mirror of https://github.com/avast/PurpleDome
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
53 lines
2.1 KiB
ReStructuredText
53 lines
2.1 KiB
ReStructuredText
*********************
|
|
Vulnerability plugins
|
|
*********************
|
|
|
|
For an attack to leave attack traces the target machine machine should be vulnerable. This means:
|
|
|
|
* Services run
|
|
* Old and unpatched application are installed
|
|
* Users with weak passwords are added to the system
|
|
|
|
You get the idea.
|
|
|
|
To get your systems vulnerable use a *vulnerability* plugin type that adds vulnerabilities to targets.
|
|
|
|
This plugin type allows you to punch some holes into the protection of a machine. Which vulnerability plugins are loaded for a specific target is defined in the configuration file. Feel free to weaken the defenses.
|
|
|
|
Usage
|
|
=====
|
|
|
|
To create a new plugin, start a sub-folder in plugins. The python file in there must contain a class that inherits from *VulnerabilityPlugin*.
|
|
|
|
An example plugin is the file *linux_sshd_config_issues.py* you can use as template.
|
|
|
|
Boilerplate
|
|
-----------
|
|
|
|
The boilerplate contains some basics:
|
|
|
|
* name: a unique name, also used in the config yaml file to reference this plugin
|
|
* description: A human readable description for this plugin.
|
|
* ttp: The TTP number linked to this vulnerability. See https://attack.mitre.org/ as a hint which TTP this vulnerability is related to. If you do not know the TTP, use "???"
|
|
* references: A list of urls to blog posts or similar describing the vulnerability
|
|
* required_files: If you ship files with your plugin: listing them here will install on plugin init.
|
|
|
|
|
|
Method: start
|
|
-------------
|
|
|
|
Starts the vulnerability on the machine. The most important method you can use here is "self.run_cmd" and execute a shell command. This must be implemented in your plugin.
|
|
|
|
Method: stop
|
|
------------
|
|
|
|
Undo the changes after the attacks ran. If the machine is re-used (and not re-built or run from a snapshot) this will make it simpler for the user to run more experiments on slightly modified systems. This must be implemented in your plugin. Even if is just an empty method that does nothing.
|
|
|
|
The plugin class
|
|
================
|
|
|
|
.. autoclass:: plugins.base.vulnerability_plugin.VulnerabilityPlugin
|
|
:members:
|
|
:member-order: bysource
|
|
:show-inheritance:
|