Open balasub opened 6 months ago
@balasub @vardhah
Questions:
The SSH connection can be persisted in the FTPDirTraversal
action, but how does it get passed to the escalate privilege
action?
What process is being added to the list of processes in the file malicious_processes.txt
? I'm assuming malicious_processes.txt
is on the target machine. Is the process the shell on the target machine that is spawned by the ssh
conneciton?
Is a reverse shell actually running? It's my understanding that a reverse-shell is a connection from the target (attacked) machine back to the attacker node. The FTPDirTraversal
is a connection in the other direction, from the attacker node to the target machine.
Answers:
We will persist the connection and keep it in a dictionary keyed by a unique id that is placed in the observation and state.
The malicious_processes.txt
file should be malicious_process_ids.txt
, as there can be many processes, some harmless and some malicious, that have same name. PID's
will be stored in this file.
The pid of the shell spawned by the malicious ssh connection will be appened to the malicious_process_ids.txt
file.
The exploit remote services action should work as follows.
Input: IP address or hostname
Implementation:
Output:
{success, available_exploit (FTPDirTraversal), exploited port (21), port on which reverse shell runs, remote port on attacker node where reverse shell connects}