archive
/
PurpleDome
mirror of https://github.com/avast/PurpleDome
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Caldera experiments can be independently controlled by files. Those will overwrite the caldera attacks in the experiment files. Good for batch processing

Browse Source
pull/3/head
Thorsten Sick 4 years ago
parent 12c92939c0
commit 090cd7c16a
6 changed files with 88 additions and 29 deletions
Show Stats Download Patch File Download Diff File

30
app/calderacontrol.py
Unescape Escape View File

@ -198,6 +198,20 @@ class CalderaControl():
res.append(ability) res.append(ability)
return res return res
def does_ability_support_platform(self, abid: str, platform: str) -> bool:
""" Checks if an ability supports a specific os
@param abid: ability id.
@param platform: os string to match for
"""
# caldera knows the os-es "windows", "linux" and "darwin"
for ability in self.get_ability(abid):
if ability["platform"] == platform:
return True
return False
def get_operation_by_id(self, op_id): def get_operation_by_id(self, op_id):
""" Get operation by id """ Get operation by id
@ -492,13 +506,16 @@ class CalderaControl():
# ######## All inclusive methods # ######## All inclusive methods
def attack(self, attack_logger: AttackLog = None, paw="kickme", ability_id="bd527b63-9f9e-46e0-9816-b8434d2b8989", group="red"): def attack(self, attack_logger: AttackLog = None, paw="kickme", ability_id="bd527b63-9f9e-46e0-9816-b8434d2b8989", group="red", target_platform=None):
""" Attacks a system and returns results """ Attacks a system and returns results
@param attack_logger: An attack logger class to log attacks with @param attack_logger: An attack logger class to log attacks with
@param paw: Paw to attack @param paw: Paw to attack
@param group: Group to attack. Paw must be in the group @param group: Group to attack. Paw must be in the group
@param ability_id: Ability to run against the target @param ability_id: Ability to run against the target
@param target_platform: Platform of the target machine. Optional. Used for quick-outs
@:return : True if the attack was executed. False if it was not. For example the target os is not supported by this attack
""" """
# Tested obfuscators (with sandcat): # Tested obfuscators (with sandcat):
@ -514,6 +531,14 @@ class CalderaControl():
adversary_name = "generated_adv__" + str(time.time()) adversary_name = "generated_adv__" + str(time.time())
operation_name = "testoperation__" + str(time.time()) operation_name = "testoperation__" + str(time.time())
if target_platform:
# Check if an ability does support the platform of the target:
if not self.does_ability_support_platform(ability_id, target_platform):
self.attack_logger.vprint(
f"{CommandlineColors.FAIL}Platform {target_platform} not supported by {ability_id}{CommandlineColors.ENDC}",
1)
return False
self.add_adversary(adversary_name, ability_id) self.add_adversary(adversary_name, ability_id)
adid = self.get_adversary(adversary_name)["adversary_id"] adid = self.get_adversary(adversary_name)["adversary_id"]
@ -595,6 +620,7 @@ class CalderaControl():
obfuscator=obfuscator, obfuscator=obfuscator,
jitter=jitter jitter=jitter
) )
return True
def pretty_print_ability(self, abi): def pretty_print_ability(self, abi):
""" Pretty pritns an ability """ Pretty pritns an ability
@ -603,7 +629,7 @@ class CalderaControl():
""" """
print(""" print("""
ID: {technique_id} TTP: {technique_id}
Technique name: {technique_name} Technique name: {technique_name}
Tactic: {tactic} Tactic: {tactic}
Name: {name} Name: {name}

