Add integration tests for chef; various fixes/improvements

- Chef integration test now included in Azure Pipeline
- Run go mod tidy
- Add verbose option for command creation to generate MOSE payload
- Move TargetAgents() to the moseutils package
- Increase the wait time from 10 to 12 minutes for chef environment generation in the pipeline
- Add logic to stop MOSE from trying to run knife upload cookbook in ~/.berkshelf
- Update image name for the chef workstation container
- Remove references to the l50 fork of the repo
- Updates to accomodate golang 1.13
- Update logic of make build
- Add a make destroy option to incorporate packr2 clean
- Move chef workstation expect script to scripts directory

Makefile

@@ -1,12 +1,14 @@
 build:
 	go get -u github.com/gobuffalo/packr/v2/packr2
 	export GO111MODULE=on
+	packr2 build
 	go get
 	go build
-	packr2 clean
-	packr2 build
 	mkdir -p payloads
 
+destroy:
+	packr2 clean
+
 setup-linter: ## Install all the build and lint dependencies
 	gometalinter --install
 
@@ -31,4 +33,4 @@ lint: ## Run all the linters
 
 test:
 	go test -count=1 -v -race ./... ; \
-		echo "Testing Complete."
+		echo "Testing Complete."

README.md

@@ -19,10 +19,11 @@ MOSE is a post exploitation tool that enables security professionals with little
 ## Dependencies
 You must download and install the following for MOSE to work:
 
- - [Golang](https://golang.org/) - specifically go1.12.7
+ - [Golang](https://golang.org/) - tested with 1.12.7 through 1.13.4
 
  **Be sure to properly set your GOROOT, PATH and GOPATH env vars**
- - [Docker](https://docs.docker.com/install/) - tested with 18.09.2, build 6247962
+
+ - [Docker](https://docs.docker.com/install/) - tested with 18.09.2 through 19.03.4
 
