guardicore / guardicore/monkey

Data Exfiltration Payload

Open
#3,888 1 comment 0 reactions 0 assignees View on GitHub
Complexity: Low Feature Impact: High Payloads Plugins
Dominant language
Python
Stars
7.1k
Forks
830
PR merge metrics
No merged PRs in 30d

Description

# Description

Build a payload plugin that allows Infection Monkey to simulate a data exfiltration. The user should be able to configure:

- Root directory (where the data exfiltration will start from)
- Recursive search/exfiltration
- List of file extensions
- Data Generation (If user doesn't have files on the machine but what to simulate data exfiltration, the payload can generate the data)
- Enabling Data Generation
- Limit of generated Data in Mb
- Types of generated Data
- Data Exfiltration Mechanisms. We decided to go with S3 Bucket andSSH/SFTP
- S3 Bucket Options
- S3 Bucket URL
- AWS Credentials: Access Key and Private Key
- SSH/SFTP
- Username and Password
- SSH Keypairs
- Port
- Data Location

[Data Exfiltration Payload branch](https://github.com/guardicore/monkey/tree/3888-data-exfiltration-payload)

## Notes

- All things needed are in a [document](https://docs.google.com/document/d/1U32gZRvlB71ZqdahDSoJdO8no5VAldYSG7PJ87FNb8M/edit) explaining this payload.
- The research done about this payload can be found in this [issue](https://github.com/guardicore/monkey/issues/3773).
- The initial example config schema is provided.
- We need to be able to exfiltrate a massive amount of data. Take that into consideration when implementing the payload.

## Tasks

- [ ] Create plugin skeleton
- [ ] Options (pydantic)
- [ ] Determine the options needed based on the example schema provided
- [ ] Create a pydantic model/s for data exfiltration payload
- [ ] Create plugin manifest
- [ ] Fix the provided schema (It may have some missing bits when we do this issue)
- [ ] Research and define events that the payload will generate
- [ ] Fix https://github.com/guardicore/monkey/issues/3887 or https://github.com/guardicore/monkey/issues/3886
- [ ] Build a basic data exfiltration paylod with stubbed components
- [ ] plugin.py constructs and executes the payload
- [ ] implement and call stubbed data exfiltrator
- [ ] implement and call stubbed recursive search for data exfiltration
- [ ] implement and call stubbed data generator
- [ ] implement and call stubbed S3 Bucket exfiltration mechanism
- [ ] implement and call stubbed SSH/SFTP exfiltration mechanism
- [ ] Implement the Data Exfiltrator
- [ ] Implement recursive search for the Data Exfiltrator
- [ ] Implement the Data Generator
- [ ] Implement S3 Bucket exfiltration mechanism
- [ ] Implement SSH/SFTP exfiltration mechanism
- [ ] Add jenkins job to build the plugin
- [ ] Update the island build jobs on Jenkins to copy the artifacts from the ransomware plugin build job
- [ ] Final testing
- [ ] Linux
- [ ] Windows
- [ ] Add documentation
- [ ] Update Changelog
- [ ] Remove vulture entries

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.