Skip to content

Conversation

VakarisZ
Copy link
Contributor

Feature

Powershell attack technique gets reported.
image

# How long should be wait after each request in seconds
REQUEST_DELAY = 0.0001
# How long should we wait after each request in seconds
REQUEST_DELAY = 0.1
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Any good reason to change this? And specifically in this branch?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No. Needed this bugfix to test and forgot to revert. Bugfix will be included in new weblogic exploiter.

# Conflicts:
#	monkey/infection_monkey/exploit/hadoop.py
Copy link
Contributor

@itaymmguardicore itaymmguardicore left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If you fixed things before, don't forget to push the changes.
Also adapt add_example_cmd to include the shell type when you add a new command.
To be clear, add_example_cmd doesn't need to receive the type as a parameter (unless it makes it easier/more accurate), you just need to detect the type like you detect powershell right now.
An entry in the cmds array will look something like:
{'cmd': 'dir C:\', 'shell_type': 'cmd'} or like this {'cmd': 'Get-Service WinDefend', 'shell_type': 'powershell'}

VakarisZ added 9 commits June 25, 2019 08:36
# Conflicts:
#	monkey/monkey_island/cc/services/attack/technique_reports/T1210.py
…ne_interface

# Conflicts:
#	monkey/monkey_island/cc/services/attack/technique_reports/T1197.py
#	monkey/monkey_island/cc/services/attack/technique_reports/__init__.py
…hash

# Conflicts:
#	monkey/monkey_island/cc/services/attack/technique_reports/T1197.py
#	monkey/monkey_island/cc/services/attack/technique_reports/__init__.py
# Conflicts:
#	monkey/monkey_island/cc/services/attack/technique_reports/__init__.py
# Conflicts:
#	monkey/infection_monkey/exploit/__init__.py
#	monkey/infection_monkey/exploit/hadoop.py
#	monkey/monkey_island/cc/services/attack/attack_report.py
@VakarisZ VakarisZ force-pushed the attack_powershell branch from 4f881a8 to 7fe100b Compare June 26, 2019 12:05
@VakarisZ
Copy link
Contributor Author

If you fixed things before, don't forget to push the changes.
Also adapt add_example_cmd to include the shell type when you add a new command.
To be clear, add_example_cmd doesn't need to receive the type as a parameter (unless it makes it easier/more accurate), you just need to detect the type like you detect powershell right now.
An entry in the cmds array will look something like:
{'cmd': 'dir C:\', 'shell_type': 'cmd'} or like this {'cmd': 'Get-Service WinDefend', 'shell_type': 'powershell'}

Why do we need the shell_type? I think powershell flag in command is enough.

@VakarisZ VakarisZ force-pushed the attack_powershell branch from 7fe100b to 3e9dcd3 Compare June 26, 2019 12:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants