oxbrbtx/PrimAITE
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

#2689 Implemented pydantic model validation on C2 Server setup method + updated E2E notebook with data exfiltration.

Browse Source
This commit is contained in:
Archer Bowen
2024-08-15 17:08:10 +01:00
parent f32b3a931f
commit 7d086ec35e
6 changed files with 182 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files

110
src/primaite/notebooks/Command-&-Control-E2E-Demonstration.ipynb
View File

@@ -500,9 +500,9 @@
"source": [
"### **Command and Control** | C2 Server Actions | C2_SERVER_DATA_EXFILTRATE\n",
"\n",
"Finally, currently the last action available is the ``C2_SERVER_DATA_EXFILTRATE`` which can be used to exfiltrate a target_file on a remote node to the C2 Beacon & Server's host file system via the ``FTP`` services.\n",
"The second to last action available is the ``C2_SERVER_DATA_EXFILTRATE`` which can be used to exfiltrate a target file on a remote node to the C2 Beacon & Server's host file system via the ``FTP`` services.\n",
"\n",
"This action is indexed as action ``9``. # TODO: Update.\n",
"This action is indexed as action ``6``..\n",
"\n",
"The below yaml snippet shows all the relevant agent options for this action\n",
"\n",
@@ -651,9 +651,13 @@
" applications:\n",
" - application_name: C2Beacon\n",
" - application_name: RansomwareScript\n",
" folders:\n",
" - folder_name: exfiltration_folder\n",
" files:\n",
" - file_name: database.db\n",
" - hostname: database_server\n",
" folders:\n",
" - folder_name: database\n",
" - folder_name: exfiltration_folder\n",
" files:\n",
" - file_name: database.db\n",
" - hostname: client_1\n",
@@ -663,7 +667,7 @@
" num_folders: 1\n",
" num_files: 1\n",
" num_nics: 1\n",
" include_num_access: false\n",
" include_num_access: true\n",
" include_nmne: false\n",
" monitored_traffic:\n",
" icmp:\n",
@@ -832,7 +836,14 @@
"source": [
"### **Command and Control** | Blue Agent Relevance | Observation Space\n",
"\n",
"This section demonstrates the OBS impact if the C2 suite is successfully installed and then used to install, configure and launch the ransomwarescript."
"This section demonstrates the impacts that each of that the C2 Beacon and the C2 Server's commands cause on the observation space (OBS)."
]
},
{
"cell_type": "markdown",
"metadata": {},
"source": [
"#### **Command and Control** | OBS Impact | C2 Beacon | Installation & Configuration"
]
},
{
@@ -888,6 +899,19 @@
"display_obs_diffs(default_obs, c2_configuration_obs, blue_env.game.step_counter)"
]
},
{
"cell_type": "markdown",
"metadata": {},
"source": [
"#### **Command and Control** | OBS Impact | C2 Server | Terminal Command\n",
"\n",
"Using the C2 Server's ``TERMINAL`` command it is possible to install a ``RansomwareScript`` application onto the C2 Beacon's host.\n",
"\n",
"The below code cells perform this as well as capturing the OBS impacts.\n",
"\n",
"It's important to note that the ``TERMINAL`` command is not limited to just installing software."
]
},
{
"cell_type": "code",
"execution_count": null,
@@ -922,11 +946,22 @@
"c2_ransomware_obs, _, _, _, _ = blue_env.step(0)"
]
},
{
"cell_type": "code",
"execution_count": null,
"metadata": {},
"outputs": [],
"source": [
"display_obs_diffs(default_obs, c2_ransomware_obs, env.game.step_counter)"
]
},
{
"cell_type": "markdown",
"metadata": {},
"source": [
"The code cell below demonstrates the differences between the default observation space and the configuration of the C2 Server and the Ransomware installation."
"#### **Command and Control** | OBS Impact | C2 Server | Data Exfiltration\n",
"\n",
"Before encrypting the database.db file, the ``DATA_EXFILTRATION`` command can be used to copy the database.db file onto both the C2 Server and the C2 Beacon's file systems:"
]
},
{
@@ -935,7 +970,61 @@
"metadata": {},
"outputs": [],
"source": [
"display_obs_diffs(default_obs, c2_ransomware_obs, env.game.step_counter)"
"exfil_options={\n",
" \"username\": \"admin\",\n",
" \"password\": \"admin\",\n",
" \"target_ip_address\": \"192.168.1.14\",\n",
" \"target_folder_name\": \"database\",\n",
" \"exfiltration_folder_name\": \"exfiltration_folder\",\n",
" \"target_file_name\": \"database.db\",\n",
"}"
]
},
{
"cell_type": "code",
"execution_count": null,
"metadata": {},
"outputs": [],
"source": [
"c2_server.send_command(given_command=C2Command.DATA_EXFILTRATION, command_options=exfil_options)"
]
},
{
"cell_type": "code",
"execution_count": null,
"metadata": {},
"outputs": [],
"source": [
"c2_exfil_obs, _, _, _, _ = blue_env.step(0)"
]
},
{
"cell_type": "code",
"execution_count": null,
"metadata": {},
"outputs": [],
"source": [
"display_obs_diffs(c2_ransomware_obs, c2_exfil_obs, env.game.step_counter)"
]
},
{
"cell_type": "markdown",
"metadata": {},
"source": [
"#### **Command and Control** | OBS Impact | C2 Server | Ransomware Commands\n",
"\n",
"The code cell below demonstrates the differences between the ransomware script installation obs and the impact of RansomwareScript upon the database."
]
},
{
"cell_type": "code",
"execution_count": null,
"metadata": {},
"outputs": [],
"source": [
"# Configuring the RansomwareScript\n",
"ransomware_config = {\"server_ip_address\": \"192.168.1.14\", \"payload\": \"ENCRYPT\"}\n",
"c2_server.send_command(C2Command.RANSOMWARE_CONFIGURE, command_options=ransomware_config)"
]
},
{
@@ -959,13 +1048,6 @@
"c2_final_obs, _, _, _, _ = blue_env.step(0)"
]
},
{
"cell_type": "markdown",
"metadata": {},
"source": [
"The code cell below demonstrates the differences between the default observation space and the configuration of the C2 Server, the ransomware script installation as well as the impact of RansomwareScript upon the database."
]
},
{
"cell_type": "code",
"execution_count": null,