Post PWN¶
The AutoPWN functionality can be extended through post pwn plugins. These are plugins that run against a service after the pwn process (gaining access, checking sudo, capturing flags, etc.). At the time of writing there is one built-in post pwn plugin:
ssh_exfil
Configuration¶
Post pwn plugins are configured through the Project File, but they can also be run automatically
based on decisions made by the plugin. Here is an example configuration for the ssh_exfil
plugin:
_version: '1.0'
base: /home/mattg/cdc/isu1-18
project: ISU1-18
flags: []
post:
- service: WWW SSH
commands:
- ssh_exfil:
files:
- /root/ToughNut/
The above configuration explicitly declares that the service WWW SSH
should use the
ssh_exfil
plugin, and should look for additional files in the /root/ToughNut
directory.
Any additional services exposing SSH will automatically attempt to find any of the default exfil
files.
Plugins¶
SSH Exfil¶
-
class
flag_slurper.autolib.post.
SSHFileExfil
¶ The
ssh_exfil
plugin attempt to find as manySENSITIVE_FILES
as possible.This plugin takes some optional parameters:
files
: List[str]A list of files to look for. All entries ending with a
/
are considered directories and will be searched.merge_files
: BooleanSet to
True
if you want to mergefiles
withSENSITIVE_FILES
, otherwise onlyfiles
will be searched.
This plugin will run automatically for all services using port 22.
Custom Plugins¶
CDCs often have unique elements that AutoPWN doesn’t know how to exploit. Frequently
this includes services runing in a non-standard way, and interesting ways to gain access to the
system. For this reason, AutoPWN allows you to write custom Post PWN plugins, to do any post
actions that are necessary for your targets. To write a plugin, you must subclass
PostPlugin
and register it with the
PluginRegistry
.
-
class
flag_slurper.autolib.post.
PostPlugin
¶ Defines a post pwn plugin.
Plugins are configured in the
post
key to a project. For example:--- _version: "0.1" ... post: - service: WWW SSH commands: - <post plugin name>: <arguments>
-
configure
(config: dict) → dict¶ Configure the plugin.
This provides the base configuration implementation. It simply just validates the schema against the given config. Plugins that need more involved configuration may override this method.
Plugins must define their own schema by overriding the
schema
class variable.- Parameters
config –
- Returns
-
abstract
predicate
(service: flag_slurper.autolib.models.Service, context: flag_slurper.autolib.post.PostContext) → bool¶ Determines whether the plugin should be run for the given service, context, and configuration. The plugin’s configuration will have been validated at this point.
- Parameters
service – The current service to test against
context – The current post context
- Returns
True if this plugin should run, False otherwise
-
abstract
run
(service: flag_slurper.autolib.models.Service, context: flag_slurper.autolib.post.PostContext) → bool¶ Run the post pwn plugin.
This is where the plugin will perform any actions it needs. All run methods MUST call their super before accessing the given context, otherwise it must attempt to safely access context entries.
- Parameters
service – The service we are currently attacking
context – The context given to the post plugin
- Returns
True if successful, False otherwise
- Raises
ValueError – if the context schema has not been set
-
unconfigure
()¶ Remove any previous configuration.
This is used between post exploits.
-
-
class
flag_slurper.autolib.post.
PluginRegistry
¶ The post pwn plugin registry.
This handles configuring and figuring out which plugins will need to be run.
-
configure
(config: List[dict])¶ Configure the plugins that will be used for this run.
This will accept the
commands
section for the current service.- Parameters
config – The post config for the current service.
- Raises
KeyError – When a command is specified that doesn’t exist.
ValueError – When more than one key in a command entry.
ValueError – When a command uses an unknown plugin.
-
post
(service: flag_slurper.autolib.models.Service, context: flag_slurper.autolib.post.PostContext) → bool¶ Runs applicable post pwn plugins against the given service, with the given context.
- Parameters
service – The service to post pwn
context – The context for the server
- Returns
Whether all post invocation were successful
-
register
(plugin: Type[flag_slurper.autolib.post.PostPlugin])¶ Register a plugin with the plugin registry.
- Parameters
plugin – The plugin class to register.
- Raises
ValueError – If the plugin does not subclass
PostPlugin
.ValueError – If the plugin name is already taken.
-
Loading Custom Plugins¶
Currently, post pwn plugins do not have an auto-loading method (i.e. entry points). In order to
load a custom plugins, you must manually call register()
after ensuring your plugin is on the PYTHONPATH
. A much better method is planned.