search

guardicore / monkey

Infection Monkey - An open-source adversary emulation platform
https://www.guardicore.com/infectionmonkey/
GNU General Public License v3.0
6.58k stars 767 forks source link

Not all Monkeys die after telling them to so they have to be killed manually #556

Closed ShayNehmad closed 3 years ago

ShayNehmad commented 4 years ago

Describe the bug

After pressing "kill all monkeys" and waiting for a few hours, Monkeys were still scanning and trying to propagate - they had to be killed manually by stopping processes.

Reported by

To Reproduce

Steps to reproduce the behavior:

  1. Configure the Monkey with default settings except for a victim limitation (10)
  2. Run the monkey on a full-mesh network with XXX machines
  3. Wait until Monkey propagates to at least YYY machines
  4. Press "kill all monkeys"

  5. wait

    • [x] TODO get network details from Amit

Expected behavior

All Monkeys have to die within 2 minutes of pressing the "kill all monkeys" button and a clear "killing" progress bar/updates page ought to be created to be able to keep track of which Monkeys were killed successfully.

Mockup of that page: After pressing the "Kill all monkeys" button:

Monkey Kill command sent Dead? Last communicated
Computer name + IP Yes Yes (good) Time (X minutes ago)
Computer name + IP Yes Collected kill command, waiting for confirmation Time (X minutes ago)
Computer name + IP Yes Not collected command Time (X minutes ago)
Computer name + IP No Other statuses? Time (X minutes ago)

Screenshots/logs

Machine version (please complete the following information):

CyberTools30001 commented 4 years ago

Hi Shay, Regarding the OS: InfectionMonkey server on Win2012R2 Agents on Win in different versions for example: Win2012R2 All machines are VMs.

CyberTools30001 commented 4 years ago

btw, didnt see anything related on the log in the UI. if there any other logs you wish to receive, let me know

ShayNehmad commented 4 years ago

Hi @CyberTools30001 , getting the following log files will help us alot in debugging this issue:

CyberTools30001 commented 4 years ago

Update: agent was finally terminated after a couple of hours on a single breached machine Attached is the island log file second requested log contains LM-hashes so i cant upload it Island_log.txt

VakarisZ commented 3 years ago

Closing, because solution to this issue is probably #594