Changeset 1008

Timestamp:

11/16/07 16:20:26 (10 months ago)

Author:

kindlund

Message:

Merging kindlund-dynamic_updates branch back into trunk.

Files:

• honeyclient/trunk/bin/StartAgent.pl (modified) (1 diff)
• honeyclient/trunk/bin/StartManager.pl (modified) (3 diffs)
• honeyclient/trunk/etc/honeyclient.xml (modified) (6 diffs)
• honeyclient/trunk/etc/honeyclient_log.conf (modified) (1 diff)
• honeyclient/trunk/lib/HoneyClient/Agent.pm (modified) (5 diffs)
• honeyclient/trunk/lib/HoneyClient/Agent/Driver/Browser.pm (modified) (3 diffs)
• honeyclient/trunk/lib/HoneyClient/Agent/Integrity.pm (modified) (18 diffs)
• honeyclient/trunk/lib/HoneyClient/Agent/Integrity/Filesystem.pm (modified) (5 diffs)
• honeyclient/trunk/lib/HoneyClient/Agent/Integrity/Registry.pm (modified) (9 diffs)
• honeyclient/trunk/lib/HoneyClient/Manager.pm (modified) (32 diffs)
• honeyclient/trunk/lib/HoneyClient/Manager/FW.pm (modified) (1 diff)
• honeyclient/trunk/lib/HoneyClient/Manager/VM.pm (modified) (40 diffs)
• honeyclient/trunk/lib/HoneyClient/Manager/VM/Clone.pm (modified) (17 diffs)
• honeyclient/trunk/lib/HoneyClient/Util/Config.pm (modified) (4 diffs)
• honeyclient/trunk/t/honeyclient_agent_integrity.t (modified) (2 diffs)
• honeyclient/trunk/t/honeyclient_agent_integrity_filesystem.t (modified) (2 diffs)
• honeyclient/trunk/t/honeyclient_agent_integrity_registry.t (modified) (4 diffs)
• honeyclient/trunk/t/honeyclient_manager.t (modified) (4 diffs)
• honeyclient/trunk/t/honeyclient_manager_fw.t (modified) (1 diff)
• honeyclient/trunk/t/honeyclient_manager_vm.t (modified) (21 diffs)
• honeyclient/trunk/t/honeyclient_manager_vm_clone.t (modified) (7 diffs)
• honeyclient/trunk/t/test_vm/nvram (modified) (previous)
• honeyclient/trunk/t/test_vm/winXPPro.vmx (modified) (1 diff)

honeyclient/trunk/bin/StartAgent.pl

@@ -60 +60 @@
-    $URL = HoneyClient::Agent->init();
-
+    # Recreate a new stub handle, in case the global configuration has
+    # changed.
+    $stub = getClientHandle(address   => 'localhost',
+                            namespace => 'HoneyClient::Agent',
+                            fault_handler => \&_watchdogFaultHandler);
+
-    # Restore state information.
-
+
+
+
-}
-

honeyclient/trunk/bin/StartManager.pl

@@ -7 +7 @@
-use Carp ();
-
+# Include Dumper Library
-use Data::Dumper;
-
@@ -18 +19 @@
-use Getopt::Long;
-
+# Include utility access to global configuration.
+use HoneyClient::Util::Config qw(getVar);
+
+# Include Manager Library
-use HoneyClient::Manager;
-
+# Include Logging Library
+use Log::Log4perl qw(:easy);
+
+# The global logging object.
+our $LOG = get_logger();
+
-# We expect that the user will supply a single argument to this script.
-
-
+
-
-# Change to 'HoneyClient::Agent::Driver::Browser::IE' or
-#           'HoneyClient::Agent::Driver::Browser::FF'
-"HoneyClient::Agent::Driver::Browser::IE"
+undef
-my $config = undef;
-5
+undef
-my $nexturl = "";
-my $urllist= "";
@@ -38 +48 @@
-           'url_list=s'           => \$urllist,
-           'max_relative_links:i' => \$maxrel);
+
+# Sanity Check.  Make sure $driver is set.
+unless (defined($driver)) {
+    $driver = getVar(name      => "default_driver",
+                     namespace => "HoneyClient::Agent");
+}
+
+# Sanity Check.  Make sure $max_relative_links is set.
+unless (defined($maxrel)) {
+    $maxrel = getVar(name      => "max_relative_links_to_visit",
+                     namespace => "HoneyClient::Agent::Driver::Browser");
+}
-
-# Go through the list of urls to create the array

