Infection Monkey — Data Center Security Testing Tool

The Infection Monkey is an open source security tool for testing a data center’s resiliency to perimeter breaches and internal server infection. The Monkey uses various methods to self propagate across a data center and reports success to a centralized C&C server.

Features include:

• Multiple propagation techniques:
  • Predefined passwords
  • Common exploits
• Multiple propagation protocols:
  • SSH
  • SMB
  • RDP
• A C&C server with a dedicated UI to visualize the Monkey’s progress inside the data center

The Infection Monkey is comprised of two parts: the Monkey and the C&C server. The monkey is the tool which infects other machines and propagates to them, while the C&C server collects all Monkey reports and displays them to the user.

Requirements

The C&C Server has been tested on Ubuntu 14.04. The Monkey itself has been tested on Windows XP, 7, 8.1 and 10. The Linux build has been tested on Ubuntu server 14.04 and 15.10.

Installation

For off-the-shelf use, download our pre-compiled binaries from our website. To set up the C&C server follow the instructions onMonkey Island readme. If you wish to compile the binaries yourself:

Set C&C server on Windows

1. Install python 2.7

    https://www.python.org/download/releases/2.7

2. Download & Run get-pip.py
   

   https://bootstrap.pypa.io/get-pip.py

3. Run:

   setx path "%path%;C:\Python27\;C:\Python27\Scripts"
   python -m pip install flask
   python -m pip install Flask-Pymongo
   python -m pip install Flask-Restful
   python -m pip install python-dateutil
   mkdir MonkeyIsland\bin
   mkdir MonkeyIsland\db
   mkdir MonkeyIsland\cc\binaries

4. Put monkey binaries in MonkeyIsland\cc\binaries:

   monkey-linux-64 - monkey binary for linux 64bit
   monkey-linux-32 - monkey binary for linux 32bit
   monkey-windows-32.exe - monkey binary for windows 32bit
   monkey-windows-64.exe - monkey binary for windows 64bit

5. Download MongoDB & Extract to MonkeyIsland\bin\mongodb

   https://downloads.mongodb.org/win32/mongodb-win32-x86_64-2008plus-ssl-latest.zip

6. Install OpenSSL

    https://slproweb.com/download/Win64OpenSSL_Light-1_0_2d.exe

7. Generate SSL Certificate, run create_certificate.bat when your current working directory is MonkeyIsland
8. Copy monkey island server to MonkeyIsland\cc

How to run:

1. Start run_mongodb.bat
2. Start run_cc.bat
3. To clear db, run clear_db.bat

Set C&C server on Linux

1. Create the following directories:

   sudo mkdir /var/monkey_island
   sudo chmod 777 /var/monkey_island
   mkdir -p /var/monkey_island/bin/mongodb
   mkdir -p /var/monkey_island/db
   mkdir -p /var/monkey_island/cc/binaries

2. Install the following packages:

   sudo pip install flask
   sudo pip install Flask-Pymongo
   sudo pip install Flask-Restful
   sudo pip install python-dateutil

3. Put monkey binaries in /var/monkey_island/cc/binaries

   monkey-linux-64 - monkey binary for linux 64bit
   monkey-linux-32 - monkey binary for linux 32bit
   monkey-windows-32.exe - monkey binary for windows 32bit
   monkey-windows-64.exe - monkey binary for windows 64bi

4. Download MongoDB and extract it to /var/monkey_island/bin/mongodb
   for debian64 – https://fastdl.mongodb.org/linux/mongodb-linux-x86_64-debian71-3.0.7.tgz
   for ubuntu64 14.10 – https://fastdl.mongodb.org/linux/mongodb-linux-x86_64-ubuntu1410-clang-3.0.7.tgz
   find more at – https://www.mongodb.org/downloads#production
   untar.gz with: tar -zxvf filename.tar.gz -C /var/monkey_island/bin/mongodb
   (make sure the content of the mongo folder is in this directory, meaning this path exists:
   /var/monkey_island/bin/mongodb/bin)
5. Install OpenSSL

    sudo apt-get install openssl

6. Generate SSL Certificate, Run create_certificate.sh (located under /linux)
7. Copy monkey island server to /var/monkey_island:

    cp -r [monkey_island_source]/cc /var/monkey_island/

How to run:

1. run run.sh
2. to clear db, run clear.db.sh

Initial configuration.

Whether you’re downloading or building the Monkey from source, the Infection Monkey is comprised of 4 executable files for different platforms plus a default configuration file.

Monkey configuration is stored in two places: 1. By default, the Monkey uses a local configuration file (usually, config.bin). This configuration file must include the address of the Monkey’s C&C server. 2. After successfully connecting to the C&C server, the monkey downloads a new configuration from the server and discards the local configuration. It is possible to change the default configuration from the C&C server’s UI.

In both cases the command server hostname should be modified to point to your local instance of the Monkey Island (note that this doesn’t require connectivity right off the bat). In addition, to improve the Monkey’s chances of spreading, you can pre-seed it with credentials and usernames commonly used.

Both configuration options use a JSON format for specifying options; see “Options” below for details.

Running the C&C Server

To run the C&C Server, install infected Monkey debian package on a specific server. The initial infected machine doesn’t require a direct link to this server.

Unleashing the Monkey

Once configured, run the monkey using ./monkey-linux-64 m0nk3y -c config.bin -s 41.50.73.31:5000 (Windows is identical). This can be done at multiple points in the network simultaneously.

Command line options include:

• -c, --config: set configuration file. JSON file with configuration values, will override compiled configuration.
• -p, --parent: set monkey’s parent uuid, allows better recognition of exploited monkeys in c&c
• -t, --tunnel: ip:port, set default tunnel for Monkey when connecting to c&c.
• -d, --depth : sets the Monkey’s current operation depth.

[adsense size='1']

How the Monkey works

1. Wakeup connection to c&c, sends basic info of the current machine and the configuration the monkey uses to the c&c.
   1. First try direct connection to c&c.
   2. If direct connection fails, try connection through a tunnel, a tunnel is found according to specified parameter (the default tunnel) or by sending a multicast query and waiting for another monkey to answer.
   3. If no connection can be made to c&c, continue without it.
2. If a firewall app is running on the machine (supports Windows Firewall for Win XP and Windows Advanced Firewall for Win 7+), try to add a rule to allow all our traffic.
3. Startup of tunnel for other Monkeys (if connection to c&c works).
   1. Firewall is checked to allow listening sockets (if we failed to add a rule to Windows firewall for example, the tunnel will not be created)
   2. Will answer multicast requests from other Monkeys in search of a tunnel.
4. Running exploitation sessions, will run x sessions according to configuration:
   1. Connect to c&c and get the latest configuration
   2. Scan ip ranges according to configuration.
   3. Try fingerprinting each host that answers, using the classes defined in the configuration (SMBFinger, SSHFinger, etc)
   4. Try exploitation on each host found, for each exploit class in configuration:
      1. check exploit class supports target host (can be disabled by configuration)
      2. each exploitation class will use the data acquired in fingerprinting, or during the exploit, to find the suitable Monkey executable for the host from the c&c.
         1. If c&c connection fails, and the source monkey’s executable is suitable, we use it.
         2. If a suitable executable isn’t found, exploitation will fail.
         3. Executables are cached in memory.
   5. will skip hosts that are already exploited in next run
   6. will skip hosts that failed during exploitation in next run (can be disabled by configuration)
5. Close tunnel before exiting Wait for monkeys using the tunnel to unregister for it Cleanup Remove firewall rules if added

https://github.com/guardicore/monkey