52
app/experimentcontrol.py
Unescape Escape View File

@ -22,11 +22,12 @@ from app.exceptions import ServerError
class Experiment(): class Experiment():
""" Class handling experiments """ """ Class handling experiments """
def __init__(self, configfile, verbosity=0): def __init__(self, configfile, verbosity=0, caldera_attacks: list = None):
""" """
@param configfile: Path to the configfile to load @param configfile: Path to the configfile to load
@param verbosity: verbosity level between 0 and 3 @param verbosity: verbosity level between 0 and 3
@param caldera_attacks: an optional argument to override caldera attacks in the config file and run just this one caldera attack. A list of caldera ID
""" """
self.attacker_1 = None self.attacker_1 = None
@ -103,8 +104,9 @@ class Experiment():
# Attack them # Attack them
self.attack_logger.vprint(f"{CommandlineColors.OKBLUE}Running Caldera attacks{CommandlineColors.ENDC}", 1) self.attack_logger.vprint(f"{CommandlineColors.OKBLUE}Running Caldera attacks{CommandlineColors.ENDC}", 1)
for target_1 in self.targets: for target_1 in self.targets:
# Run caldera attacks if caldera_attacks is None:
caldera_attacks = self.experiment_config.get_caldera_attacks(target_1.get_os()) # Run caldera attacks
caldera_attacks = self.experiment_config.get_caldera_attacks(target_1.get_os())
if caldera_attacks: if caldera_attacks:
for attack in caldera_attacks: for attack in caldera_attacks:
# TODO: Work with snapshots # TODO: Work with snapshots
@ -112,11 +114,12 @@ class Experiment():
self.attack_logger.vprint(f"Attacking machine with PAW: {target_1.get_paw()} with {attack}", 2) self.attack_logger.vprint(f"Attacking machine with PAW: {target_1.get_paw()} with {attack}", 2)
caldera_control = CalderaControl("http://" + self.attacker_1.getip() + ":8888", self.attack_logger, config=self.experiment_config) caldera_control = CalderaControl("http://" + self.attacker_1.getip() + ":8888", self.attack_logger, config=self.experiment_config)
caldera_control.attack(attack_logger=self.attack_logger, it_worked = caldera_control.attack(attack_logger=self.attack_logger,
paw=target_1.get_paw(), paw=target_1.get_paw(),
ability_id=attack, ability_id=attack,
group=target_1.get_group(), group=target_1.get_group(),
) target_platform=target_1.get_os()
)
# Moved to fix section below. If fix works: can be removed # Moved to fix section below. If fix works: can be removed
# print(f"Pausing before next attack (config: nap_time): {self.experiment_config.get_nap_time()}") # print(f"Pausing before next attack (config: nap_time): {self.experiment_config.get_nap_time()}")
@ -124,23 +127,24 @@ class Experiment():
# Fix: Caldera sometimes gets stuck. This is why we better re-start the caldera server and wait till all the implants re-connected # Fix: Caldera sometimes gets stuck. This is why we better re-start the caldera server and wait till all the implants re-connected
# Reason: In some scenarios we keep the infra up for hours or days. No re-creation like intended. This can cause Caldera to hick up # Reason: In some scenarios we keep the infra up for hours or days. No re-creation like intended. This can cause Caldera to hick up
self.attack_logger.vprint(f"{CommandlineColors.OKBLUE}Restarting caldera server and waiting for clients to re-connect{CommandlineColors.ENDC}", 1) if it_worked:
self.attacker_1.start_caldera_server() self.attack_logger.vprint(f"{CommandlineColors.OKBLUE}Restarting caldera server and waiting for clients to re-connect{CommandlineColors.ENDC}", 1)
self.attack_logger.vprint(f"Pausing before next attack (config: nap_time): {self.experiment_config.get_nap_time()}", 2) self.attacker_1.start_caldera_server()
time.sleep(self.experiment_config.get_nap_time()) self.attack_logger.vprint(f"Pausing before next attack (config: nap_time): {self.experiment_config.get_nap_time()}", 2)
retries = 100 time.sleep(self.experiment_config.get_nap_time())
for target_system in self.targets: retries = 100
running_agents = caldera_control.list_paws_of_running_agents() for target_system in self.targets:
self.attack_logger.vprint(f"Agents currently connected to the server: {running_agents}", 2)
while target_system.get_paw() not in running_agents:
time.sleep(1)
running_agents = caldera_control.list_paws_of_running_agents() running_agents = caldera_control.list_paws_of_running_agents()
retries -= 1 self.attack_logger.vprint(f"Agents currently connected to the server: {running_agents}", 2)
self.attack_logger.vprint(f"Waiting for clients to re-connect ({retries}, {running_agents}) ", 3) while target_system.get_paw() not in running_agents:
if retries <= 0: time.sleep(1)
raise ServerError running_agents = caldera_control.list_paws_of_running_agents()
self.attack_logger.vprint(f"{CommandlineColors.OKGREEN}Restarted caldera server clients re-connected{CommandlineColors.ENDC}", 1) retries -= 1
# End of fix self.attack_logger.vprint(f"Waiting for clients to re-connect ({retries}, {running_agents}) ", 3)
if retries <= 0:
raise ServerError
self.attack_logger.vprint(f"{CommandlineColors.OKGREEN}Restarted caldera server clients re-connected{CommandlineColors.ENDC}", 1)
# End of fix
self.attack_logger.vprint(f"{CommandlineColors.OKGREEN}Finished Caldera attacks{CommandlineColors.ENDC}", 1) self.attack_logger.vprint(f"{CommandlineColors.OKGREEN}Finished Caldera attacks{CommandlineColors.ENDC}", 1)

