Skip to content

Conversation

shreyamalviya
Copy link
Contributor

What does this PR do?

Fixes #3164

PR Checklist

  • Have you added an explanation of what your changes do and why you'd like to include them?
  • Is the TravisCI build passing?
  • Was the CHANGELOG.md updated to reflect the changes?
  • Was the documentation framework updated to reflect the changes?
  • Have you checked that you haven't introduced any duplicate code?

Testing Checklist

  • Added relevant unit tests?
  • Do all unit tests pass?
  • Do all end-to-end tests pass?
  • Any other testing performed?

    Tested Zerologon manually in the Zoo

  • If applicable, add screenshots or log transcripts of the feature working

Comment on lines 2 to 4
"required": [
"max_attempts"
],
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is unnecessary. max_attempts has a default value. The purpose of a default value is to supply a value if none is provided. If max_attempts is required, then the user must provide a value, meaning there's no point in having a default.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No, not having this means the user can submit this in the UI:
image

The ZerologonOptions pydantic object will populate it with 2000 because of the default value that it has, but the user doesn't know that. The behavior is ambiguous.

This change disables submission:
image

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's a UI issue, not an issue with the schema. Don't let UI requirements leak down into other components.

It seems that the UI should populate the field with the default value, not that the schema should have knowledge of the UI's requirements.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IIRC, the only reason we have the schema files in the plugins is to show the configurations in the UI (for rjsf).

Copy link
Collaborator

@mssalvatore mssalvatore May 3, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The schema files define what configuration the plugin accepts. This allows any user of the API to examine how the agent can be configured. It also allows both the agent and the island to verify/validate a supplied configuration.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think that's how we thought of it initially. Hadoop and SMB have the "required" field in their config schema files.

It's fine if we're changing it now but before we do that, we should think about how we'll make the changes in the UI. I don't see a clean way to do it as of now, but more importantly, changing a plugin's config schema would most likely require changes to the frontend, defeating the whole purpose of implementing a plugin system.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think that's how we thought of it initially.

It is. I know because that's how I designed it.

Hadoop and SMB have the "required" field in their config schema files.

We should remove it from those plugins as well.

It's fine if we're changing it now but before we do that, we should think about how we'll make the changes in the UI.

I've created issue #3297 to cover this. We'll fix it next week.

changing a plugin's config schema would most likely require changes to the frontend, defeating the whole purpose of implementing a plugin system.

How do you figure? The plugin specifies a schema, the frontend parses and displays that schema. The whole point is that changes to the schema shouldn't require frontend changes. If we change fields from required to optional and that forces a UI change (like it does now), this is evidence of a deficiency in the frontend.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How does the UI know which fields to mark as "required" if the config schema doesn't have that information?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The config schema can contain required fields. But if it does, those fields shouldn't have default values. If fields have default values, then they are, by definition, not required.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Dropped the commit

@shreyamalviya shreyamalviya marked this pull request as ready for review May 3, 2023 14:08
@shreyamalviya shreyamalviya force-pushed the 3164-fix-ete-tests branch 2 times, most recently from 587e0fa to 500f2d3 Compare May 3, 2023 14:53
@@ -14,6 +14,7 @@ Changelog](https://keepachangelog.com/en/1.0.0/).
- Renamed "Credential collector" to "Credentials collector". #3167
- Hard-coded WMI exploiter to a plugin. #3163
- Hard-coded Mimikatz credentials collector to a plugin. #3168
- Hard-coded Zerologon exploiter to a plugin. #3164
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch

@mssalvatore mssalvatore force-pushed the 3164-fix-ete-tests branch from 500f2d3 to 41070ac Compare May 3, 2023 15:02
mssalvatore added a commit that referenced this pull request May 3, 2023
@mssalvatore mssalvatore force-pushed the 3164-fix-ete-tests branch from 2ecc7e9 to c9ce6c5 Compare May 3, 2023 18:50
@mssalvatore mssalvatore merged commit 91f0ee1 into develop May 3, 2023
@mssalvatore mssalvatore deleted the 3164-fix-ete-tests branch May 3, 2023 18:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Migrate the ZeroLogon exploiter to a plugin
3 participants