From 01a2a448de2ed1dd1e3b514daab0d616544531cc Mon Sep 17 00:00:00 2001 From: VakarisZ Date: Tue, 17 Sep 2019 14:51:42 +0300 Subject: [PATCH] delays singleton attack telem and sends it when monkey can communicate with server --- monkey/infection_monkey/monkey.py | 6 +++++- monkey/infection_monkey/system_singleton.py | 14 ++------------ 2 files changed, 7 insertions(+), 13 deletions(-) diff --git a/monkey/infection_monkey/monkey.py b/monkey/infection_monkey/monkey.py index cd8df4705..70379ce85 100644 --- a/monkey/infection_monkey/monkey.py +++ b/monkey/infection_monkey/monkey.py @@ -24,9 +24,10 @@ from infection_monkey.telemetry.trace_telem import TraceTelem from infection_monkey.telemetry.tunnel_telem import TunnelTelem from infection_monkey.windows_upgrader import WindowsUpgrader from infection_monkey.post_breach.post_breach_handler import PostBreach -from common.utils.attack_utils import ScanStatus from infection_monkey.exploit.tools.helpers import get_interface_to_target from infection_monkey.exploit.tools.exceptions import ExploitingVulnerableMachineError +from infection_monkey.telemetry.attack.t1106_telem import T1106Telem +from common.utils.attack_utils import ScanStatus, UsageEnum __author__ = 'itamar' @@ -103,6 +104,9 @@ class InfectionMonkey(object): ControlClient.wakeup(parent=self._parent) ControlClient.load_control_config() + if utils.is_windows_os(): + T1106Telem(ScanStatus.USED, UsageEnum.SINGLETON_WINAPI).send() + if not WormConfiguration.alive: LOG.info("Marked not alive from configuration") return diff --git a/monkey/infection_monkey/system_singleton.py b/monkey/infection_monkey/system_singleton.py index 50fa6363b..6a4a0912b 100644 --- a/monkey/infection_monkey/system_singleton.py +++ b/monkey/infection_monkey/system_singleton.py @@ -4,8 +4,7 @@ import sys from abc import ABCMeta, abstractmethod from infection_monkey.config import WormConfiguration -from infection_monkey.telemetry.attack.t1106_telem import T1106Telem -from common.utils.attack_utils import ScanStatus, UsageEnum + __author__ = 'itamar' @@ -46,21 +45,13 @@ class WindowsSystemSingleton(_SystemSingleton): ctypes.c_char_p(self._mutex_name)) last_error = ctypes.windll.kernel32.GetLastError() - status = None if not handle: LOG.error("Cannot acquire system singleton %r, unknown error %d", self._mutex_name, last_error) - status = ScanStatus.SCANNED - + return False if winerror.ERROR_ALREADY_EXISTS == last_error: - status = ScanStatus.SCANNED LOG.debug("Cannot acquire system singleton %r, mutex already exist", self._mutex_name) - - if not status: - status = ScanStatus.USED - T1106Telem(status, UsageEnum.SINGLETON_WINAPI).send() - if status == ScanStatus.SCANNED: return False self._mutex_handle = handle @@ -71,7 +62,6 @@ class WindowsSystemSingleton(_SystemSingleton): def unlock(self): assert self._mutex_handle is not None, "Singleton not locked" - ctypes.windll.kernel32.CloseHandle(self._mutex_handle) self._mutex_handle = None