This repository has been archived by the owner on Oct 20, 2023. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 276
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Sliver 1.6 parser (alpha) and sample dataset (#190)
Co-authored-by: Courtney Carpenter <[email protected]>
- Loading branch information
1 parent
e992cdb
commit 06b6991
Showing
31 changed files
with
1,276 additions
and
339 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
170 changes: 170 additions & 0 deletions
170
applications/redeye-e2e/src/fixtures/sliver/clients/json_2023-09-20_00-50-01.log
Large diffs are not rendered by default.
Oops, something went wrong.
19 changes: 19 additions & 0 deletions
19
applications/redeye-e2e/src/fixtures/sliver/clients/json_2023-09-20_06-51-01.log
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,19 @@ | ||
| {"time":"2023-09-20T06:51:01.285066093Z","level":"DEBUG","msg":"http","type":"command"} | ||
| {"time":"2023-09-20T06:51:01.28839426Z","level":"INFO","msg":"Starting HTTP :80 listener ...\n"} | ||
| {"time":"2023-09-20T06:51:01.391682177Z","level":"INFO","msg":"Successfully started job #1\n"} | ||
| {"time":"2023-09-20T06:51:18.725030504Z","level":"INFO","msg":"Beacon fcefd6d0 BURNING_OXEN - 10.0.0.2:55844 (2c6ab9987174) - linux/amd64 - Wed, 20 Sep 2023 06:51:18 UTC","type":"event"} | ||
| {"time":"2023-09-20T06:51:26.687264841Z","level":"DEBUG","msg":"use fcefd6d0","type":"command"} | ||
| {"time":"2023-09-20T06:51:26.694869049Z","level":"INFO","msg":"Active beacon BURNING_OXEN (fcefd6d0-f246-419a-8634-eb0804d4275b)\n"} | ||
| {"time":"2023-09-20T06:51:29.390068884Z","level":"DEBUG","msg":"ls","type":"command"} | ||
| {"time":"2023-09-20T06:51:29.414300301Z","level":"INFO","msg":"Tasked beacon BURNING_OXEN (1802352b)"} | ||
| {"time":"2023-09-20T06:51:57.145476008Z","level":"DEBUG","msg":"tasks","type":"command"} | ||
| {"time":"2023-09-20T06:51:57.154961425Z","level":"INFO","msg":" ID State Message Type Created Sent Completed "} | ||
| {"time":"2023-09-20T06:51:57.155117758Z","level":"INFO","msg":"========== ========= ============== =============================== ====== ==========="} | ||
| {"time":"2023-09-20T06:51:57.155136216Z","level":"INFO","msg":" 1802352b \u001b[1mpending\u001b[0m Ls Wed, 20 Sep 2023 06:51:29 UTC "} | ||
| {"time":"2023-09-20T06:51:57.155158466Z","level":"INFO","msg":"%!(EXTRA []interface {}=[])"} | ||
| {"time":"2023-09-20T06:52:35.213722262Z","level":"INFO","msg":"BURNING_OXEN completed task 1802352b","type":"event"} | ||
| {"time":"2023-09-20T06:52:35.216409804Z","level":"INFO","msg":"\r\u001b[2K\r"} | ||
| {"time":"2023-09-20T06:52:35.217814054Z","level":"INFO","msg":"/home/sliver (13 items, 69.6 MiB)"} | ||
| {"time":"2023-09-20T06:52:35.218980137Z","level":"INFO","msg":"================================="} | ||
