"description":kwargs.get("description",None),# Generic description for this attack. Set by the attack
"description":kwargs.get("description",None),# Generic description for this attack. Set by the attack
"situation_description":kwargs.get("situation_description",None),# Description for the situation this attack was run in. Set by the plugin or attacker emulation
"situation_description":kwargs.get("situation_description",None),# Description for the situation this attack was run in. Set by the plugin or attacker emulation
"countermeasure":kwargs.get("countermeasure",None),# Set by the attack
"countermeasure":kwargs.get("countermeasure",None),# Set by the attack
"description":kwargs.get("description",None),# Generic description for this attack. Set by the attack
"description":kwargs.get("description",None),# Generic description for this attack. Set by the attack
"situation_description":kwargs.get("situation_description",None),# Description for the situation this attack was run in. Set by the plugin or attacker emulation
"situation_description":kwargs.get("situation_description",None),# Description for the situation this attack was run in. Set by the plugin or attacker emulation
"countermeasure":kwargs.get("countermeasure",None),# Set by the attack
"countermeasure":kwargs.get("countermeasure",None),# Set by the attack
self.attack_logger.vprint(f"{CommandlineColors.FAIL}Failed getting operation data. We just have: {output} from get_operation_by_id{CommandlineColors.ENDC}",0)
self.attack_logger.vprint(f"{CommandlineColors.FAIL}Failed getting operation data. We just have: {outp} from get_operation_by_id{CommandlineColors.ENDC}",0)
@ -443,6 +447,9 @@ class MetasploitInstant(Metasploit):
"""
"""
ttp="T1055"
ttp="T1055"
tactics="Privilege Escalation"
tactics_id="TA0004"
description="Migrating to another process can escalate privileges, move the meterpreter to a long running process or evade detection. For that the Meterpreter stub is injected into another process and the new stub then connects to the Metasploit server instead of the old one."
process_list=self.ps_process_discovery(target)
process_list=self.ps_process_discovery(target)
ps=self.parse_ps(process_list[0])
ps=self.parse_ps(process_list[0])
@ -456,16 +463,22 @@ class MetasploitInstant(Metasploit):
# If metasploit requirements are not set, self.metasploit stay None and using metasploit from a plugin not having the requirements will trigger an exception
defcopy_to_attacker_and_defender(self):
defcopy_to_attacker_and_defender(self):
""" Copy attacker/defender specific files to the machines. Called by setup, do not call it yourself. template processing happens before """
""" Copy attacker/defender specific files to the machines. Called by setup, do not call it yourself. template processing happens before """
situation_description="Kiwi is the modern version of mimikatz. It is integrated into metasploit. The attacker wants to get some credentials - reading them from memory.",
countermeasure="Memory access into critical processes should be monitored."
The file {{ e.file_name }} is dropped to the target {{ e.target }}.
~~~~~~~~~~~~
{% endif %}
{% endif %} {# end attack_step #}
{% if e.type is eq("execute_payload") %}
{% if e.type is eq("dropping_file") %}
Executing payload on target
~~~~~~~~~~~~~~~~~~~~~~~~~~~
Dropping file to target
At {{ e.timestamp }}
~~~~~~~~~~~~~~~~~~~~~~~
The command {{ e.command }} is used to start a file on the target {{ e.target }}.
{% endif %}
At {{ e.timestamp }}
{% if e.type is eq("narration") %}
The file {{ e.file_name }} is dropped to the target {{ e.target }}.
{{ e.text }}
{% endif %}
{% endif %}
{% if e.type is eq("execute_payload") %}
{% if e.sub_type is eq("metasploit") %}
Metasploit attack {{ e.name }}
Executing payload on target
~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~
Tactics: {{ e.tactics }}
Tactics ID: {{ e.tactics_id }}
At {{ e.timestamp }}
Hunting Tag: {{ e.hunting_tag}}
The command {{ e.command }} is used to start a file on the target {{ e.target }}.
