Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove should_monkey_run() check and supporting code #1635

Closed
5 of 6 tasks
mssalvatore opened this issue Nov 30, 2021 · 0 comments
Closed
5 of 6 tasks

Remove should_monkey_run() check and supporting code #1635

mssalvatore opened this issue Nov 30, 2021 · 0 comments

Comments

@mssalvatore
Copy link
Collaborator

mssalvatore commented Nov 30, 2021

The should_monkey_run() check in monkey.py is a performance improvement intended to optimize the monkey's penetration into the network. It comes with a few pitfalls:

  1. It only works if the first agent was started on the island, which is not necessarily the recommended way to run agents.
  2. It assumes that if a port is accessible from the island it is exploitable from the island. Tools like DenyHosts are one example of why this assumption may be false. In these cases, this optimization can actually have an adverse effect on how deeply the monkey can penetrate into a network.
  3. It requires a "scan" capability to be provided by the Island. Architecturally speaking, it's not the C&C server's responsibility to perform network scans.
  4. It adds extra complexity to the agent (e.g. the --vulnerable-port argument)

The Agent Refactor effort, which is currently underway, will provide a number of performance improvements that should mitigate the performance penalty of removing the should_monkey_run() check.

Tasks

  • Remove the --vulneable-port cli argument on develop. Run BB tests, but don't merge to develop, merge to agent refactoring. Modify any exploiters or utility code that specifies this argument (0d) - @shreyamalviya
  • Remove the should_monkey_run() check in the agent refactoring branch (0d)
  • Remove the scanning capability from the island.(0d) @mssalvatore
    • Remove can_island_see_port() in the agent
    • Remove the RemotePortCheck resource and corresponding API endpoint
  • Inspect the started_on_island field in the WormConfiguration and determine if it's still necessary. If not remove it. (0.25d) - @shreyamalviya
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants