v3.2.18-rc10

UI bug fixes and agent_type support added in
its-a-feature · Mar 5, 2024 · 2970729 · 2970729
1 parent 287e959
commit 2970729
Show file tree

Hide file tree

Showing 23 changed files with 279 additions and 164 deletions.
diff --git a/CHANGELOG.MD b/CHANGELOG.MD
@@ -4,6 +4,14 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.2.18-rc10] - 2024-03-04
+
+### Changed
+
+- Updated SOCKS/rpfwd traffic to not double send close connection messages to the agent
+- Added "AgentType" field to "PayloadType" database table
+- Updated SOCKS initial connection to accept more bytes in case client supports many auth mechanisms
+
 ## [3.2.18-rc9] - 2024-02-28
 
 ### Changed

diff --git a/MythicReactUI/CHANGELOG.MD b/MythicReactUI/CHANGELOG.MD
@@ -4,6 +4,14 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.1.77] - 2024-03-04
+
+### Changed
+
+- Fixed the download link color when generating payloads to match normal text colors
+- Updated processes browser to help address pid-reuse and cyclic references based on old PID values
+- Updated checks in callback table for 3rd party service agents
+
 ## [0.1.75-76] - 2024-02-29
 
 ### Changed

diff --git a/MythicReactUI/src/components/MythicComponents/MythicTag.js b/MythicReactUI/src/components/MythicComponents/MythicTag.js
@@ -11,7 +11,6 @@ import TableBody from '@mui/material/TableBody';
 import TableCell from '@mui/material/TableCell';
 import TableContainer from '@mui/material/TableContainer';
 import TableRow from '@mui/material/TableRow';
-import Paper from '@mui/material/Paper';
 import AceEditor from 'react-ace';
 import 'ace-builds/src-noconflict/mode-json';
 import 'ace-builds/src-noconflict/theme-monokai';
@@ -97,7 +96,7 @@ query getSingleTag($tag_id: Int!){
 `
 export const TagsDisplay = ({tags}) => {
   return (
-      tags.map( tt => (
+      tags?.map( tt => (
           <TagChipDisplay tag={tt} key={tt.id} />
         ))
   )

diff --git a/MythicReactUI/src/components/pages/Callbacks/CallbacksTableRow.js b/MythicReactUI/src/components/pages/Callbacks/CallbacksTableRow.js
@@ -33,7 +33,7 @@ import LockOpenIcon from '@mui/icons-material/LockOpen';
 import EditIcon from '@mui/icons-material/Edit';
 import OpenInNewIcon from '@mui/icons-material/OpenInNew';
 import { FontAwesomeIcon } from '@fortawesome/react-fontawesome'
-import {faQuestion, faSkullCrossbones, faFolderOpen, faList} from '@fortawesome/free-solid-svg-icons';
+import {faQuestion, faSkullCrossbones, faFolderOpen, faList, faRobot} from '@fortawesome/free-solid-svg-icons';
 import {faLinux, faApple, faWindows, faChrome, faAndroid} from '@fortawesome/free-brands-svg-icons';
 import {DetailedCallbackTable} from './DetailedCallbackTable';
 import InfoIcon from '@mui/icons-material/Info';
@@ -368,6 +368,9 @@ export const CallbacksTableLastCheckinCell = React.memo( ({rowData, cellData}) =
         }
         return newTime;
     }
+    if(rowData?.payload?.payloadtype?.agent_type !== "agent"){
+        return "Streaming Now..."
+    }
     return (
         <div>
                 <Moment filter={adjustOutput} interval={500} parse={"YYYY-MM-DDTHH:mm:ss.SSSSSSZ"}
@@ -550,6 +553,9 @@ export const CallbacksTableC2Cell = React.memo(({rowData}) => {
             setLocalRowData(rowData);
         }
     }, [rowData]);
+    if(rowData?.payload?.payloadtype?.agent_type !== "agent"){
+        return null
+    }
     return (
         <div>
             {hasEgressRoute ? 
@@ -581,6 +587,9 @@ export const CallbacksTableC2Cell = React.memo(({rowData}) => {
 export const CallbacksTableOSCell = React.memo( ({rowData, cellData}) => {
     const [openOSDialog, setOpenOSDialog] = React.useState(false);
     const getOSIcon = useCallback( () => {
+        if(rowData?.payload?.payloadtype?.agent_type !== "agent"){
+            return <FontAwesomeIcon icon={faRobot} size="2x" style={{cursor: "pointer"}} onClick={displayOSInfo} />
+        }
         switch(rowData.payload.os.toLowerCase()){
             case "windows":
                 return <FontAwesomeIcon icon={faWindows} size="2x" style={{cursor: "pointer"}} onClick={displayOSInfo} />
@@ -632,6 +641,9 @@ export const CallbacksTableSleepCell = React.memo( ({rowData, cellData, updateSl
         event.stopPropagation();
         setOpenSleepDialog(true);
     }
+    if(rowData?.payload?.payloadtype?.agent_type !== "agent"){
+        return null
+    }
     return (
         <div>
             <SnoozeIcon onClick={onOpenSleepDialog} 

