guardicore / monkey

Infection Monkey - An open-source adversary emulation platform
https://www.guardicore.com/infectionmonkey/
GNU General Public License v3.0
6.62k stars 772 forks source link

Bug in report generation on AWS #1341

Closed VakarisZ closed 3 years ago

VakarisZ commented 3 years ago

Describe the bug

A clear and concise description of what the bug is.

To Reproduce

Steps to reproduce the behavior:

  1. Exploit a machine using SSH exploiter on AWS
  2. Navigate the UI
  3. See error
2021-07-21 07:09:12,839 - pywsgi.py:1226 -      write() - INFO - 88.222.20.171 - - [2021-07-21 07:09:12] "GET /api HTTP/1.1" 500 163 0.095493
2021-07-21 07:09:12,885 - report.py:541 - get_domain_issues() - INFO - Domain issues generated for reporting
2021-07-21 07:09:12,891 - report.py:312 - get_azure_creds() - INFO - Azure machines creds generated for reporting
2021-07-21 07:09:12,891 - report.py:103 - get_azure_issues() - INFO - Azure issues generated for reporting
2021-07-21 07:09:12,895 - report.py:710 - get_issues() - INFO - Issues generated for reporting
2021-07-21 07:09:12,913 - report.py:135 - get_scanned() - INFO - Scanned nodes generated for reporting
2021-07-21 07:09:12,923 - report.py:177 - get_exploited() - INFO - Exploited nodes generated for reporting
2021-07-21 07:09:12,924 - config.py:240 - get_default_config() - INFO - Default config was called
2021-07-21 07:09:12,932 - report.py:203 - get_stolen_creds() - INFO - Stolen creds generated for reporting
2021-07-21 07:09:12,933 - report.py:312 - get_azure_creds() - INFO - Azure machines creds generated for reporting
2021-07-21 07:09:12,937 - report_exporter_manager.py:29 -     export() - DEBUG - Trying to export using <class 'monkey_island.cc.services.reporting.aws_exporter.AWSExporter'>
2021-07-21 07:09:12,960 - aws_exporter.py:79 - _prepare_finding() - DEBUG - aws account id acquired: 125686982355
2021-07-21 07:09:12,961 - app.py:1455 - log_exception() - ERROR - Exception on /api [GET]
Traceback (most recent call last):
  File "/tmp/.mount_InfectzgRSYK/usr/src/monkey_island/cc/services/reporting/report_exporter_manager.py", line 31, in export
    exporter().handle_report(report)
  File "/tmp/.mount_InfectzgRSYK/usr/src/monkey_island/cc/services/reporting/aws_exporter.py", line 34, in handle_report
    findings_list.append(AWSExporter._prepare_finding(issue, current_aws_region))
  File "/tmp/.mount_InfectzgRSYK/usr/src/monkey_island/cc/services/reporting/aws_exporter.py", line 93, in _prepare_finding
    finding, findings_dict[issue["type"]](issue, instance_arn)
KeyError: 'SSHExploiter'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/tmp/.mount_InfectzgRSYK/opt/python3.7/lib/python3.7/site-packages/flask/app.py", line 1513, in full_dispatch_request
    rv = self.dispatch_request()
  File "/tmp/.mount_InfectzgRSYK/opt/python3.7/lib/python3.7/site-packages/flask/app.py", line 1499, in dispatch_request
    return self.ensure_sync(self.view_functions[rule.endpoint])(**req.view_args)
  File "/tmp/.mount_InfectzgRSYK/opt/python3.7/lib/python3.7/site-packages/flask_restful/__init__.py", line 467, in wrapper
    resp = resource(*args, **kwargs)
  File "/tmp/.mount_InfectzgRSYK/opt/python3.7/lib/python3.7/site-packages/flask/views.py", line 83, in view
    return self.dispatch_request(*args, **kwargs)
  File "/tmp/.mount_InfectzgRSYK/opt/python3.7/lib/python3.7/site-packages/flask_restful/__init__.py", line 582, in dispatch_request
    resp = meth(*args, **kwargs)
  File "/tmp/.mount_InfectzgRSYK/usr/src/monkey_island/cc/resources/root.py", line 23, in get
    return self.get_server_info()
  File "/tmp/.mount_InfectzgRSYK/usr/src/monkey_island/cc/resources/auth/auth.py", line 83, in wrapper
    return fn(*args, **kwargs)
  File "/tmp/.mount_InfectzgRSYK/usr/src/monkey_island/cc/resources/root.py", line 38, in get_server_info
    completed_steps=InfectionLifecycle.get_completed_steps(),
  File "/tmp/.mount_InfectzgRSYK/usr/src/monkey_island/cc/services/infection_lifecycle.py", line 37, in get_completed_steps
    InfectionLifecycle._on_finished_infection()
  File "/tmp/.mount_InfectzgRSYK/usr/src/monkey_island/cc/services/infection_lifecycle.py", line 55, in _on_finished_infection
    safe_generate_reports()
  File "/tmp/.mount_InfectzgRSYK/usr/src/monkey_island/cc/services/reporting/report_generation_synchronisation.py", line 22, in safe_generate_reports
    report = safe_generate_regular_report()
  File "/tmp/.mount_InfectzgRSYK/usr/src/monkey_island/cc/services/reporting/report_generation_synchronisation.py", line 36, in safe_generate_regular_report
    report = ReportService.generate_report()
  File "/tmp/.mount_InfectzgRSYK/usr/src/monkey_island/cc/services/reporting/report.py", line 681, in generate_report
    ReportExporterManager().export(report)
  File "/tmp/.mount_InfectzgRSYK/usr/src/monkey_island/cc/services/reporting/report_exporter_manager.py", line 33, in export
    logger.exception("Failed to export report, error: " + e)
TypeError: can only concatenate str (not "KeyError") to str
2021-07-21 07:09:12,965 - pywsgi.py:1226 -      write() - INFO - 88.222.20.171 - - [2021-07-21 07:09:12] "GET /api HTTP/1.1" 500 163 0.090477

Expected behavior

  1. SSHKey error shouldn't happen
  2. Exception should be properly handled instead of crashing the tool

Screenshots

If applicable, add screenshots to help explain your problem.

Machine version (please complete the following information):

VakarisZ commented 3 years ago

Looks like we've been neglecting monkey/monkey_island/cc/services/reporting/aws_exporter.py that is yet another place to update when adding an exploiter. We should either remove this feature altogether or make the AWS exports automatic.