honeyclient/trunk/etc/honeyclient.xml

@@ -72 +72 @@
-            <name>HoneyClient::Agent::Driver::Browser::FF</name>
-        </allowed_drivers>
+        <default_driver description="If no driver is manually specified, then this Driver will be used as the default by the Agent." default="HoneyClient::Agent::Driver::Browser::IE">
+            HoneyClient::Agent::Driver::Browser::IE
+        </default_driver>
-        <!-- HoneyClient::Agent::Driver Options -->
-        <Driver>
@@ -94 +97 @@
-                    1
-                </ignore_links_timed_out>
-                <!-- TODO: Update this. -->
-                <process_name description="The name of the Internet Explorer application process, as it appears in the Task Manager." default="iexplore.exe">
-                    iexplore.exe
-                </process_name>
-                <max_relative_links_to_visit description="An integer, representing the maximum number of relative links that the browser should visit, before moving onto another website.  If negative, then the browser will exhaust all possible relative links found, before moving on.  This functionality is best effort; it's possible for the browser to visit new links on previously visited websites." default="-1">
--1
+5
-                </max_relative_links_to_visit>
-                <positive_words description="If a link contains any number of these words, then its probability of being visited (its score) will increase.">
@@ -123 +122 @@
-                    <word>jobs</word>
-                    <word>careers</word>
+                    <word>term</word>
-                </negative_words>
-                <IE>
@@ -155 +155 @@
-            </changes_found_file>
-            <realtime_changes_file description="When an integrity check fails, all changes will be written to this file within the compromized honeyclient VM's filesystem." default="/tmp/realtime-changes.txt">
-
+    
-            </realtime_changes_file>
-            <!-- HoneyClient::Agent::Integrity::Filesystem Options -->
@@ -329 +329 @@
-    <DB>
-        <enable description="Enables database operations. 1 enables, 0 disables." default="0">
-1
+0
-        </enable>
-        <host description="The system providing the HoneyClient database.  If the database is installed on the same host system as the Manager, then localhost should be used." default="127.0.0.1">
@@ -349 +349 @@
-    <Manager>
-        <!-- TODO: Update this. -->
-save
+append
-            Manager.dump
-        </manager_state>
+        <compromise_dump description="When the Manager encounters a compromised VM, it will attempt to append a complete copy of the compromised information to this file, if specified.">
+            Compromise.dump
+        </compromise_dump>
-        <!-- TODO: Update this. -->
-        <address description="The IP or hostname that all Manager modules should use, when accepting SOAP requests." default="localhost">

honeyclient/trunk/etc/honeyclient_log.conf

@@ -65 +65 @@
-#log4perl.logger.HoneyClient.Manager=INFO, Screen, Syslog
-#log4perl.logger.HoneyClient.DB=DEBUG, Screen, Syslog
+#log4perl.logger.HoneyClient.Manager.VM.Clone=DEBUG, Screen
-# Suppress Parser Debugging Messages
-#log4perl.logger.HoneyClient.Agent.Integrity.Registry.Parser=INFO, Screen