At {{ e.timestamp }} a Metasploit command {{ e.name }} was used to attack {{ e.target }} from {{ e.source }}.
{% endif %}
{{ e.description }}
{% if e.type is eq("narration") %}
{% if e.metasploit_command is string() %}
{{ e.text }}
Metasploit command: {{ e.metasploit_command }}
{% endif %}
{% endif %}
{% if e.sub_type is eq("metasploit") %}
{% if e.situation_description is string() %}
Situation: {{ e.situation_description }}
Metasploit attack {{ e.name }}
{% endif %}
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
{% if e.countermeasure is string() %}
Countermeasure: {{ e.countermeasure }}
+ Tactics: {{ e.tactics }}
{% endif %}
+ Tactics ID: {{ e.tactics_id }}
{% endif %}
+ Hunting Tag: {{ e.hunting_tag}}
{% if e.sub_type is eq("kali") %}
+ At {{ e.timestamp }} a Metasploit command {{ e.name }} was used to attack {{ e.target }} from {{ e.source }}.
Kali attack {{ e.name }}
+ Description: {{ e.description }}
~~~~~~~~~~~~~~~~~~~~~~~~~~
{% if e.metasploit_command is string() %}
Tactics: {{ e.tactics }}
+ Metasploit command: {{ e.metasploit_command }}
Tactics ID: {{ e.tactics_id }}
{% endif %}
Hunting Tag: {{ e.hunting_tag}}
{% if e.situation_description is string() %}
At {{ e.timestamp }} a Kali command {{ e.kali_name }} was used to attack {{ e.target }} from {{ e.source }}.
+ Situation: {{ e.situation_description }}
{{ e.description }}
{% endif %}
{% if e.kali_command is string() %}
{% if e.countermeasure is string() %}
Kali command: {{ e.kali_command }}
+ Countermeasure: {{ e.countermeasure }}
{% endif %}
{% endif %}
{% if e.situation_description is string() %}
{% if e.result is string() %}
Situation: {{ e.situation_description }}
Attack result::
{% endif %}
{% if e.countermeasure is string() %}
{{ e.result }}
Countermeasure: {{ e.countermeasure }}
{% endif %}
{% endif %}
{% if e.result is iterable() %}
{% endif %}
Attack result::
{% if e.sub_type is eq("caldera") %}
Caldera attack {{ e.name }}
{% for item in e.result %}
~~~~~~~~~~~~~~~~~~~~~~~~~~
{{ item|trim()|indent(4) }}
Tactics: {{ e.tactics }}
{% endfor %}
Tactics ID: {{ e.tactics_id }}
{% endif %}
Hunting Tag: {{ e.hunting_tag}}
{% endif %}
At {{ e.timestamp }} a Caldera ability {{ e.ability_id }}/"{{ e.name }}" was used to attack the group {{ e.target_group }} from {{ e.source }}.
{% if e.sub_type is eq("kali") %}
{{ e.description }}
{% if e.situation_description is string() %}
Kali attack {{ e.name }}
Situation: {{ e.situation_description }}
~~~~~~~~~~~~~~~~~~~~~~~~
{% endif %}
{% if e.countermeasure is string() %}
+ Tactics: {{ e.tactics }}
Countermeasure: {{ e.countermeasure }}
+ Tactics ID: {{ e.tactics_id }}
{% endif %}
+ Hunting Tag: {{ e.hunting_tag}}
{% endif %}
+ At {{ e.timestamp }} a Kali command {{ e.kali_name }} was used to attack {{ e.target }} from {{ e.source }}.
