forked from p15670423/monkey
Agent: Modify PBAs to yield PostBreachData instead of returning it
This is done mainly because of the hide files PBA which needs to send telemetry two times. It also makes more sense to do it this way so that it's easier to send telemetry multiple times in any PBA.
This commit is contained in:
parent
28ff112872
commit
ec2b2beca5
|
@ -16,7 +16,7 @@ class ClearCommandHistory(PBA):
|
|||
results = [pba.run() for pba in self.clear_command_history_PBA_list()]
|
||||
if results:
|
||||
# Note: `self.command` is empty here
|
||||
return PostBreachData(self.name, self.command, results)
|
||||
yield PostBreachData(self.name, self.command, results)
|
||||
|
||||
def clear_command_history_PBA_list(self):
|
||||
return self.CommandHistoryPBAGenerator().get_clear_command_history_pbas()
|
||||
|
|
|
@ -53,4 +53,4 @@ class ProcessListCollection(PBA):
|
|||
continue
|
||||
|
||||
# No command here; used psutil
|
||||
return PostBreachData(self.name, "", (processes, success_state))
|
||||
yield PostBreachData(self.name, "", (processes, success_state))
|
||||
|
|
|
@ -54,11 +54,11 @@ class CommunicateAsBackdoorUser(PBA):
|
|||
)
|
||||
# `command` is empty here; we could get the command from `new_user` but that
|
||||
# doesn't work either since Windows doesn't use a command, it uses win32 modules
|
||||
return PostBreachData(self.name, "", result)
|
||||
yield PostBreachData(self.name, "", result)
|
||||
except subprocess.CalledProcessError as e:
|
||||
return PostBreachData(self.name, "", (e.output.decode(), False))
|
||||
yield PostBreachData(self.name, "", (e.output.decode(), False))
|
||||
except NewUserError as e:
|
||||
return PostBreachData(self.name, "", (str(e), False))
|
||||
yield PostBreachData(self.name, "", (str(e), False))
|
||||
|
||||
@staticmethod
|
||||
def get_random_new_user_name():
|
||||
|
|
|
@ -29,7 +29,7 @@ class ModifyShellStartupFiles(PBA):
|
|||
]
|
||||
# `command` is empty here since multiple commands were run and the results
|
||||
# were aggregated to send the telemetry just once
|
||||
return PostBreachData(self.name, "", results).send()
|
||||
yield PostBreachData(self.name, "", results).send()
|
||||
|
||||
def modify_shell_startup_PBA_list(self):
|
||||
return self.ShellStartupPBAGenerator().get_modify_shell_startup_pbas()
|
||||
|
|
|
@ -35,7 +35,7 @@ class PBA:
|
|||
T1064Telem(
|
||||
ScanStatus.USED, f"Scripts were used to execute {self.name} post breach action."
|
||||
).send()
|
||||
return PostBreachData(self.name, self.command, result)
|
||||
yield PostBreachData(self.name, self.command, result)
|
||||
else:
|
||||
logger.debug(f"No command available for PBA '{self.name}' on current OS, skipping.")
|
||||
|
||||
|
|
|
@ -53,9 +53,9 @@ class MockPuppet(IPuppet):
|
|||
logger.debug(f"run_pba({name}, {options})")
|
||||
|
||||
if name == "AccountDiscovery":
|
||||
return PostBreachData(name, "pba command 1", ["pba result 1", True])
|
||||
yield PostBreachData(name, "pba command 1", ["pba result 1", True])
|
||||
else:
|
||||
return PostBreachData(name, "pba command 2", ["pba result 2", False])
|
||||
yield PostBreachData(name, "pba command 2", ["pba result 2", False])
|
||||
|
||||
def ping(self, host: str, timeout: float = 1) -> PingScanData:
|
||||
logger.debug(f"run_ping({host}, {timeout})")
|
||||
|
|
Loading…
Reference in New Issue