-
Notifications
You must be signed in to change notification settings - Fork 807
Fix Zerologon plugin #3295
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix Zerologon plugin #3295
Conversation
"required": [ | ||
"max_attempts" | ||
], |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This is unnecessary. max_attempts
has a default value. The purpose of a default value is to supply a value if none is provided. If max_attempts
is required, then the user must provide a value, meaning there's no point in having a default.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
That's a UI issue, not an issue with the schema. Don't let UI requirements leak down into other components.
It seems that the UI should populate the field with the default value, not that the schema should have knowledge of the UI's requirements.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
IIRC, the only reason we have the schema files in the plugins is to show the configurations in the UI (for rjsf
).
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The schema files define what configuration the plugin accepts. This allows any user of the API to examine how the agent can be configured. It also allows both the agent and the island to verify/validate a supplied configuration.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I don't think that's how we thought of it initially. Hadoop and SMB have the "required" field in their config schema files.
It's fine if we're changing it now but before we do that, we should think about how we'll make the changes in the UI. I don't see a clean way to do it as of now, but more importantly, changing a plugin's config schema would most likely require changes to the frontend, defeating the whole purpose of implementing a plugin system.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I don't think that's how we thought of it initially.
It is. I know because that's how I designed it.
Hadoop and SMB have the "required" field in their config schema files.
We should remove it from those plugins as well.
It's fine if we're changing it now but before we do that, we should think about how we'll make the changes in the UI.
I've created issue #3297 to cover this. We'll fix it next week.
changing a plugin's config schema would most likely require changes to the frontend, defeating the whole purpose of implementing a plugin system.
How do you figure? The plugin specifies a schema, the frontend parses and displays that schema. The whole point is that changes to the schema shouldn't require frontend changes. If we change fields from required to optional and that forces a UI change (like it does now), this is evidence of a deficiency in the frontend.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
How does the UI know which fields to mark as "required" if the config schema doesn't have that information?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The config schema can contain required fields. But if it does, those fields shouldn't have default values. If fields have default values, then they are, by definition, not required.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Dropped the commit
de87973
to
032f986
Compare
032f986
to
bf723d6
Compare
587e0fa
to
500f2d3
Compare
@@ -14,6 +14,7 @@ Changelog](https://keepachangelog.com/en/1.0.0/). | |||
- Renamed "Credential collector" to "Credentials collector". #3167 | |||
- Hard-coded WMI exploiter to a plugin. #3163 | |||
- Hard-coded Mimikatz credentials collector to a plugin. #3168 | |||
- Hard-coded Zerologon exploiter to a plugin. #3164 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Good catch
500f2d3
to
41070ac
Compare
2ecc7e9
to
c9ce6c5
Compare
What does this PR do?
Fixes #3164
PR Checklist
Was the documentation framework updated to reflect the changes?Testing Checklist
Added relevant unit tests?If applicable, add screenshots or log transcripts of the feature working