search

guardicore / monkey

Infection Monkey - An open-source adversary emulation platform
https://www.guardicore.com/infectionmonkey/
GNU General Public License v3.0
6.58k stars 767 forks source link

Duplicate credentials added to configuration. #443

Closed VakarisZ closed 4 years ago

VakarisZ commented 4 years ago

Describe the bug Each monkey run that gathers credentials adds them to credential list without checking if they already exists. This results in monkey brute-forcing the same credentials multiple times.

To Reproduce Steps to reproduce the behavior:

  1. Run monkey on machine with credentials and allow mimikatz to gather passwords or hashes.
  2. Run monkey again on the same machine and it will gather same passwords/hashes again.

Expected behavior Before adding credentials monkey island should check for already existing ones

Screenshots image

danielguardicore commented 4 years ago

The addition of credentials happens at the island, so this should be fixed on the Island side. But agreed