2
caldera_control.py
Unescape Escape View File

@ -104,7 +104,7 @@ def create_parser():
parser_delete_agents.set_defaults(func=delete_agents) parser_delete_agents.set_defaults(func=delete_agents)
# For all parsers # For all parsers
main_parser.add_argument("--caldera_url", help="caldera url, including port", default="http://192.168.178.118:8888/") main_parser.add_argument("--caldera_url", help="caldera url, including port", default="http://192.168.178.125:8888/")
main_parser.add_argument("--apikey", help="caldera api key", default="ADMIN123") main_parser.add_argument("--apikey", help="caldera api key", default="ADMIN123")
return main_parser return main_parser

13
caldera_subset_classic.txt
Unescape Escape View File

@ -0,0 +1,13 @@
bd527b63-9f9e-46e0-9816-b8434d2b8989
c0da588f-79f0-4263-8998-7496b1a40596
c1cd6388-3ced-48c7-a511-0434c6ba8f48
feaced8f-f43f-452a-9500-a5219488abb8
b6f545ef-f802-4537-b59d-2cb19831c8ed
3b5db901-2cb8-4df7-8043-c4628a6a5d5a
530e47c6-8592-42bf-91df-c59ffbd8541b
b22b3b47-6219-4504-a2e6-ae8263e49fc3
2dece965-37a0-4f70-a391-0f30e3331aba
5c4dd985-89e3-4590-9b57-71fed66ff4e2
8c06ebf8-bacf-486b-bd77-21ba8c5a5777
ce485320-41a4-42e8-a510-f5a8fe96a644
b007fc38-9eb7-4320-92b3-9a3ad3e6ec25

16
experiment_control.py
Unescape Escape View File

@ -20,7 +20,19 @@ def run(args):
@param args: arguments from the argparse parser @param args: arguments from the argparse parser
""" """
Experiment(args.configfile, args.verbose)
if args.caldera_attack_file:
with open(args.caldera_attack_file, "rt") as fh:
for line in fh:
line = line.strip()
print(f"Running calder attack {line}")
Experiment(args.configfile, args.verbose, [line])
else:
caldera_attack = None
if args.caldera_attack:
caldera_attack = [args.caldera_attack]
Experiment(args.configfile, args.verbose, caldera_attack)
def create_parser(): def create_parser():
@ -35,6 +47,8 @@ def create_parser():
parser_run = subparsers.add_parser("run", help="run experiments") parser_run = subparsers.add_parser("run", help="run experiments")
parser_run.set_defaults(func=run) parser_run.set_defaults(func=run)
parser_run.add_argument("--configfile", default="experiment.yaml", help="Config file to create from") parser_run.add_argument("--configfile", default="experiment.yaml", help="Config file to create from")
parser_run.add_argument("--caldera_attack", default=None, help="The id of a specific caldera attack to run")
parser_run.add_argument("--caldera_attack_file", default=None, help="The file name containing a list of caldera attacks to run")
return parser return parser

4
tools/shipit.py
Unescape Escape View File

@ -58,7 +58,9 @@ globs = ["TODO.md",
"plugins/avast_internal_plugins/*/*/hosts", "plugins/avast_internal_plugins/*/*/hosts",
"plugins/README.md", "plugins/README.md",
"pylint.rc", "pylint.rc",
"shipit_log.txt"] "shipit_log.txt",
"all_caldera_attacks_unique.txt",
"caldera_subset.txt"]
try: try:
os.remove(filename) os.remove(filename)

Write Preview
Loading…
Cancel
Save