honeyclient/trunk/lib/HoneyClient/Agent.pm

@@ -346 +346 @@
-        Carp::croak "Error: " . __PACKAGE__ . " daemon is already running (PID = $DAEMON_PID)!\n";
-    }
+
+    # Reinitialize global constants (for dynamic updates).
+    $PERFORM_INTEGRITY_CHECKS = getVar(name => "perform_integrity_checks");
-
-    # Figure out what our list of allowed Drivers are. 
@@ -896 +899 @@
-        my $driverTargetsChanged = 0;
-
+        # Boolean to indicate that the driver has been compromised.
+        my $isCompromised = 0;
+
+        # Variable to hold any changes found in a compromise.
+        my $changes = undef;
+
-        while (!$driver->isFinished() && !$driverTargetsChanged) {
-            # XXX: Debug.  Remove this.
@@ -907 +916 @@
-            # If the operation fails, then an exception will be generated.
-            $driver->drive();
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-            # Acquire lock on stored driver state.
-            $data = _lock();
@@ -928 +960 @@
-            $data->{$driverName}->{'next'} = $driver->next();
-            $data->{$driverName}->{'status'} = $driver->status();
-0
+$isCompromised
-            $data->{$driverName}->{'status'}->{'is_running'} = 1;
-            $data->{$driverName}->{'state'} = $driver;
@@ -935 +967 @@
-            _unlock($data);
-        }
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-        # Release our copy of the integrity object, but do not destroy 
-        # any internal references.

honeyclient/trunk/lib/HoneyClient/Agent/Driver/Browser.pm

@@ -438 +438 @@
-
-=cut
-
-my %PARAMS = (
-
-    # This is a hashtable of fully qualified URLs
-    # to visit by the browser.  Specifically, the 'key' is
-    # the absolute URL and the 'value' is always 1.
-    links_to_visit          => { },
-
-    # This is a hashtable of fully qualified URLs that the
-    # browser has already visited.  Specifically, the
-    # 'key' is the absolute URL and the 'value' is a string
-    # representing the date and time of when the link was visited.
-    #
-    # Note: See _getTimestamp() for the corresponding date/time
-    # format.
-    links_visited           => { },
-
-    # This is a hashtable of URLs that the browser has found
-    # during its traversal process, but the browser could not
-    # access the link.
-    #
-    # Links could be added to this list if access requires any type of
-    # authentication, or if the link points to a non-HTTP or HTTPS
-    # resource (i.e., "javascript:doNetDetect()").
-    #
-    # The 'key' is the absolute URL and the 'value' is a string
-    # representing the date and time of when the link was visited.
-    #
-    # Note: See _getTimestamp() for the corresponding date/time
-    # format.
-    links_ignored           => { },
-
-    # This is a hashtable of fully qualified URLs
-    # that all share a common *hostname*.  This hashtable should be
-    # initially empty.  As the driver extracts and removes new URLs
-    # off the 'links_to_visit' hashtable, driving the browser to each URL,
-    # any *relative* links found are added into this hashtable; any
-    # *external* links found are added back into the 'links_to_visit'
-    # hashtable.
-    #
-    # When navigating to the next link, this hashtable is exhausted prior
-    # to the main 'links_to_visit' hashtable.  This allows a
-    # browser to navigate to all links hosted on the same server, prior
-    # to contacting a different server.
-    #
-    # Specifically, the 'key' is the absolute URL and the 'value'