{% endif %} {# event equal start #}
+ Description: {{ e.description }}
{% if e.kali_command is string() %}
+ Kali command: {{ e.kali_command }}
{% endif %}
{% if e.situation_description is string() %}
+ Situation: {{ e.situation_description }}
{% endif %}
{% if e.countermeasure is string() %}
+ Countermeasure: {{ e.countermeasure }}
{% endif %}
{% if e.result is string() %}
Attack result::
{{ e.result }}
{% endif %}
{% if e.result is iterable() %}
Attack result::
{% for item in e.result %}
{{ item|trim()|indent(4) }}
{% endfor %}
{% endif %}
{% endif %}
{% if e.sub_type is eq("caldera") %}
Caldera attack {{ e.name }}
~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ Tactics: {{ e.tactics }}
+ Tactics ID: {{ e.tactics_id }}
+ Hunting Tag: {{ e.hunting_tag}}
+ At {{ e.timestamp }} a Caldera ability {{ e.ability_id }}/"{{ e.name }}" was used to attack the group {{ e.target_group }} from {{ e.source }}.
+ Description: {{ e.description }}
{% if e.situation_description is string() %}
+ Situation: {{ e.situation_description }}
{% endif %}
{% if e.countermeasure is string() %}
+ Countermeasure: {{ e.countermeasure }}
{% endif %}
{% if e.result is string() %}
Attack result::
{{ e.result }}
{% endif %}
{% if e.result is iterable() %}
Attack result::
{% for item in e.result %}
{{ item|trim()|indent(4) }}
{% endfor %}
{% endif %}
{% endif %}
{% endif %} {# event equal start #}
{% endfor %}
{% endfor %}
Tools
Tools
-----
-----
{% for e in events %}
{% for e in events %}
{% if e.event is eq("start") %}
{% if e.event is eq("start") %}
{% if e.type is eq("build") %}
{% if e.type is eq("build") %}
Building tool {{ e.filename }}
~~~~~~~~~~~~~~~~~~~~~~~
Building tool {{ e.filename }}
The file {{ e.filename }} is built
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
{% if e.for_step %}
It will be used in Step {{ e.for_step }}
The file {{ e.filename }} is built
{% endif %}
{% if e.for_step %}
Build time is between {{ e.timestamp }} and {{ e.timestamp_end }}
It will be used in Step {{ e.for_step }}
{% if e.dl_uri is string() %}
{% endif %}
Built from source downloaded from {{ e.dl_uri }}
Build time is between {{ e.timestamp }} and {{ e.timestamp_end }}
{% endif %}
{% if e.dl_uri is string() %}
{% if e.dl_uris %}
Built from source downloaded from {{ e.dl_uri }}
Built from sources downloaded from
{% endif %}
{% for i in e.dl_uris %}
{% if e.dl_uris %}
* {{ i }}
Built from sources downloaded from
{% endfor %}
{% for i in e.dl_uris %}
{% endif %}
* {{ i }}
{% if e.payload is string() %}
{% endfor %}
The attack tool uses a Meterpreter payload. The payload is {{ e.payload }}. The payload is built for the {{ e.platform }} platform and the {{ e.architecture }} architecture.
{% endif %}
The settings for lhost and lport are {{ e.lhost }}/{{ e.lport }}.
{% if e.payload is string() %}
{% endif %}
The attack tool uses a Meterpreter payload. The payload is {{ e.payload }}. The payload is built for the {{ e.platform }} platform and the {{ e.architecture }} architecture.
{% if e.encoding is string() %}
The settings for lhost and lport are {{ e.lhost }}/{{ e.lport }}.
The file was encoded using {{ e.encoding }} after compilation.
{% endif %}
{% endif %}
{% if e.encoding is string() %}
{% if e.encoded_filename is string() %}
The file was encoded using {{ e.encoding }} after compilation.
The encoded version is named {{ e.encoded_filename }}.
{% endif %}
{% endif %}
{% if e.encoded_filename is string() %}
{% if e.SRDI_conversion %}
The encoded version is named {{ e.encoded_filename }}.
The attack tool was converted to position independent shellcode. See: https://github.com/monoxgas/sRDI
{% endif %}
{% endif %}
{% if e.SRDI_conversion %}
{{ e.comment }}
The attack tool was converted to position independent shellcode. See: https://github.com/monoxgas/sRDI
Thorsten Sick
3 years ago
committed by