p59342861
/
monkey
forked from p15670423/monkey
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge pull request #384 from VakarisZ/attack_sys_network_config 

T1016 System network configuration discovery
This commit is contained in:
Itay Mizeretz 2019-08-21 17:41:46 +03:00 committed by GitHub
parent 145488edd4 f014d3b035
commit fc23faed3e
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
8 changed files with 108 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
monkey/monkey_island/cc/services/attack/attack_report.py
View File

@ -3,7 +3,7 @@ import logging
from monkey_island.cc.models import Monkey
from monkey_island.cc.services.attack.technique_reports import T1210, T1197, T1110, T1075, T1003, T1059, T1086, T1082
from monkey_island.cc.services.attack.technique_reports import T1145, T1105, T1065, T1035, T1129, T1106, T1107, T1188
from monkey_island.cc.services.attack.technique_reports import T1090, T1041, T1222, T1005, T1018
from monkey_island.cc.services.attack.technique_reports import T1090, T1041, T1222, T1005, T1018, T1016
from monkey_island.cc.services.attack.attack_config import AttackConfig
from monkey_island.cc.database import mongo
@ -32,7 +32,8 @@ TECHNIQUES = {'T1210': T1210.T1210,
'T1041': T1041.T1041,
'T1222': T1222.T1222,
'T1005': T1005.T1005,
'T1018': T1018.T1018}
'T1018': T1018.T1018,
'T1016': T1016.T1016}
REPORT_NAME = 'new_report'

12
monkey/monkey_island/cc/services/attack/attack_schema.py
View File

@ -176,6 +176,7 @@ SCHEMA = {
"type": "bool",
"value": True,
"necessary": False,
"depends_on": ["T1016", "T1005"],
"description": "An adversary may attempt to get detailed information about the "
"operating system and hardware, including version, patches, hotfixes, "
"service packs, and architecture."
@ -187,6 +188,16 @@ SCHEMA = {
"necessary": True,
"description": "Adversaries will likely attempt to get a listing of other systems by IP address, "
"hostname, or other logical identifier on a network for lateral movement."
},
"T1016": {
"title": "T1016 System network configuration discovery",
"type": "bool",
"value": True,
"necessary": False,
"depends_on": ["T1005", "T1082"],
"description": "Adversaries will likely look for details about the network configuration "
"and settings of systems they access or through information discovery"
" of remote systems."
}
}
},
@ -199,6 +210,7 @@ SCHEMA = {
"type": "bool",
"value": True,
"necessary": False,
"depends_on": ["T1016", "T1082"],
"description": "Sensitive data can be collected from local system sources, such as the file system "
"or databases of information residing on the system prior to Exfiltration."
}

35
monkey/monkey_island/cc/services/attack/technique_reports/T1016.py Normal file
View File

@ -0,0 +1,35 @@
from common.utils.attack_utils import ScanStatus
from monkey_island.cc.services.attack.technique_reports import AttackTechnique
from monkey_island.cc.database import mongo
__author__ = "VakarisZ"
class T1016(AttackTechnique):
tech_id = "T1016"
unscanned_msg = "Monkey didn't gather network configurations."
scanned_msg = ""
used_msg = "Monkey gathered network configurations on systems in the network."
query = [{'$match': {'telem_category': 'system_info'}},
{'$project': {'machine': {'hostname': '$data.hostname', 'ips': '$data.network_info.networks'},
'networks': '$data.network_info.networks',
'netstat': '$data.network_info.netstat'}},
{'$addFields': {'_id': 0,
'netstat': 0,
'networks': 0,
'info': [
{'used': {'$and': [{'$ifNull': ['$netstat', False]}, {'$gt': ['$netstat', {}]}]},
'name': {'$literal': 'Network connections (netstat)'}},
{'used': {'$and': [{'$ifNull': ['$networks', False]}, {'$gt': ['$networks', {}]}]},
'name': {'$literal': 'Network interface info'}},
]}}]
@staticmethod
def get_report_data():
network_info = list(mongo.db.telemetry.aggregate(T1016.query))
status = ScanStatus.USED.value if network_info else ScanStatus.UNSCANNED.value
data = T1016.get_base_data_by_status(status)
data.update({'network_info': network_info})
return data

