Commit Graph

271 Commits

Author SHA1 Message Date
Marek Wolan
08f1cf1fbd Fix airspace and remaining port problems from refactor 2024-09-19 15:06:29 +01:00
Marek Wolan
dd931d900b port refactor - eod commit, airspace still broken 2024-09-18 16:02:25 +01:00
=
310876cd3b 2755 Add ability to extend HostNode, NetworkNode, Service and Application outside PrimAITE. 2024-09-04 15:49:37 +01:00
Marek Wolan
a1553fb1b4 Backport core changes from internal 2024-08-28 10:20:32 +01:00
Archer Bowen
bceedbf72d Merged PR 504: Command and Control Full PR
## Summary
Implements the Command and Control applications to the quality and capability needed for the TAP001 expansion and lays the foundations for all the features required for TAP002 (Next Release).

The C2C suite contains three new applications:

**1. Abstract C2**

Base class for the C2 Server and the C2 Beacon. Controls the main internal logic of both applications but with a couple of abstract methods which each class defines differently.

**2. C2 Server**

The C2 Server takes red agent actions and converts the action options into C2 Commands which are then passed to the C2 Beacon.
The output of these commands is sent back to the C2 Server and then returned back to the red agent.

**3. C2 Beacon**

The C2 beacon uses the Terminal and the Ransomware Applications to perform different commands which it receives these commands and executes them and returns the output.

The C2 beacon can also be configured by the Red Agent to configure the current networking behaviour.

For a much more detailed description please refer to the .rst documentation and the notebook which demonstrate and describe the functionality very explicitly.

Lastly the wiki page also provides more information around the design work for this feature.

[Command and Control](/Welcome-to-PrimAITE!/Design/[~In-Progress~]/Command-and-Control)

Worth noting that some changes were needed that were unseen during the design page but the overall goals of the feature have been accomplished.

## Test process
Tested via notebooks and a series of e2e tests.

## Checklist
- [x] PR is linked to a **work item**
- [x] **acceptance criteria** of linked ticket are met
- [x] performed **self-review** of the code
- [x] written **tests** for any new functionality added with this PR
- [x] updated the **documentation** if this PR changes or adds functionality
- [x] written/updated **design docs** if this PR implements new functionality
- [x] updated the **change log**
- [x] ran **pre-commit** checks for code style
- [x] attended to any **TO-DOs** left in the code (One remaining but unsure if it should be handled in this PR)

Related work items: #2689, #2720, #2721, #2779
2024-08-20 13:16:22 +00:00
Marek Wolan
98f5454f04 Merge remote-tracking branch 'origin/dev' into feature/2736-instantaneous-rewards 2024-08-20 10:40:48 +01:00
Archer Bowen
5bba4ed20e Merge remote-tracking branch 'origin/dev' into feature/2689-command-and-control 2024-08-20 09:30:43 +01:00
Marek Wolan
aeca5fb6a2 #2769 - Clean up incorrect names and commented out code [skip ci] 2024-08-19 10:28:39 +01:00
Marek Wolan
05f9751fa8 #2736 - implement instantaneous rewards 2024-08-19 10:17:39 +01:00
Archer Bowen
83b8206ce0 #2689 Added C2 Sequence diagram to docs and added additional ftp_client request tests. 2024-08-16 11:51:38 +01:00
Archer Bowen
6a28f17f1b #2689 Initial draft of File exfiltration. 2024-08-14 19:49:58 +01:00
Marek Wolan
929bd46d6d #2769 - Make changing password disconnect remote sessions 2024-08-12 14:16:04 +01:00
Marek Wolan
5956721804 Merge remote-tracking branch 'origin/dev' into feature/2769-implement-user-account-action-space 2024-08-12 09:23:55 +01:00
Marek Wolan
3df55a708d #2769 - add actions and tests for terminal 2024-08-11 23:24:29 +01:00
Archer Bowen
0e8e8c5681 Merge remote-tracking branch 'origin/dev' into feature/2689-command-and-control 2024-08-09 12:15:43 +01:00
Archer Bowen
4241118d26 #2689 Adding slight changes to c2_Beacon & terminal that appeared when merging from dev. 2024-08-09 12:14:57 +01:00
Christopher McCarthy
ca2aef7343 Merged PR 503: Enable Multi-Port Listening for Services and Applications
## Summary
- Added a `listen_on_ports` set in the `IOSoftware` class to enable software listening on ports in addition to the main port they're assigned.
- Also added something I missed in the `CHANGELOG.md` from user login ticket 🙃

## Test process
- Tested listening on ports with a dummy listener software class and counted frames snooped on.
- Also tested that the actual software that the posts being snooped in on still works as expected.

## Checklist
- [X] PR is linked to a **work item**
- [X] **acceptance criteria** of linked ticket are met
- [X] performed **self-review** of the code
- [X] written **tests** for any new functionality added with this PR
- [X] updated the **documentation** if this PR changes or adds functionality
- [X] written/updated **design docs** if this PR implements new functionality
- [X] updated the **change log**
- [X] ran **pre-commit** checks for code style
- [ ] attended to any **TO-DOs** left in the code

