Questions about some Linux handlers

[tm6907]

Hi, I just have a few questions about some of json examples for different handlers that I'm trying to implement for a linux client. Apologies, I'm still learning JSON.

1. Here on the example for an SSH timeline, what is the meaning of this section "|<unique_key_from_credentials>|" Am I to fill the blanks with the values for a box to perform these SSH tasks on?

2. For the example handler for cron, does the "ScheduleType" of Cron affect the handler in anyway or is just running the command described in "TimelineEvents" ? Because it seems the "Schedule" doesn't affect when the Cron job is run, instead its determined by the "DelayAfter" value.

3. Is there an example timeline block for the Curl handler on linux?

4. Is the Bash handler for Linux clients the equivalent to the Command handler? If so should I use Bash over Command and is there an example timeline block?

Thanks :)

[vramULB]

I'm not working directly on this project, but I hope this can help you with the first question:

You need to create a JSON file to add the credentials for the SSH connection, following the example below:

{
  "Version": "1.0",
  "Data": {
    "credkey1": {"username": "user1", "password": "pw1base64"}, #Credentials for ip 192.168.20.1
    "credkey2": {"username": "user2", "password": "pw2base64"},  #Credentials for ip 192.168.20.2
  }
}

Then, add the path of the file to the CredentialsFile variable to be loaded. The JSON file will be deserialized into a C# object called Credentials. See more details here: Credentials.cs.

Next, the CommandArgs represents the commands for SSH. For an SSH connection, you need to retrieve the IP, username, and password of the target machine. Using the previous configuration, replace <unique_key_from_credentials> with credkey1 as in the example above and add the commands you would like to be executed in the target machine:

"CommandArgs": [
  "192.168.20.1 | credkey1 | ls -lah; ls -ltrh; help; pwd; date; time; uptime; uname -a; df -h; cd ~; cd /home/kali; touch cve1234.rb"
]

You can learn more about the running process here: Ssh.cs.

[tm6907]

Brilliant, thank you :)

[tm6907]

On this SSH handler, how would I check it has worked? The logs says its began and ssh command but not much else before it starts another handler. Nothing to see on the other VM I had it ssh to as well

[sei-dupdyke]

2... does the "ScheduleType" of Cron affect the handler in anyway or is just running the command described in "TimelineEvents" ? Because it seems the "Schedule" doesn't affect when the Cron job is run, instead its determined by the "DelayAfter" value.

Some wanted to be able to schedule specific activities at very specific times, so we implemented Quartz - a library that enabled cron style task scheduling (Quartz has others as well, but we felt most people would know cron).

I'd have to look into the specific issue you're seeing. TBH, we mostly use ghosts for randomized activity, and so very rarely if ever use cron (I'd actually argue to remove it, unless folks have compelling arguments to keep it).

3... Is there an example timeline block for the Curl handler on linux?

No, sorry, but a curl should run like any other command under bash.

4... Is the Bash handler for Linux clients the equivalent to the Command handler? If so should I use Bash over Command and is there an example timeline block?

Yes, bash for linux, Cmd for windows. There should be samples here.

[tm6907]

It seems for the Command handler on Linux it works anyway