p59342861
/
monkey
forked from p15670423/monkey
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

System info technique implemented

This commit is contained in:
VakarisZ 2019-06-13 17:19:04 +03:00
parent 9c52ad3617
commit c28420944e
6 changed files with 100 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
monkey/monkey_island/cc/services/attack/attack_report.py
View File

@ -1,5 +1,5 @@
import logging
from monkey_island.cc.services.attack.technique_reports import T1210, T1197, T1110, T1075, T1003, T1059, T1086
from monkey_island.cc.services.attack.technique_reports import T1210, T1197, T1110, T1075, T1003, T1059, T1086, T1082
from monkey_island.cc.services.attack.attack_telem import AttackTelemService
from monkey_island.cc.services.attack.attack_config import AttackConfig
from monkey_island.cc.database import mongo
@ -15,7 +15,8 @@ TECHNIQUES = {'T1210': T1210.T1210,
'T1075': T1075.T1075,
'T1003': T1003.T1003,
'T1059': T1059.T1059,
'T1086': T1086.T1086}
'T1086': T1086.T1086,
'T1082': T1082.T1082}
REPORT_NAME = 'new_report'

15
monkey/monkey_island/cc/services/attack/attack_schema.py
View File

@ -106,5 +106,20 @@ SCHEMA = {
}
}
},
"discovery": {
"title": "Discovery",
"type": "object",
"properties": {
"T1082": {
"title": "T1082 System information discovery",
"type": "bool",
"value": True,
"necessary": False,
"description": "An adversary may attempt to get detailed information about the "
"operating system and hardware, including version, patches, hotfixes, "
"service packs, and architecture."
}
}
},
}
}

37
monkey/monkey_island/cc/services/attack/technique_reports/T1082.py
View File

@ -12,26 +12,35 @@ class T1082(AttackTechnique):
scanned_msg = ""
used_msg = "Monkey gathered system info from machines in the network."
# Gets data about successful PTH logins
query = [{'$match': {'telem_type': 'system_info_collection'},
query = [{'$match': {'telem_type': 'system_info_collection'}},
{'$project': {'machine': {'hostname': '$data.hostname', 'ips': '$data.network_info.networks'},
'aws': '$data.aws',
'netstat': '$data.network_info.netstat',
'process_list': '$data.process_list',
'ssh_info': '$data.ssh_info',
'azure_info': '$data.Azure'}},
{'$project': {'_id': 0,
'machine': {'hostname': '$data.hostname', 'ips': '$data.network_info.networks'},
'info': {'aws': '$data.aws',
'process_list': '$data.process_list.1'
'attempt_cnt': {'$size': '$data.attempts'},
'attempts': {'$filter': {'input': '$data.attempts',
'as': 'attempt',
'cond': {'$eq': ['$$attempt.result', True]}}}}}]
'machine': 1,
'collections': [
{'used': {'$and': [{'$ifNull': ['$netstat', False]}, {'$gt': ['$aws', {}]}]},
'name': {'$literal': 'Amazon Web Services info'}},
{'used': {'$and': [{'$ifNull': ['$process_list', False]}, {'$gt': ['$process_list', {}]}]},
'name': {'$literal': 'Running process list'}},
{'used': {'$and': [{'$ifNull': ['$netstat', False]}, {'$ne': ['$netstat', []]}]},
'name': {'$literal': 'Network connections'}},
{'used': {'$and': [{'$ifNull': ['$ssh_info', False]}, {'$ne': ['$ssh_info', []]}]},
'name': {'$literal': 'SSH info'}},
{'used': {'$and': [{'$ifNull': ['$azure_info', False]}, {'$ne': ['$azure_info', []]}]},
'name': {'$literal': 'Azure info'}}
]}}]
@staticmethod
def get_report_data():
data = {'title': T1082.technique_title(T1082.tech_id)}
successful_logins = list(mongo.db.telemetry.aggregate(T1082.query))
data.update({'successful_logins': successful_logins})
if successful_logins:
system_info = list(mongo.db.telemetry.aggregate(T1082.query))
data.update({'system_info': system_info})
if system_info:
data.update({'message': T1082.used_msg, 'status': ScanStatus.USED.name})
elif mongo.db.telemetry.count_documents(T1082.login_attempt_query):
data.update({'message': T1082.scanned_msg, 'status': ScanStatus.SCANNED.name})
else:
data.update({'message': T1082.unscanned_msg, 'status': ScanStatus.UNSCANNED.name})
return data

1
monkey/monkey_island/cc/services/config_schema.py
View File

@ -422,6 +422,7 @@ SCHEMA = {
"title": "Collect system info",
"type": "boolean",
"default": True,
"attack_techniques": ["T1082"],
"description": "Determines whether to collect system info"
},
"should_use_mimikatz": {

55
monkey/monkey_island/cc/ui/src/components/attack/techniques/T1082.js Normal file
View File

@ -0,0 +1,55 @@
import React from 'react';
import '../../../styles/Collapse.scss'
import ReactTable from "react-table";
class T1082 extends React.Component {
constructor(props) {
super(props);
}
static renderMachineString(data){
let machineStr = data['hostname'] + " ( ";
data['ips'].forEach(function(ipInfo){
machineStr += ipInfo['addr'] + " ";
});
return machineStr + ")"
}
static renderCollections(collections){
let output = [];
collections.forEach(function(collection){
if(collection['used']){
output.push(<div key={collection['name']}>{collection['name']}</div>)
}
});
return (<div>{output}</div>);
}
static getSystemInfoColumns() {
return ([{
columns: [
{Header: 'Machine', id: 'machine', accessor: x => T1082.renderMachineString(x.machine), style: { 'whiteSpace': 'unset' }},
{Header: 'Gathered info', id: 'info', accessor: x => T1082.renderCollections(x.collections), style: { 'whiteSpace': 'unset' }},
]
}])};
render() {
return (
<div>
<div>{this.props.data.message}</div>
<br/>
{this.props.data.status === 'USED' ?
<ReactTable
columns={T1082.getSystemInfoColumns()}
data={this.props.data.system_info}
showPagination={false}
defaultPageSize={this.props.data.system_info.length}
/> : ""}
</div>
);
}
}
export default T1082;

4
monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js
View File

@ -12,6 +12,7 @@ import T1075 from "../attack/techniques/T1075";
import T1003 from "../attack/techniques/T1003";
import T1059 from "../attack/techniques/T1059";
import T1086 from "../attack/techniques/T1086";
import T1082 from "../attack/techniques/T1082";
const tech_components = {
'T1210': T1210,
@ -20,7 +21,8 @@ const tech_components = {
'T1075': T1075,
'T1003': T1003,
'T1059': T1059,
'T1086': T1086
'T1086': T1086,
'T1082': T1082
};
const classNames = require('classnames');