachine(x),
                       style: { 'whiteSpace': 'unset' },
                       width: 200},
                     {Header: 'Time',

monkey/monkey_island/cc/ui/src/components/attack/techniques/T1210.js

@@ -1,7 +1,7 @@
 import React from 'react';
 import '../../../styles/Collapse.scss'
 import ReactTable from "react-table";
-import { RenderMachine } from "./Helpers"
+import { renderMachine } from "./Helpers"
 
 
 class T1210 extends React.Component {
@@ -13,7 +13,7 @@ class T1210 extends React.Component {
   static getScanColumns() {
     return ([{
       columns: [
-        {Header: 'Machine', id: 'machine', accessor: x => RenderMachine(x.machine),
+        {Header: 'Machine', id: 'machine', accessor: x => renderMachine(x.machine),
           style: { 'whiteSpace': 'unset' }, width: 200},
         {Header: 'Time', id: 'time', accessor: x => x.time, style: { 'whiteSpace': 'unset' }, width: 170},
         {Header: 'Port', id: 'port', accessor: x =>x.service.port, style: { 'whiteSpace': 'unset' }},
@@ -24,7 +24,7 @@ class T1210 extends React.Component {
   static getExploitColumns() {
     return ([{
       columns: [
-        {Header: 'Machine', id: 'machine', accessor: x => RenderMachine(x.machine),
+        {Header: 'Machine', id: 'machine', accessor: x => renderMachine(x.machine),
           style: { 'whiteSpace': 'unset' }, width: 200},
         {Header: 'Time', id: 'time', accessor: x => x.time, style: { 'whiteSpace': 'unset' }, width: 170},
         {Header: 'Port/url', id: 'port', accessor: x =>this.renderEndpoint(x.service), style: { 'whiteSpace': 'unset' }},