2
monkey/monkey_island/cc/services/config_schema.py
View File

@ -422,7 +422,7 @@ SCHEMA = {
"title": "Collect system info",
"type": "boolean",
"default": True,
"attack_techniques": ["T1082", "T1005"],
"attack_techniques": ["T1082", "T1005", "T1016"],
"description": "Determines whether to collect system info"
},
"should_use_mimikatz": {

13
monkey/monkey_island/cc/ui/src/components/attack/techniques/Helpers.js
View File

@ -37,6 +37,19 @@ export function getUsageColumns() {
style: { 'whiteSpace': 'unset' }}]
}])}
/* Renders table fields that contains 'used' boolean value and 'name' string value.
'Used' value determines if 'name' value will be shown.
*/
export function renderUsageFields(usages){
let output = [];
usages.forEach(function(usage){
if(usage['used']){
output.push(<div key={usage['name']}>{usage['name']}</div>)
}
});
return (<div>{output}</div>);
}
export const ScanStatus = {
UNSCANNED: 0,
SCANNED: 1,

39
monkey/monkey_island/cc/ui/src/components/attack/techniques/T1016.js Normal file
View File

@ -0,0 +1,39 @@
import React from 'react';
import '../../../styles/Collapse.scss'
import ReactTable from "react-table";
import { renderMachineFromSystemData, renderUsageFields, ScanStatus } from "./Helpers"
class T1016 extends React.Component {
constructor(props) {
super(props);
}
static getNetworkInfoColumns() {
return ([{
Header: "Network configuration info gathered",
columns: [
{Header: 'Machine', id: 'machine', accessor: x => renderMachineFromSystemData(x.machine), style: { 'whiteSpace': 'unset' }},
{Header: 'Network info', id: 'info', accessor: x => renderUsageFields(x.info), style: { 'whiteSpace': 'unset' }},
]
}])};
render() {
return (
<div>
<div>{this.props.data.message}</div>
<br/>
{this.props.data.status === ScanStatus.USED ?
<ReactTable
columns={T1016.getNetworkInfoColumns()}
data={this.props.data.network_info}
showPagination={false}
defaultPageSize={this.props.data.network_info.length}
/> : ""}
</div>
);
}
}
export default T1016;

14
monkey/monkey_island/cc/ui/src/components/attack/techniques/T1082.js
View File

@ -1,7 +1,7 @@
import React from 'react';
import '../../../styles/Collapse.scss'
import ReactTable from "react-table";
import { renderMachineFromSystemData, ScanStatus } from "./Helpers"
import { renderMachineFromSystemData, renderUsageFields, ScanStatus } from "./Helpers"
class T1082 extends React.Component {
@ -10,21 +10,11 @@ class T1082 extends React.Component {
super(props);
}
static renderCollections(collections){
let output = [];
collections.forEach(function(collection){
if(collection['used']){
output.push(<div key={collection['name']}>{collection['name']}</div>)
}
});
return (<div>{output}</div>);
}
static getSystemInfoColumns() {
return ([{
columns: [
{Header: 'Machine', id: 'machine', accessor: x => renderMachineFromSystemData(x.machine), style: { 'whiteSpace': 'unset' }},
{Header: 'Gathered info', id: 'info', accessor: x => T1082.renderCollections(x.collections), style: { 'whiteSpace': 'unset' }},
{Header: 'Gathered info', id: 'info', accessor: x => renderUsageFields(x.collections), style: { 'whiteSpace': 'unset' }},
]
}])};

4
monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js
View File

@ -27,6 +27,7 @@ import T1041 from "../attack/techniques/T1041";
import T1222 from "../attack/techniques/T1222";
import T1005 from "../attack/techniques/T1005";
import T1018 from "../attack/techniques/T1018";
import T1016 from "../attack/techniques/T1016";
const tech_components = {
'T1210': T1210,
@ -49,7 +50,8 @@ const tech_components = {
'T1041': T1041,
'T1222': T1222,
'T1005': T1005,
'T1018': T1018
'T1018': T1018,
'T1016': T1016
};
const classNames = require('classnames');