 ## Getting started
 Install all go-specific dependencies and build the binary:
@@ -66,22 +67,19 @@ Usage of ./mose [options]:
   ```
 
 ### TLS Certificates
-
-**WARNING: You should generate and use a TLS certificate signed by a trusted Certificate Authority**
+**You should generate and use a TLS certificate signed by a trusted Certificate Authority**
 
 A self-signed certificate and key are provided for you, although you really shouldn't use them. This key and certificate are widely distributed, so you can not expect privacy if you do choose to use them. They can be found in the  `data` directory.
 
 ### Examples
-You can find a couple of examples of how to run MOSE in [EXAMPLES.md](EXAMPLES.md)
+You can find some examples of how to run MOSE in [EXAMPLES.md](EXAMPLES.md).
 
 ### Test Labs
-You can find test labs that can be run with MOSE at the following locations:
-
+Test labs that can be run with MOSE are at these locations:
  - https://github.com/master-of-servers/puppet-test-lab
  - https://github.com/master-of-servers/chef-test-lab
 
 ### Credits
 The following resources were used to help motivate the creation of this project:
-
  - https://n0tty.github.io/2017/06/11/Enterprise-Offense-IT-Operations-Part-1/
- - http://www.ryanwendel.com/2017/10/03/cooking-up-shells-with-a-compromised-chef-server/
+ - http://www.ryanwendel.com/2017/10/03/cooking-up-shells-with-a-compromised-chef-server/

azure-pipelines.yml

@@ -43,7 +43,7 @@ steps:
     go get
     go build
     mkdir -p payloads
-  displayName: Build MOSE
+  displayName: 'Build MOSE'
   workingDirectory: "$(modulePath)"
 
 # Puppet
@@ -69,7 +69,7 @@ steps:
     docker exec -i basic-puppetmaster /bin/bash -c "echo 'Y' | /puppet-linux"
     docker exec -i basic-puppetagent /bin/bash -c "puppet agent -t"
     docker exec -i basic-puppetagent /bin/bash -c "cat /tmp/test.txt"
-  displayName: 'Run MOSE generated payload on puppet test env'
+  displayName: 'Run MOSE generated payload on puppet test environment'
   workingDirectory: "$(modulePath)"
 # End Puppet
 
@@ -79,8 +79,42 @@ steps:
     sudo DEBIAN_FRONTEND=noninteractive apt-get install -y tzdata
     sudo apt-get install -y expect
     export GO111MODULE=on
-    expect test_chef.exp
-  displayName: 'Generate a chef payload'
+    expect scripts/test_chef_workstation.exp
+  displayName: 'Generate a chef payload for workstation in chef test environment'
+  workingDirectory: "$(modulePath)"
+
+- script: | 
+    git clone https://github.com/master-of-servers/chef-test-lab.git
+    cd chef-test-lab
+    cd docker/basic
+    bash create_ssh_key.sh
+    docker-compose up -d --build
+    echo "Sleeping for 12 minutes (720 seconds) while waiting for the chef environment to finish building."
+    sleep 720
+    docker ps
+  displayName: 'Build and configure chef test environment'
+  workingDirectory: "$(modulePath)"
+
+- script: | 
+    # Copy MOSE payload to workstation
+    docker cp $(modulePath)/payloads/chef-linux basic-chef-workstation:/chef-linux
+    # This is very annoying and redundant work, but it seems to need to be done for the pipeline
+    docker exec -i basic-chef-workstation /bin/bash -c "cd /root/.chef/cookbooks && rm -rf chef-client && knife supermarket download chef-client && tar -xvf chef-client-*; rm *tar*"
+    docker exec -i basic-chef-workstation /bin/bash -c "cd /root/.chef/cookbooks && cp hello/Berksfile chef-client/Berksfile"
+    docker exec -i basic-chef-workstation /bin/bash -c "cd /root/.chef/cookbooks/chef-client && berks install && berks upload"
+    docker exec -i basic-chef-workstation /bin/bash -c "cd /root/.chef/ && knife ssl fetch && knife upload cookbooks"
+    docker exec -i basic-chef-workstation knife vault create secret_vault mysql_pw '{"user": "mysql", "password": "TheM0stS3cr3T!!!"}'
+    # Bootstrap agent with chef server
+    docker exec -i basic-chef-workstation /bin/bash -c "knife bootstrap chef-agent-1 -u root -P toor --sudo -N chef-agent-1 --run-list 'recipe[hello], recipe[chef-client::config]'"
+
+    # Run MOSE against the workstation
+    docker exec -i basic-chef-workstation /bin/bash -c "echo 'n' | /chef-linux"
+    # Run chef-client to enact the changes made by MOSE
+    docker exec -i basic-chef-agent-1 /bin/bash -c "chef-client"
+    
+    # Ensure that MOSE is working properly by running cat on the file it created
+    docker exec -i basic-chef-agent-1 /bin/bash -c "cat /tmp/test.txt"
+  displayName: 'Run MOSE generated payload on workstation in chef test environment'
   workingDirectory: "$(modulePath)"
 # End Chef
 

chefEnv.go

@@ -11,7 +11,7 @@ import (
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/client"
 	"github.com/gobuffalo/packr/v2"