diff --git a/MythicReactUI/src/components/pages/Callbacks/CallbacksTabsProcessBrowser.js b/MythicReactUI/src/components/pages/Callbacks/CallbacksTabsProcessBrowser.js
@@ -69,12 +69,12 @@ const treeSubscription = gql`
 const rootQuery = gql`
     ${treeFragment}
     query myRootFolderQuery($operation_id: Int!) {
-        mythictree(where: { operation_id: { _eq: $operation_id }, tree_type: {_eq: "process"} }) {
+        mythictree(where: { operation_id: { _eq: $operation_id }, tree_type: {_eq: "process"} }, order_by: {id: asc}) {
             ...treeObjData
         }
     }
 `;
-
+export const uniqueSplitString = "$&%^";
 export function CallbacksTabsProcessBrowserLabel(props){
     const [description, setDescription] = React.useState("Processes: " + props.tabInfo.displayID)
     const [openEditDescriptionDialog, setOpenEditDescriptionDialog] = React.useState(false);
@@ -140,7 +140,7 @@ export const CallbacksTabsProcessBrowserPanel = ({index, value, tabInfo, me}) =>
                         // new host discovered
                         treeRootDataRef.current[currentGroups[j]][data.mythictree[i]["host"]] = {};
                     }
-                    treeRootDataRef.current[currentGroups[j]][data.mythictree[i]["host"]][data.mythictree[i]["full_path_text"]] = {...data.mythictree[i]}
+                    treeRootDataRef.current[currentGroups[j]][data.mythictree[i]["host"]][data.mythictree[i]["full_path_text"] /*+ uniqueSplitString + data.mythictree[i]["callback_id"]*/] = {...data.mythictree[i]}
                 }
             }
             // create the top level data in the adjacency matrix
@@ -154,11 +154,18 @@ export const CallbacksTabsProcessBrowserPanel = ({index, value, tabInfo, me}) =>
                         // the current host isn't tracked in the adjacency matrix, so add it
                         prev[currentGroups[j]][cur["host"]] = {}
                     }
-                    if (prev[currentGroups[j]][cur["host"]][cur["parent_path_text"]] === undefined) {
+                    if(cur["parent_path_text"] === ""){
+                        if(prev[currentGroups[j]][cur['host']][""] === undefined){
+                            prev[currentGroups[j]][cur['host']][""] = {}
+                        }
+                        prev[currentGroups[j]][cur['host']][""][cur["full_path_text"] /*+ uniqueSplitString + cur["callback_id"]*/] = 1;
+                        continue
+                    }
+                    if (prev[currentGroups[j]][cur["host"]][cur["parent_path_text"] /*+ uniqueSplitString + cur["callback_id"]*/] === undefined) {
                         // the current parent's path isn't tracked, so add it and ourselves as children
-                        prev[currentGroups[j]][cur["host"]][cur["parent_path_text"]] = {};
+                        prev[currentGroups[j]][cur["host"]][cur["parent_path_text"] /*+ uniqueSplitString + cur["callback_id"]*/] = {};
                     }
-                    prev[currentGroups[j]][cur["host"]][cur["parent_path_text"]][cur["full_path_text"]] = 1;
