It seems that agents run on hadoop-2 do not always shut down properly. Sometimes it doesn't send an AgentShutdownEvent and the Island needs to mark it as stopped when it starts receiving heartbeats
This is an intermittent behavior, so you may need to run a few times or vary when you hit the stop button in order to observe the behavior. It may also affect machines other than hadoop-2; a thorough log analysis is required.
{
"metadata": {
"encrypted": false
},
"configuration": {
"keep_tunnel_open_time": 20,
"credential_collectors": [
{
"name": "MimikatzCollector",
"options": {}
},
{
"name": "SSHCollector",
"options": {}
}
],
"payloads": [
{
"name": "ransomware",
"options": {
"encryption": {
"enabled": true,
"file_extension": ".m0nk3y",
"directories": {
"linux_target_dir": "",
"windows_target_dir": ""
}
},
"other_behaviors": {
"readme": true
}
}
}
],
"propagation": {
"maximum_depth": 3,
"network_scan": {
"tcp": {
"timeout": 0.8,
"ports": [
22,
80,
135,
443,
445,
2222,
3306,
3389,
5985,
5986,
7001,
8008,
8080,
8088,
8983,
9600
]
},
"icmp": {
"timeout": 1
},
"fingerprinters": [
{
"name": "http",
"options": {}
},
{
"name": "ssh",
"options": {}
}
],
"targets": {
"blocked_ips": [],
"inaccessible_subnets": [],
"scan_my_networks": false,
"subnets": [
"10.2.2.9",
"10.2.1.10",
"10.2.0.10",
"10.2.0.11",
"10.2.0.12",
"10.2.3.14",
"10.2.4.15",
"10.2.5.16",
"10.2.2.0-10.2.2.32",
"10.2.3.30-10.2.3.56"
]
}
},
"exploitation": {
"options": {
"http_ports": [
80,
443,
7001,
8008,
8080,
8983,
9600
]
},
"brute_force": [
{
"name": "SSHExploiter",
"options": {}
},
{
"name": "WmiExploiter",
"options": {
"smb_download_timeout": 30
}
}
],
"vulnerability": [
{
"name": "Log4ShellExploiter",
"options": {}
},
{
"name": "HadoopExploiter",
"options": {}
}
]
},
"general": {
"maximum_depth": 3
}
},
"advanced": {
"keep_tunnel_open_time": 20
}
},
"credentials": {
"exploit_user_list": [
"m0nk3y"
],
"exploit_password_list": [
"3Q=(Ge(+&w]*",
"`))jU7L(w}",
"t67TC5ZDmz",
"u26gbVQe",
"5BuYHeVl"
],
"exploit_lm_hash_list": [],
"exploit_ntlm_hash_list": [
"d0f0132b308a0c4e5d1029cc06f48692",
"5da0889ea2081aa79f6852294cba4a5e",
"50c9987a6bf1ac59398df9f911122c9b"
],
"exploit_ssh_keys": []
}
}
Describe the bug
It seems that agents run on hadoop-2 do not always shut down properly. Sometimes it doesn't send an
AgentShutdownEventand the Island needs to mark it as stopped when it starts receiving heartbeatsTo Reproduce
Steps to reproduce the behavior:
kill button. You may want to try waiting more or less time before hitting the kill buttonNote
This is an intermittent behavior, so you may need to run a few times or vary when you hit the stop button in order to observe the behavior. It may also affect machines other than hadoop-2; a thorough log analysis is required.
Configuration
Tasks remaining
SIGTERM. Verify that the agent shuts itself down cleanlySIGTERMSIGTERMand/orSIGKILL