| {"time":"2023-09-20T06:52:35.219900554Z","level":"INFO","msg":"drwxr-xr-x :sliver .cache <dir> Wed Sep 20 00:50:07 +0000 2023\ndrwxr-xr-x :sliver .config <dir> Wed Sep 20 00:49:29 +0000 2023\ndrwxr-xr-x :sliver .msf4 <dir> Sun Sep 10 03:09:01 +0000 2023\ndrwx------ :sliver .sliver <dir> Wed Sep 20 06:52:35 +0000 2023\ndrwx------ :sliver .sliver-client <dir> Wed Sep 20 00:50:01 +0000 2023\n-rwx------ :sliver BORING_SCORN 17.6 MiB Wed Sep 20 00:50:21 +0000 2023\n-rwx------ :sliver BURNING_OXEN 17.4 MiB Wed Sep 20 00:55:59 +0000 2023\n-rwx------ :sliver EARLY_QUESTION 17.2 MiB Wed Sep 20 03:21:16 +0000 2023\n-rw-r--r-- :sliver run.sh 99 B Wed Sep 20 01:19:37 +0000 2023\n-rw-r--r-- :sliver run2.sh 174 B Wed Sep 20 01:25:16 +0000 2023\n-rw-r--r-- :sliver run3.sh 61 B Wed Sep 20 01:25:29 +0000 2023\n-rw-r--r-- :sliver run5.sh 52 B Wed Sep 20 01:27:26 +0000 2023\n-rwx------ :sliver TIRED_GUN 17.5 MiB Wed Sep 20 00:50:43 +0000 2023\n"} | ||
| {"time":"2023-09-20T06:52:35.221062887Z","level":"INFO","msg":"%!(EXTRA []interface {}=[])"} |
Binary file not shown.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,50 @@ | ||
| dependsOn: | ||
| - 'models' | ||
| - 'parser-core' | ||
| tasks: | ||
| build: | ||
| deps: | ||
| - ~:build-node | ||
| start-dev: | ||
| local: true | ||
| deps: | ||
| - ^:build | ||
| - ~:start-node | ||
| options: | ||
| runInCI: false | ||
| runDepsInParallel: false | ||
| generate-entities: | ||
| command: 'yarn node --loader ts-node/esm src/generate-entities.ts' | ||
| deps: | ||
| - ~:build | ||
| test: | ||
| deps: | ||
| - ~:test-jest | ||
| release-mac: | ||
| deps: | ||
| - ~:build | ||
| outputs: | ||
| - /release/mac/parsers/sliver-parser | ||
| options: | ||
| runInCI: false | ||
| release-linux: | ||
| deps: | ||
| - ~:build | ||
| outputs: | ||
| - /release/linux/parsers/sliver-parser | ||
| options: | ||
| runInCI: false | ||
| release-windows: | ||
| deps: | ||
| - ~:build | ||
| outputs: | ||
| - /release/windows/parsers/sliver-parser | ||
| options: | ||
| runInCI: false | ||
| release-all: | ||
| deps: | ||
| - ~:release-mac | ||
| - ~:release-linux | ||
| - ~:release-windows | ||
| options: | ||
| runInCI: false |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,19 @@ | ||
| { | ||
| "name": "@redeye/sliver-parser", | ||
| "version": "0.0.1-alpha.0", | ||
| "bin": "./dist/index.js", | ||
| "pkg": { | ||
| "assets": [ | ||
| "../../node_modules/better-sqlite3/**/*.*", | ||
| "../../../node_modules/better-sqlite3/**/*.*" | ||
| ], | ||
| "compress": "GZip" | ||
| }, | ||
| "files": [ | ||
| "dist" | ||
| ], | ||
| "dependencies": { | ||
| "@redeye/models": "workspace:*", | ||
| "@redeye/parser-core": "workspace:*" | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,38 @@ | ||
| import { MikroORM } from '@mikro-orm/core'; | ||
| import { defineConfig } from '@mikro-orm/better-sqlite'; | ||
| import { resolve } from 'node:path'; | ||
|
|
||
| (async () => { | ||
| const orm = await MikroORM.init( | ||
| defineConfig({ | ||
| discovery: { | ||
| // we need to disable validation for no entities | ||
| warnWhenNoEntities: false, | ||
| }, | ||
| dbName: resolve( | ||
| __dirname, | ||
| '..', | ||
| '..', | ||
| '..', | ||
| 'applications', | ||
| 'redeye-e2e', | ||
| 'src', | ||
| 'fixtures', | ||
| 'sliver', | ||
| 'sliver.db' | ||
| ), | ||
| // ... | ||
| }) | ||
| ); | ||
| const generator = orm.getEntityGenerator(); | ||
| await generator.generate({ | ||
| // @ts-ignore | ||
| entitySchema: true, | ||
| bidirectionalRelations: true, | ||