+                    prev[currentGroups[j]][cur["host"]][cur["parent_path_text"] /*+ uniqueSplitString + cur["callback_id"]*/][cur["full_path_text"] /*+ uniqueSplitString + cur["callback_id"]*/] = 1;
                 }
                 return prev;
             }, {...treeAdjMtx});
@@ -199,7 +206,7 @@ export const CallbacksTabsProcessBrowserPanel = ({index, value, tabInfo, me}) =>
                         // new host discovered
                         treeRootDataRef.current[currentGroups[j]][data.data.mythictree_stream[i]["host"]] = {};
                     }
-                    treeRootDataRef.current[currentGroups[j]][data.data.mythictree_stream[i]["host"]][data.data.mythictree_stream[i]["full_path_text"]] = {...data.data.mythictree_stream[i]};
+                    treeRootDataRef.current[currentGroups[j]][data.data.mythictree_stream[i]["host"]][data.data.mythictree_stream[i]["full_path_text"] /*+ uniqueSplitString + data.data.mythictree_stream[i]["callback_id"]*/] = {...data.data.mythictree_stream[i]};
                 }
             }
             const newMatrix = data.data.mythictree_stream.reduce( (prev, cur) => {
@@ -212,11 +219,18 @@ export const CallbacksTabsProcessBrowserPanel = ({index, value, tabInfo, me}) =>
                         // the current host isn't tracked in the adjacency matrix, so add it
                         prev[currentGroups[j]][cur["host"]] = {}
                     }
-                    if (prev[currentGroups[j]][cur["host"]][cur["parent_path_text"]] === undefined) {
+                    if(cur["parent_path_text"] === ""){
+                        if(prev[currentGroups[j]][cur['host']][""] === undefined){
+                            prev[currentGroups[j]][cur['host']][""] = {}
+                        }
+                        prev[currentGroups[j]][cur['host']][""][cur["full_path_text"] /*+ uniqueSplitString + cur["callback_id"]*/] = 1;
+                        continue
+                    }
+                    if (prev[currentGroups[j]][cur["host"]][cur["parent_path_text"] /*+ uniqueSplitString + cur["callback_id"]*/] === undefined) {
                         // the current parent's path isn't tracked, so add it and ourselves as children
-                        prev[currentGroups[j]][cur["host"]][cur["parent_path_text"]] = {};
+                        prev[currentGroups[j]][cur["host"]][cur["parent_path_text"] /*+ uniqueSplitString + cur["callback_id"]*/] = {};
                     }
-                    prev[currentGroups[j]][cur["host"]][cur["parent_path_text"]][cur["full_path_text"]] = 1;
+                    prev[currentGroups[j]][cur["host"]][cur["parent_path_text"] /*+ uniqueSplitString + cur["callback_id"]*/][cur["full_path_text"] /*+ uniqueSplitString + cur["callback_id"]*/] = 1;
                 }
                 return prev;
             }, {...treeAdjMtx});
@@ -244,7 +258,6 @@ export const CallbacksTabsProcessBrowserPanel = ({index, value, tabInfo, me}) =>
     const updateSelectedGroup = (group) => {
         setSelectedGroup(group);
         const hosts = Object.keys(treeAdjMtx[group]);
-        console.log("updated selected group, new hosts", hosts);
         if(hosts.length > 0){
             setSelectedHost(hosts[0]);
         } else {