alphasoc / flightsim

A utility to safely generate malicious network traffic patterns and evaluate controls.
https://alphasoc.com
Other
1.21k stars 129 forks source link

simulator: add ssh-transfer and ssh-exfil modules #29

Closed kmroz closed 2 years ago

kmroz commented 2 years ago

The ssh-transfer module simulates SSH/SFTP file writes by generating 'random' data, and sending this data using the SFTP protocol to a running instance of alphasoc's sandbox server.

The ssh-exfil makes use of ssh-transfer, but 'randomly' selects an agreed upon list of non-standard SSH ports to test SSH exfiltration.

kmroz commented 2 years ago

https://github.com/alphasoc/flightsim/issues/28 https://github.com/alphasoc/flightsim/issues/21

@tg I think this is ready for a first look. I still need to push some changes to sandbox. Will do that in a bit. Thanks!

Regarding the build, it looks like code checkout failed in circleci. I'll have a look tomorrow.

Will also think about some tests, but most of this is connection setup and leveraging clap-sftp packet parsing.

tg commented 2 years ago

Probably worth bumping up golang version in circleci to something newer as well.

kmroz commented 2 years ago
./flightsim run ssh-transfer:1MB
...
12:11:03 [ssh-transfer:1MB] Preparing to send randomly generated data to a standard SSH port
12:11:03 [ssh-transfer:1MB] Simulating an SSH/SFTP file transfer of 1048576B (1.00MB) to 127.0.0.1:22
...
./flightsim run ssh-exfil:1MB
...
12:11:11 [ssh-exfil:1MB] Preparing to send randomly generated data to a non-standard SSH port
12:11:11 [ssh-exfil:1MB] Simulating an SSH/SFTP file transfer of 1048576B (1.00MB) to 127.0.0.1:465
...
./flightsim run ssh-exfil:1MB
...
12:11:20 [ssh-exfil:1MB] Preparing to send randomly generated data to a non-standard SSH port
12:11:20 [ssh-exfil:1MB] Simulating an SSH/SFTP file transfer of 1048576B (1.00MB) to 127.0.0.1:587
...
./flightsim run ssh-exfil:1MB
...
12:11:23 [ssh-exfil:1MB] Preparing to send randomly generated data to a non-standard SSH port
12:11:23 [ssh-exfil:1MB] Simulating an SSH/SFTP file transfer of 1048576B (1.00MB) to 127.0.0.1:995
kmroz commented 2 years ago

@tg @ioj - rebased this on top of master.