-    # is always 1.
-    relative_links_to_visit => { },
-
-    # This is a scalar that contains the next URL to visit.
-    # It is updated dynamically, any time getNextLink() is called.
-    # When the browser is ready to drive to the next link,
-    # 'next_link_to_visit' is checked.  If that value is undef, then
-    # the 'relative_links_to_visit' hashtable is checked next.
-    # If that hashtable is empty, then finally the 'links_to_visit'
-    # hashtable is checked.
-    next_link_to_visit      => undef,
-
-    # This is a hashtable of URLs that the browser has found
-    # during its traversal process, but the browser could not
-    # access the resource due to the operation timing out.
-    #
-    # The 'key' is the absolute URL and the 'value' is a string
-    # representing the date and time of when the link was visited.
-    #
-    # Note: See _getTimestamp() for the corresponding date/time
-    # format.
-    links_timed_out         => { },
-
-    # If this parameter is a defined scalar, then the browser
-    # will also never attempt to revisit any links that caused
-    # the browser to time out.
-    ignore_links_timed_out  => getVar(name => "ignore_links_timed_out"),
-
-    # A string containing the process name of the browser application,
-    # as it appears in the Task Manager.
-    process_name            => getVar(name => "process_name"),
-
-    # An integer, representing how many relative links the browser
-    # should continue to drive to, before moving onto another
-    # website.  If negative, then the browser will exhaust all possible
-    # relative links, before moving on.  (This internal variable should
-    # never be modified externally.)
-    _remaining_number_of_relative_links_to_visit => getVar(name => "max_relative_links_to_visit"),
-
-    # An integer, representing the maximum number of relative links that
-    # the browser should visit, before moving onto another website.  If
-    # negative, then the browser will exhaust all possible relative links
-    # found, before moving on.  This functionality is best effort; it's
-    # possible for the browser to visit new links on previously visited
-    # websites.
-    max_relative_links_to_visit => getVar(name => "max_relative_links_to_visit"),
-
-    # An array of positive words, where a link's probability of being
-    # visited (its score) will increase, if the link contains any of these
-    # words.
-    positive_words => getVar(name => "positive_words")->{word},
-
-    # An array of negative words, where a link's probability of being
-    # visited (its score) will decrease, if the link contains any of these
-    # words.
-    negative_words => getVar(name => "negative_words")->{word},
-
-    # If set to 1, then the code will attempt to parse and extract links
-    # within active content (e.g., Flash animations).  Otherwise, the
-    # code will ignore all active content. 
-    parse_active_content => getVar(name      => "enable",
-                                   namespace => "HoneyClient::Agent::Driver::ActiveContent"),
-);
-
-#######################################################################
@@ -907 +798 @@
-    #
-    # - For each parameter given, it overwrites any corresponding
-PARAMS
+params
-    #   with custom entries that were given as parameters.
-    #
@@ -926 +817 @@
-
-    # Initialize default parameters.
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-    $self = $class->SUPER::new();
-    @{$self}{keys %params} = values %params;

