guardicore/monkey

In domain networks, query domain to scan machines in domain

Open

#191 opened on 2018年10月7日

GitHub で見る
 (1 comment) (0 reactions) (1 assignee)Python (6,250 stars) (752 forks)batch import
Complexity: MediumFeatureHelp wantedImpact: Medium

説明

Expected Behavior

The Monkey should have a feature (with a toggle) to query the domain controller and get a list of domain joined machines to try and attack. Since the Monkey in this case would be running in a domain machine, the credentials stolen by mimikatz will likely be valid for other domain joined machines.

We could get the data using WMI queries we're already running or by running PowerShell commands

コントリビューターガイド

技術スタック
python
領域
backendsecurity
Issue 種別
feature
難度新しい貢献者にとっての実装難度です。1 は非常に小さな変更、5 は専門的な作業です。
4
推定時間経験ある貢献者が調査、実装、テスト、pull request 準備にかけるおおよその時間範囲です。
over 1 week
活動状況Issue が今どれだけ取り組みやすいかを示します。新しい、活発、古い、ブロック中、またはメンテナー入力待ちなどです。
stale
明確さ期待される変更、受け入れ条件、次の手順がどれだけ明確かを示します。
mostly clear
前提条件
PythonWindows domain knowledgePowerShell basicsWMI understanding
初心者向け度初回貢献者にどれだけ取り組みやすいかを 1-100 で推定したスコアです。
20
調査方針
Investigate how the Monkey currently performs WMI queries (likely in the exploit modules). Look at existing code for WMI execution (e.g., 'exploit/wmi' class). Research how to query Active Directory for domain joined machines via LDAP or PowerShell from Python. Consider using the 'pyad' library or subprocess to run PowerShell commands. The issue suggests a toggle to enable this feature; design a configuration option. Check if there are any linked PRs or comments that provide more context.
In domain networks, query domain to scan machines in domain · guardicore/monkey#191 | Good First Issue