-
Notifications
You must be signed in to change notification settings - Fork 90
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Signed-off-by: Marine LM <[email protected]>
- Loading branch information
Showing
30 changed files
with
814 additions
and
449 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
79 changes: 79 additions & 0 deletions
79
openbas-api/src/main/java/io/openbas/injectors/openbas/util/OpenBASObfuscationMap.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,79 @@ | ||
| package io.openbas.injectors.openbas.util; | ||
|
|
||
| import java.nio.charset.StandardCharsets; | ||
| import java.util.Base64; | ||
| import java.util.HashMap; | ||
| import java.util.Map; | ||
| import java.util.function.BiFunction; | ||
| import lombok.Getter; | ||
|
|
||
| public class OpenBASObfuscationMap { | ||
| private final Map<String, OpenBASObfuscation> obfuscationMap; | ||
|
|
||
| @Getter | ||
| public static class OpenBASObfuscation { | ||
| private final String information; | ||
| private final BiFunction<String, String, String> obfuscate; | ||
|
|
||
| public OpenBASObfuscation(String information, BiFunction<String, String, String> obfuscate) { | ||
| this.information = information; | ||
| this.obfuscate = obfuscate; | ||
| } | ||
| } | ||
|
|
||
| public OpenBASObfuscationMap() { | ||
| this.obfuscationMap = new HashMap<>(); | ||
| this.registerObfuscation("plain-text", "", this::obfuscatePlainText); | ||
| this.registerObfuscation( | ||
| "base64", "CMD does not support base64 obfuscation", this::obfuscateBase64); | ||
| } | ||
|
|
||
| public void registerObfuscation( | ||
| String key, String information, BiFunction<String, String, String> function) { | ||
| if (key == null || function == null) { | ||
| throw new IllegalArgumentException("Key and function must not be null."); | ||
| } | ||
| obfuscationMap.put(key, new OpenBASObfuscation(information, function)); | ||
| } | ||
|
|
||
| public String executeObfuscation(String key, String command, String executor) { | ||
| OpenBASObfuscation obfuscation = obfuscationMap.get(key); | ||
| if (obfuscation != null) { | ||
| return obfuscation.getObfuscate().apply(command, executor); | ||
| } | ||
| throw new IllegalArgumentException("No obfuscation found for key: " + key); | ||
| } | ||
|
|
||
| public Map<String, String> getAllObfuscationInfo() { | ||
| Map<String, String> keyInfoMap = new HashMap<>(); | ||
| for (Map.Entry<String, OpenBASObfuscation> entry : obfuscationMap.entrySet()) { | ||
| keyInfoMap.put(entry.getKey(), entry.getValue().getInformation()); | ||
| } | ||
| return keyInfoMap; | ||
| } | ||
|
|
||
| private String obfuscatePlainText(String command, String executor) { | ||
| return command; | ||
| } | ||
|
|
||
| private String obfuscateBase64(String command, String executor) { | ||
| String obfuscatedCommand = command; | ||
|
|
||
| if (executor.equals("psh") || executor.equals("cmd")) { | ||
| byte[] utf16Bytes = command.getBytes(StandardCharsets.UTF_16LE); | ||
| String base64 = Base64.getEncoder().encodeToString(utf16Bytes); | ||
| obfuscatedCommand = String.format("powershell -Enc %s", base64); | ||
|
|
||
| } else if (executor.equals("bash") || executor.equals("sh")) { | ||
| obfuscatedCommand = | ||
| String.format( | ||
| "eval \"$(echo %s | base64 --decode)\"", | ||
| Base64.getEncoder().encodeToString(command.getBytes())); | ||
| } | ||
| return obfuscatedCommand; | ||
| } | ||
|
|
||
| public String getDefaultObfuscator() { | ||
| return "plain-text"; | ||
| } | ||
| } |
55 changes: 55 additions & 0 deletions
55
openbas-api/src/main/java/io/openbas/migration/V3_55__Add_obfuscator_inject_contract.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,55 @@ | ||
| package io.openbas.migration; | ||
|
|
||
| import java.sql.Connection; | ||
| import java.sql.Statement; | ||
| import org.flywaydb.core.api.migration.BaseJavaMigration; | ||
| import org.flywaydb.core.api.migration.Context; | ||
| import org.springframework.stereotype.Component; | ||
|
|
||
| @Component | ||
| public class V3_55__Add_obfuscator_inject_contract extends BaseJavaMigration { | ||
|
|
||
| @Override | ||
| public void migrate(Context context) throws Exception { | ||
| Connection connection = context.getConnection(); | ||
| Statement statement = connection.createStatement(); | ||
|
|
||
| String addObfuscationQuery = | ||
| "UPDATE injectors_contracts " | ||
| + "SET injector_contract_content = JSONB_SET(" | ||
| + " injector_contract_content::jsonb," | ||
| + " '{fields}'," | ||
| + " CASE WHEN NOT EXISTS (" | ||
| + " SELECT 1 FROM jsonb_array_elements(injector_contract_content::jsonb->'fields') AS fields " | ||
| + " WHERE fields->>'key' = 'obfuscator'" | ||
| + " ) THEN " | ||
| + " injector_contract_content::jsonb->'fields' || " | ||
| + " jsonb_build_object(" | ||
| + " 'key', 'obfuscator'," | ||
| + " 'cardinality', '1'," | ||
| + " 'defaultValue', jsonb_build_array('plain-text')," | ||
| + " 'mandatory', false," | ||
| + " 'mandatoryGroups', null," | ||
| + " 'label', 'Obfuscator'," | ||
| + " 'readOnly', false," | ||
| + " 'linkedFields', jsonb_build_array()," | ||
| + " 'linkedValues', jsonb_build_array()," | ||
| + " 'type', 'choice'," | ||
| + " 'choices', jsonb_build_array(" | ||
| + " jsonb_build_object('value', 'base64', 'label', 'base64', 'information', 'CMD does not support base64 obfuscation')," | ||
| + " jsonb_build_object('value', 'plain-text', 'label', 'plain-text', 'information', '')" | ||
| + " )" | ||
| + " )" | ||
| + " ELSE " | ||
| + " injector_contract_content::jsonb->'fields'" | ||
| + " END" | ||
| + ") " | ||
| + "WHERE injector_id IN (" | ||
| + " SELECT injector_id FROM injectors WHERE injector_type = 'openbas_implant'" | ||
| + ") " | ||
| + "AND injector_contract_payload IN (" | ||
| + " SELECT payload_id FROM payloads WHERE payload_type = 'Command'" | ||
| + ")"; | ||
| statement.executeUpdate(addObfuscationQuery); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.