-	"github.com/l50/mose/pkg/chefutils"
+	"github.com/master-of-servers/mose/pkg/moseutils"
 	"github.com/mholt/archiver"
 	"io"
 	"io/ioutil"
@@ -236,7 +236,7 @@ func runMoseInContainer(cli *client.Client, id string, osTarget string) {
 		os.Exit(0)
 	}
 	// Run the MOSE binary on the new workstation that we just created
-	agents, err := chefutils.TargetAgents(nodes, osTarget)
+	agents, err := moseutils.TargetAgents(nodes, osTarget)
 	if err != nil {
 		log.Println("Quitting...")
 		signalChan <- os.Interrupt

cmd/mose/chef/main.go

@@ -10,11 +10,6 @@ import (
 	"crypto/tls"
 	"encoding/json"
 	"flag"
-	"github.com/fatih/color"
-	"github.com/gobuffalo/packr/v2"
-	"github.com/l50/goutils"
-	"github.com/l50/mose/pkg/chefutils"
-	"github.com/l50/mose/pkg/moseutils"
 	"io"
 	"log"
 	"mime/multipart"
@@ -26,6 +21,11 @@ import (
 	"strings"
 	"text/template"
 	"time"
+
+	"github.com/fatih/color"
+	"github.com/gobuffalo/packr/v2"
+	utils "github.com/l50/goutils"
+	"github.com/master-of-servers/mose/pkg/moseutils"
 )
 
 type Command struct {
@@ -397,7 +397,7 @@ func chefWorkstation(knifeFile string, chefDirs []string) {
 		if suppliedNodes != "" {
 			agents = strings.Fields(suppliedNodes)
 		} else {
-			agents, err = chefutils.TargetAgents(nodes, osTarget)
+			agents, err = moseutils.TargetAgents(nodes, osTarget)
 			if err != nil {
 				log.Fatal("Quitting")
 			}
@@ -418,7 +418,7 @@ func chefWorkstation(knifeFile string, chefDirs []string) {
 		}
 		var cookbooksLoc string
 		for _, dir := range chefDirs {
-			if strings.Contains(dir, "cookbooks") {
+			if strings.Contains(dir, ".chef/cookbooks") {
 				cookbooksLoc = dir
 			}
 		}

cmd/mose/puppet/main.go

@@ -11,7 +11,7 @@ import (
 	"github.com/fatih/color"
 	"github.com/gobuffalo/packr/v2"
 	"github.com/l50/goutils"
-	"github.com/l50/mose/pkg/moseutils"
+	"github.com/master-of-servers/mose/pkg/moseutils"
 	"io/ioutil"
 	"log"
 	"os"

filehandler.go

@@ -7,7 +7,7 @@ package main
 import (
 	"context"
 	"encoding/json"
-	"github.com/l50/mose/pkg/moseutils"
+	"github.com/master-of-servers/mose/pkg/moseutils"
 	"io"
 	"log"
 	"net/http"

go.mod

@@ -1,43 +1,39 @@
-module github.com/l50/mose
-
-go 1.12
+module github.com/master-of-servers/mose
 
 require (
+	github.com/Azure/go-ansiterm v0.0.0-20170929234023-d6e3b3328b78 // indirect
+	github.com/Microsoft/go-winio v0.4.14 // indirect
 	github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5 // indirect
-	github.com/containerd/continuity v0.0.0-20190426062206-aaeac12a7ffc // indirect
 	github.com/docker/distribution v2.7.1+incompatible // indirect
 	github.com/docker/docker v1.13.1
 	github.com/docker/go-connections v0.4.0 // indirect
 	github.com/docker/go-units v0.4.0 // indirect
 	github.com/dsnet/compress v0.0.1 // indirect
 	github.com/fatih/color v1.7.0
-	github.com/gobuffalo/flect v0.1.3 // indirect
+	github.com/gobuffalo/envy v1.8.1 // indirect
+	github.com/gobuffalo/logger v1.0.3 // indirect
+	github.com/gobuffalo/packr/v2 v2.7.1
 	github.com/gogo/protobuf v1.2.1 // indirect
 	github.com/golang/snappy v0.0.1 // indirect
 	github.com/gorilla/mux v1.7.2 // indirect
-	github.com/keegancsmith/rpc v1.1.0 // indirect
-	github.com/konsorten/go-windows-terminal-sequences v1.0.2 // indirect
-	github.com/koron/iferr v0.0.0-20180615142939-bb332a3b1d91 // indirect
-	github.com/kr/pty v1.1.4 // indirect
 	github.com/l50/goutils v0.0.0-20190618185127-76c085e83296
 	github.com/mattn/go-colorable v0.1.1 // indirect
 	github.com/mattn/go-isatty v0.0.7 // indirect
 	github.com/mholt/archiver v3.1.1+incompatible
-	github.com/moby/moby v1.13.1
 	github.com/nwaples/rardecode v1.0.0 // indirect
 	github.com/opencontainers/go-digest v1.0.0-rc1 // indirect
 	github.com/opencontainers/image-spec v1.0.1 // indirect
-	github.com/opencontainers/runc v0.1.1 // indirect
 	github.com/pierrec/lz4 v2.0.5+incompatible // indirect
-	github.com/spf13/pflag v1.0.3 // indirect
-	github.com/stamblerre/gocode v0.0.0-20190327203809-810592086997 // indirect
-	github.com/stretchr/objx v0.2.0 // indirect
+	github.com/rogpeppe/go-internal v1.5.0 // indirect
 	github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 // indirect
+	golang.org/x/crypto v0.0.0-20191128160524-b544559bb6d1 // indirect
+	golang.org/x/sys v0.0.0-20191128015809-6d18c012aee9 // indirect
 	golang.org/x/time v0.0.0-20190308202827-9d24e82272b4 // indirect
-	golang.org/x/tools v0.0.0-20190418235243-4796d4bd3df0 // indirect
 	google.golang.org/grpc v1.21.1 // indirect
 	gopkg.in/src-d/go-git.v4 v4.12.0 // indirect
 	gotest.tools v2.2.0+incompatible // indirect
 )
 
 replace github.com/docker/docker => github.com/docker/engine v0.0.0-20190423201726-d2cfbce3f3b0
+
+go 1.13