Related work items: #2768
2024-08-09 10:25:33 +00:00
Charlie Crane
665c53d880 #2781 - Actioning review comments 2024-08-08 15:48:44 +01:00
Chris McCarthy
a5652ae4b2 Merge branch 'refs/heads/dev' into feature/2768_enable-multi-port-listening-for-services-and-applications 2024-08-08 14:26:35 +01:00
Charlie Crane
116ac725b0 #2718 - making terminal rm _login() and _remote_login() consistent in their RequestResponse 2024-08-08 14:23:10 +01:00
Charlie Crane
5f5ea5e524 #2718 - Updates to Terminal following discussion about implementation with actions. 2024-08-08 14:20:23 +01:00
Charlie Crane
ff054830bc #2781 - Correcting some typos in Terminal notebook and elaborating the data in _remote_login request 2024-08-08 11:57:30 +01:00
Charlie Crane
93ef3076f5 #2781 - user_session_manager._timeout_session() now sends a user_timeout command when closing remote sessions. Corrected source_ip in Terminal.receive() 2024-08-08 11:33:42 +01:00
Charlie Crane
9fea34bb43 #2781 - Correcting terminal tests and fixing a typo in base.py 2024-08-07 11:58:17 +01:00
Charlie Crane
1802648436 #2781 - Initial commit with changes to Terminal to integrate with user_session_manager. Login and logout are now talking to the monitored user session 2024-08-07 11:31:51 +01:00
Charlie Crane
bd91b4be1d #2706 - Merge branch 'dev' into feature/2706-Terminal_Sim_Component 2024-08-07 09:08:43 +01:00
Charlie Crane
6d6f21a20a #2706 - Additional assert on new test and a guard clause on LocalTerminalConnection.execute() to check that the Terminal service is running before sending a command 2024-08-06 19:14:53 +01:00
Charlie Crane
d05fd00594 #2706 - Resolving an issue that saw disconnected terminal connections still able to send execute commands that were also then processed by the target node. Created a new class: LocalterminalConnection, for local connection objects to terminal. Calling terminal.show() when there is a local connection will have 'Local Connection' as the IP address. Receive and execute will check that the provided connection uuid is valid before actioning any commands. TerminalClientConnection objects now have an is_active flag similar to DatabaseClientConnection. Added a new test to check that terminals will reject commands from disconnected clientconnection objects. 2024-08-06 19:09:23 +01:00
Charlie Crane
df49b3b5bb #2706 - Actioning Review Comments 2024-08-06 14:10:10 +01:00
Charlie Crane
89107f2c4b #2706 - Type-hint changes following review 2024-08-06 10:37:11 +01:00
Chris McCarthy
d2011ff327 #2811 - Updated syslog messaging around DatabaseClient and DatabaseService connection request and password authentication 2024-08-05 22:23:54 +01:00
Charlie Crane
63a689d94a #2706 - correcting test failures 2024-08-05 16:25:35 +01:00
Charlie Crane
4fe9753fcf #2706 - Updated terminal.receive() to work with SSHPacket class, fixed some tests and updated RemoteTerminalConnection to hold Source_IP for easier reading 2024-08-05 15:44:52 +01:00
Charlie Crane
22c84d35d7 Merge branch 'dev' into feature/2706-Terminal_Sim_Component 2024-08-05 09:52:53 +01:00
Charlie Crane
4bddf72cd3 #2706 - Initial refactor of Terminal Class following review discussion on Friday. Terminal will now return a TerminalConnection/RemoteTerminalConnection object on login.
The new connection object can then be used to pass commands to the target node, without needing to form a full payload item.
2024-08-05 09:29:17 +01:00
Chris McCarthy
322a691e53 #2768 - Added listen_on_ports attribute to IOSoftware. updated software manager so that it sends copies of payloads to listening ports too. Added integration test that installs a listening service to snoop on DB traffic. 2024-08-02 23:21:35 +01:00
Charlie Crane
e132c52121 #2706 - Removed the LoginValidator. Will be handled by UserSessionManager. Updated some missing variables in method definitions/ 2024-08-02 13:32:34 +01:00
Charlie Crane
ab4931463f #2706 - Minor change following the session_id changes as local_login failed to pass a session_id when creating a new TerminalClientConnection object 2024-08-02 09:21:55 +01:00
Charlie Crane
0fe61576c7 #2706 - Removed source and target ip_address attributes from the SSHPacket Class. Terminal now uses session_id to send login outcome. No more network_interface[1].ip_address. 2024-08-02 09:13:31 +01:00
Charlie Crane
19d7774440 #2706 - Changed how Terminal Class handles its connections. Terminal now has a list of TerminalClientConnection objects that holds all active connections. Corrected a typo in ssh.py 2024-08-01 12:34:21 +01:00
Charlie Crane
e4e3e17f51 #2706 - commit minor changes from review comments 2024-08-01 07:57:01 +01:00
Charlie Crane
0f3fa79ffe #2706 - Actioning review comments on example notebook and terminal class 2024-07-31 15:47:18 +01:00
Charlie Crane
3698e6ff5f #2706 - Commented out references to UserSessionManager to remove the dependency. 2024-07-30 15:24:37 +01:00
Charlie Crane
09084574a8 #2706 - Inclusion of health_state_actual attribute to the Terminal class. Started fleshing out a walkthrough notebook showing how to use the new component. 2024-07-30 12:15:37 +01:00
Charlie Crane
bb0ecb93a4 #2706 - Correcting whitespace change in database_service.py and actioning some review comments 2024-07-30 09:57:47 +01:00
Charlie Crane
e492f19a43 #2706 - Small change to execute method following feedback 2024-07-29 17:10:13 +01:00
Charlie Crane
f78cb24150 #2706 - Removed some un-necessary comments and changes to network used in terminal ACL unit test 2024-07-29 14:20:29 +01:00
Charlie Crane
cf7341a4fd #2713 - Minor changes before merging into main Terminal branch 2024-07-29 10:50:32 +01:00
Charlie Crane
0ac1c6702c #2713 - eod commit. Initial RequestManager Test implemented, along with an initial setup of the additional Request Manager methods. 2024-07-26 16:56:03 +01:00
Charlie Crane
a0e675a09a #2712 - Minor changes to login Validator 2024-07-24 11:20:01 +01:00