Post PWN

The AutoPWN functionality can be extended through post pwn plugins. These are plugins that run against a service after the pwn process (gaining access, checking sudo, capturing flags, etc.). At the time of writing there is one built-in post pwn plugin:

  • ssh_exfil

Configuration

Post pwn plugins are configured through the Project File, but they can also be run automatically based on decisions made by the plugin. Here is an example configuration for the ssh_exfil plugin:

_version: '1.0'
base: /home/mattg/cdc/isu1-18
project: ISU1-18
flags: []
post:
- service: WWW SSH
    commands:
    - ssh_exfil:
        files:
            - /root/ToughNut/

The above configuration explicitly declares that the service WWW SSH should use the ssh_exfil plugin, and should look for additional files in the /root/ToughNut directory. Any additional services exposing SSH will automatically attempt to find any of the default exfil files.

Plugins

SSH Exfil

class flag_slurper.autolib.post.SSHFileExfil

The ssh_exfil plugin attempt to find as many SENSITIVE_FILES as possible.

This plugin takes some optional parameters:

files: List[str]

A list of files to look for. All entries ending with a / are considered directories and will be searched.

merge_files: Boolean

Set to True if you want to merge files with SENSITIVE_FILES, otherwise only files will be searched.

This plugin will run automatically for all services using port 22.

Custom Plugins

CDCs often have unique elements that AutoPWN doesn’t know how to exploit. Frequently this includes services runing in a non-standard way, and interesting ways to gain access to the system. For this reason, AutoPWN allows you to write custom Post PWN plugins, to do any post actions that are necessary for your targets. To write a plugin, you must subclass PostPlugin and register it with the PluginRegistry.

class flag_slurper.autolib.post.PostPlugin

Defines a post pwn plugin.

Plugins are configured in the post key to a project. For example:

---
_version: "0.1"
...
post:
  - service: WWW SSH
    commands:
      - <post plugin name>:
          <arguments>
configure(config: dict) → dict

Configure the plugin.

This provides the base configuration implementation. It simply just validates the schema against the given config. Plugins that need more involved configuration may override this method.

Plugins must define their own schema by overriding the schema class variable.

Parameters

config

Returns

abstract predicate(service: flag_slurper.autolib.models.Service, context: flag_slurper.autolib.post.PostContext) → bool

Determines whether the plugin should be run for the given service, context, and configuration. The plugin’s configuration will have been validated at this point.

Parameters
  • service – The current service to test against

  • context – The current post context

Returns

True if this plugin should run, False otherwise

abstract run(service: flag_slurper.autolib.models.Service, context: flag_slurper.autolib.post.PostContext) → bool

Run the post pwn plugin.

This is where the plugin will perform any actions it needs. All run methods MUST call their super before accessing the given context, otherwise it must attempt to safely access context entries.

Parameters
  • service – The service we are currently attacking

  • context – The context given to the post plugin

Returns

True if successful, False otherwise

Raises

ValueError – if the context schema has not been set

unconfigure()

Remove any previous configuration.

This is used between post exploits.

class flag_slurper.autolib.post.PluginRegistry

The post pwn plugin registry.

This handles configuring and figuring out which plugins will need to be run.

configure(config: List[dict])

Configure the plugins that will be used for this run.

This will accept the commands section for the current service.

Parameters

config – The post config for the current service.

Raises
  • KeyError – When a command is specified that doesn’t exist.

  • ValueError – When more than one key in a command entry.

  • ValueError – When a command uses an unknown plugin.

post(service: flag_slurper.autolib.models.Service, context: flag_slurper.autolib.post.PostContext) → bool

Runs applicable post pwn plugins against the given service, with the given context.

Parameters
  • service – The service to post pwn

  • context – The context for the server

Returns

Whether all post invocation were successful

register(plugin: Type[flag_slurper.autolib.post.PostPlugin])

Register a plugin with the plugin registry.

Parameters

plugin – The plugin class to register.

Raises

Loading Custom Plugins

Currently, post pwn plugins do not have an auto-loading method (i.e. entry points). In order to load a custom plugins, you must manually call register() after ensuring your plugin is on the PYTHONPATH. A much better method is planned.