honeyclient/trunk/lib/HoneyClient/Agent/Integrity.pm

@@ -61 +61 @@
-  }
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-a list exported by the Capture C code. However, in the future it may become 
-israble to perform an initial baseline of the system
-
+sirable to perform an initial baseline of the system,
+ 
-mechanisms that Capture code uses to record events, may in some cases be unable
-
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-=cut
@@ -250 +273 @@
-=back
-
+=head2 changes_found_file
+
+A string to the absolute path of a file on the VM's filesystem.
+When an integrity check fails, all changes will be written to this
+file within the compromized honeyclient VM's filesystem.
+
+=back
+
-=cut
-
-my %PARAMS = (
-    # When set to 1, the object will forgo any type of initial baselining
-    # process, upon initialization.  Otherwise, baselining will occur
-    # as normal, upon initialization.
-    # XXX: Bypass static baselining, for now.
-    # XXX: Baselining will not be used with the current version which includes Capture
-    bypass_baseline => 1,
-
-    # Contains the Registry object, once initialized.
-    # (For internal use only.)
-    _registry => undef,
-
-    # Contains the Filesystem object, once initialized.
-    # (For internal use only.)
-    _filesystem => undef,
-
-    # XXX: comment this
-    _changes_found_file => getVar(name => 'changes_found_file'),
-
-    # XXX: comment this
-    _realtime_changes_file => getVar(name => 'realtime_changes_file'),
-
-);
-
-#######################################################################
@@ -289 +296 @@
-    # the Registry object creates new files that must exist to be added to the
-    # Filesystem's baseline list of files that exist on the system.
-   
+    
-    $self->{'_filesystem'} = HoneyClient::Agent::Integrity::Filesystem->new();
-}
@@ -334 +341 @@
-diag("Performing baseline check of the system; this may take some time...");
-
-# XXX: Uncomment this next check, eventually.  (It's commented out right now, in order to save some time).
-# Perform baseline.
-$integrity = HoneyClient::Agent::Integrity->new();
-isa_ok($integrity, 'HoneyClient::Agent::Integrity', "new()") or diag("The new() call failed.");
+$integrity->destroy();
-
-=end testing
@@ -349 +356 @@
-    #
-    # - For each parameter given, it overwrites any corresponding
-PARAMS
+params
-    #   with custom entries that were given as parameters.
-    #
@@ -369 +376 @@
-    # Initialize default parameters.
-    $self = { };
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-    @{$self}{keys %params} = values %params;
-
@@ -404 +435 @@
-hashtable has the following format:
-
-
+  
-    #A reference to an anonymous array of process objects
-    processes => [ {
@@ -456 +487 @@
-        file_system => [ {
-            #The full path and name of the file which was effected
-       
+        
-
-            'event_type' => { Deleted | Read | Write }, #TODO: add created & renamed/moved
-
-            'time' => ISO 8601 Timestamp, 
-       
+        
-            #OPTIONAL, this will not exist for deleted files
-       
-       
-       
-       
-       
-       
+        
+        
+        
+        
+        
+        
-        },]
-    },]
-
+  
-
-I<Notes>:
-
-=back
-
-#=begin testing
-#
-# TODO:
-#
-#=end testing
-
-=cut
@@ -506 +531 @@
-    });
-
-  
+    
-#        'registry' => $self->{'_registry'}->check(),
-#        'filesystem' => $self->{'_filesystem'}->check(),
-#    };
-#XENO - BEGIN REPLACEMENT WITH CAPTURE-READING CODE
-_
+
-    my %changes;
-    my @capdump;
@@ -670 +695 @@
-                        };
-                        my $tmp_name = $toks[$F_NAME];
-   
+    
-                            if(-f $tmp_name){
-                                my $md5_ctx  = Digest::MD5->new();
@@ -680 +705 @@
-                                my $size = 0;
-                                my $fh = IO::File->new($tmp_name, "r");
-   
-   
-   
-   
-
-   
-   
-
-   
-   
-   
-   
-   
-   
-   
-   
-   
-   
-   
-   
-   
+    
+    
+    
+    
+
+    
+    
+
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
-                                $file_obj->{'contents'}->{'size'} = $size;
-                                $file_obj->{'contents'}->{'md5'} = $md5;
@@ -738 +763 @@
-    # filesystem.
-    if (scalar($changes{'processes'})){
-_
-_
+
+
-        } else {
-            $Data::Dumper::Terse = 1;
@@ -749 +774 @@
-    }
-
-   
+    
-}
-
+# TODO: Comment this.
-# This function looks for if there is already a process object with the given pid and name
-# and if it exists, returns its index in the processes array
@@ -777 +803 @@
-}
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-sub closeFiles {
-    my $self = shift;
@@ -796 +833 @@
-}
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-sub destroy {
-    my $self = shift;
@@ -819 +870 @@
-=head1 BUGS & ASSUMPTIONS
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-=head1 SEE ALSO
@@ -833 +923 @@
-=head1 ACKNOWLEDGEMENTS
-
-
-
+
+
+
+
+
+
-
-=head1 AUTHORS
@@ -845 +939 @@
-
-Brad Stephenson, E<lt>stephenson@mitre.orgE<gt>
-
-Thanh Truong, E<lt>ttruong@mitre.orgE<gt>
-
-=head1 COPYRIGHT & LICENSE

honeyclient/trunk/lib/HoneyClient/Agent/Integrity/Filesystem.pm

@@ -175 +175 @@
-=begin testing
-
+# Make sure ExtUtils::MakeMaker loads.
+BEGIN { use_ok('ExtUtils::MakeMaker', qw(prompt)) or diag("Can't load ExtUtils::MakeMaker package.  Check to make sure the package library is correctly listed within the path."); }
+require_ok('ExtUtils::MakeMaker');
+can_ok('ExtUtils::MakeMaker', 'prompt');
+use ExtUtils::MakeMaker qw(prompt);
+
-# Make sure Log::Log4perl loads
-BEGIN { use_ok('Log::Log4perl', qw(:nowarn))
@@ -358 +364 @@
-
-=cut
-
-my %PARAMS = (
-    # When set to 1, the object will forgo any type of initial baselining
-    # process, upon initialization.  Otherwise, baselining will occur