| identifiedReferences: true, | ||
| esmImport: true, | ||
| save: true, | ||
| baseDir: resolve(__dirname, 'sliver-entities'), | ||
| }); | ||
| await orm.close(true); | ||
| })(); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| #! /usr/bin/env node | ||
|
|
||
| import { Command } from 'commander'; | ||
| import { registerCampaignCommand } from './parse-campaign.command'; | ||
| import { registerInfoCommand } from './info.command'; | ||
| import { registerValidateFilesCommand } from './validate-files.command'; | ||
| const program = new Command(); | ||
| program | ||
| .name('RedEye - Sliver Parser') | ||
| .description('CLI to parse Sliver DB & Log Files') | ||
| .version('0.0.1', '-v, --version', 'output the current version'); | ||
| registerCampaignCommand(program); | ||
| registerInfoCommand(program); | ||
| registerValidateFilesCommand(program); | ||
| program.parse(); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,36 @@ | ||
| import type { Command } from 'commander'; | ||
| import type { ParserInfo } from '@redeye/parser-core'; | ||
| import { | ||
| ParserMessageTypes, | ||
| ServerDelineationTypes, | ||
| UploadType, | ||
| ValidationMode, | ||
| writeParserMessage, | ||
| } from '@redeye/parser-core'; | ||
|
|
||
| export const registerInfoCommand = (program: Command) => { | ||
| const infoCommand = program.command('info'); | ||
|
|
||
| infoCommand.action(() => { | ||
| writeParserMessage(ParserMessageTypes.Data, aboutInfo); | ||
| }); | ||
| }; | ||
|
|
||
| const aboutInfo: ParserInfo = { | ||
| version: 1, | ||
| id: 'sliver-parser', | ||
| name: 'Sliver Parser', | ||
| uploadForm: { | ||
| serverDelineation: ServerDelineationTypes.Database, | ||
| enabledInBlueTeam: false, | ||
| tabTitle: 'Sliver', | ||
| fileUpload: { | ||
| type: UploadType.Directory, | ||
| validate: ValidationMode.Parser, | ||
| description: 'Upload the Sliver log folder containing a sliver.db file and json_*.log files', | ||
| }, | ||
| fileDisplay: { | ||
| editable: true, | ||
| }, | ||
| }, | ||
| }; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,26 @@ | ||
| import type { Command } from 'commander'; | ||
| import { ParserMessageTypes, writeParserMessage } from '@redeye/parser-core'; | ||
| import { parseSliverFiles } from './parser/parse-sliver-files'; | ||
|
|
||
| type CommandCallbackOptions = { | ||
| folder?: string; | ||
| }; | ||
|
|
||
| export const registerCampaignCommand = (program: Command) => { | ||
| const campaignCommand = program.command('parse-campaign'); | ||
| campaignCommand.option( | ||
| '-f, --folder </absolute/path/to/folder>', | ||
| 'The folder containing a Sliver campaign, includes a sliver.db file and json_*.log files', | ||
| (value) => value.replaceAll('"', '') | ||
| ); | ||
|
|
||
| campaignCommand.action(campaignCommandAction); | ||
| }; | ||
|
|
||
| const campaignCommandAction = async (options: CommandCallbackOptions) => { | ||
| if (options.folder) { | ||
| writeParserMessage(ParserMessageTypes.Data, await parseSliverFiles(options.folder)); | ||
| } else { | ||
| writeParserMessage(ParserMessageTypes.Error, 'No folder specified'); | ||
| } | ||
| }; |
Oops, something went wrong.