Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Define payloads plugin interface #3390

Closed
8 tasks done
mssalvatore opened this issue May 31, 2023 · 3 comments · Fixed by #3531 or #3539
Closed
8 tasks done

Define payloads plugin interface #3390

mssalvatore opened this issue May 31, 2023 · 3 comments · Fixed by #3531 or #3539

Comments

@mssalvatore
Copy link
Collaborator

mssalvatore commented May 31, 2023

Description

In order to create payloads plugins, we must first define a plugin interface for payloads.

Tasks

  • Define what should be passed to Plugin.__init__() for payloads (0d) @shreyamalviya
  • Define what should be passed to Plugin.run() for payloads plugins and modify the puppet as necessary (0d) @shreyamalviya
  • Define what should be returned from Plugin.run() (if anything) for payloads and modify the puppet as necessary (0d) @shreyamalviya
  • Modify PluginLoader._load_plugin_from_island() to load payload plugins (0d) @shreyamalviya
    • Modify puppet to verify OS-compatibility before running payloads
  • Make the UI work for payload plugins (0d) @shreyamalviya
  • Build a mock/test payload plugin and test the system end-to-end (0d) @shreyamalviya
  • Consolidate build.sh scripts in data_for_tests/ (0.25d) @shreyamalviya
@shreyamalviya
Copy link
Contributor

For Plugin.__init__():

The ransomware payload constructor currently requires config, agent_event_queue, and agent_id (along with other ransomware-specific parameters) in its constructor.

The payload plugin constructor should have the name, IAgentEventPublisher, and AgentID.

@shreyamalviya
Copy link
Contributor

shreyamalviya commented Jul 24, 2023

For Plugin.run() parameters:

The ransomware payload run() only accepts interrupt.

Payload plugins' run() functions should accept options and interrupt. OS compatibility will be checked in the puppet, so the plugin doesn't need to worry about it.

@shreyamalviya
Copy link
Contributor

shreyamalviya commented Jul 24, 2023

For Plugin.run() return value:

The ransomware payload run() always returns None.

Payload plugins' run() functions may return PayloadResultData, similar to what we have for exploiters. This would be used in the case where a payload couldn't run due to an unexpected error. A log and event would be published with that message. This also seems a like a good idea to me since payloads are expected to be more varied than other kinds of plugins.

@dataclass
class PayloadResultData:
    run_success: bool = False
    error_message: str = ""

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment