center-for-threat-informed-defense / caldera_pathfinder

Pathfinder is a plugin for mapping network vulnerabilities, scanned by CALDERA or imported by a supported network scanner, and translating those scans into adversaries for network traversal.

MITRE Caldera™ Plugin: Pathfinder

Overview

Pathfinder is a Caldera plugin developed by the Center for Threat-Informed Defense. Pathfinder extends Caldera's functionality to support automated ingestion of network scanning tool output. By intelligently integrating scan data with an automated adversary emulation platform, Pathfinder will demonstrate how an adversary might use vulnerabilities in an environment to achieve their goals, highlighting a path through a network, and showing the real impact of a vulnerability for Caldera to analyze and execute against.

Pathfinder extends Caldera to do the following:

1. Run a scan of a target network or system
2. Upload the scan results to a running instance of Caldera
3. Use the ingested results to draw out potential attack paths Caldera could notionally take
4. Create workflows so that Caldera can follow the actual attack paths and execute a real attack

More information is provided under docs

Tutorial Video

Screenshot

map vulnerabilities. plan attacks.

Getting Started

If you want to run scans with nmap directly with the pathfinder plugin make sure to install nmap on your system

Install Caldera (if you don't have it already) and clone down the pathfinder repo into the caldera/plugins folder with this command:

git clone https://github.com/center-for-threat-informed-defense/caldera_pathfinder.git pathfinder --recursive

Go into plugins/pathfinder and run pip install -r requirements.txt to install dependencies, and note that you should have nmap installed already.

After that add pathfinder to enabled plugins list in the caldera conf file for your environment and you are set to start scanning and path finding!

Questions and Feedback

Please submit issues for any technical questions/concerns or contact [email protected] directly for more general inquiries.

Also see the guidance for contributors if are interested in contributing.

Liability / Responsible Usage

This content is only to be used with appropriate prior, explicit authorization for the purposes of assessing security posture and/or research.

Notice

Copyright 2020 MITRE Engenuity. Approved for public release. Document number CT0007

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

caldera_pathfinder's Issues

Issue with download report function onclick="downloadReport()" (pathfinder)

After update, Pathfinder appears to function and work however, after running nmap scan and going to reports, the downloadReport function does not work. caldera was also updated with a git pull. everything else functions as supposed to. Values may not be passed to function properly. Still in the process of tracking the problem down.

Run recon scan as part of an operation

Hi Guys,

I just stumbled upon this, you guys have done some serious work here. Thanks for sharing it 🤗.
My question though is whether there is anything in the roadmap to be able to run the initial scan as part of an operation. As far as I understood the nmap scan is done directly from the CALDERA server which limits the visibility over the target network, considering your CALDERA server is not in the same subnet as the vulnerable machines you want to identify.
Running it as part of an operation would likely increase the attack surface, given you have an agent running inside the target subnet.

error when rendering after selecting nmap from Pathfinder drop-down

Selecting the 'nmap' scanner from the Caldera GUI with Pathfinder plugin installed results in a Javascript Reference Error

pathfinder.js:222 ReferenceError: validateFormState is not defined
 at pathfinder.js:207:9
(anonymous) @ pathfinder.js:222

function setupScannerSection(){
.....
.....
        validateFormState(response.enabled, '#startScan')

Would appear the validateFormState function is not defined

*Note : Just cloned the code direct into Caldera plugin - no docker etc

c_cve.py errors

When adding Pathfinder plugin to working Ubuntu 20.04 Caldera 3.1.0 or 4.0.0-Alpha builds, encountered the attached error, referencing c_cve.py. If I copy c_cve.py from pathfinder/app/objects/ to caldera/app/objects, Pathfinder appears to work fine. Looking at caldera/plugins/pathfinder/app/enrichment/cve.py, in line 11 it calls to "from app.objects.c_cve import CVE". If I edit the line to be "from plugins.pathfinder.app.objects.c_cve import CVE", Pathfinder plugin generates no errors on Caldera server version 3.1.0 or 4.0.0-Alpha and appears to operate correctly.

Import Report Doesn't Work

I am trying to import a report into the Pathfinder plugin and it just reloads back to the Scan page. I don't know if this is a known bug or if something else is wrong. I also see a banner at the top that says I am "Currently using the legacy plugin interface for pathfinder". However, I am unaware of a newer version of Pathfinder. It is currently running in Caldera with the server.py script.

Problem when testing nmap-vulners

I have the following error while testing pathfinder in kali.

nmap scan started with parameters:
{
    "target_specification": "192.168.0.0/24",
    "script": "nmap-vulners",
    "script_args": "",
    "ports": "",
    "pingless": "0"
}
scan initiated, depending on scope it may take a few minutes
scan ID:c3f7f452-6d21-4089-a171-7c4578c794f0 failed. error output: NSE: failed to initialize the script engine:
/usr/bin/../share/nmap/nse_main.lua:821: directory 'nmap-vulners' found, but will not match without '/'
stack traceback:
	[C]: in function 'error'
	/usr/bin/../share/nmap/nse_main.lua:821: in local 'get_chosen_scripts'
	/usr/bin/../share/nmap/nse_main.lua:1312: in main chunk
	[C]: in ?

QUITTING!

Pathfinder scan parameters are not passed on from GUI

Hello everyone, I already mentioned this bug in mitre/caldera#2650 (comment) but since I found another problem regarding this bug I wanted to open an issue for the bug itself here.

CALDERA Version: 4.1.0
Pathfinder Plugin: Newest master branch
Browser: Firefox and Chrome

Bug Description

When running a Pathfinder scan, the default scan parameters in the GUI are not passed on to the scanner. This can also be seen in the output next to the input fields in the GUI.
More precisely, the fields "script" and "pingless" are empty.

To reproduce

• Fresh install CALDERA 4.1.0 and Pathfinder plugin
• Open Pathfinder plugin page
• Choose nmap scanner and enter ip adress
• Click "Scan"

Expected behavior
The pathfinder nmap scan is executed with the default parameters that are seen in the GUI ("script: nmap-vulners, pingless: false").

Screenshot

• First run shows output when executing steps from "to reproduce"
• Second run shows output when first selecting another scanner script and then nmap-vulners again and also checking and un-checking the "no ping" box
  

Current Workaround
To get the pathfinder plugin in to work with the nmap-vulners script, one has to add another script to the plugin. Only by selecting another script and then re-seleting the nmap-vulners script, the field in the scan parameters that can be seen in the output box is set. Without a second scanner script I cannot get the plugin to use the nmap-vulners script at all!
Same applies for the "pingless" field, but here it is easier to check and un-check the box.
Update for easier workaround: Edit the pathfinder/scanners/nmap/scanner.py lines 30 and 33.

self.script = script or "nmap-vulners"
self.pingless = pingless or False

The parameters are still not shown in the output box, but since they are not set when creating the new scanner object, the defined default values are used instead and the scan works as intended.

Suggested fix
The "pingless" part can be fixed by editing line 33 of the nmap/scanner.py as shown above.
The "script" part should still be just considered a workaround because when another script is shown in the drop down menu by default, still the vulners script will be used when the parameter is not set in the scanner fields.

Unable to show vulnerability

Hello，I found that when scanning for vulnerabilities in the pathfinder plugin, the web page did not show the scanned vulnerabilities, but running the Nmap scan locally did.

Mapping TTPs and CVEs

Hi! I am new here!
Is there any way to link TTPs and CVEs through the Caldera?
Through the Pathfinder plugin I have received the network topology including the CVES, and then I have created an operation using as adversary the Thief.
Once the operation is done, I use the Debrief plugin to see how the operation is completed and then I can see the used TTPs.
Is there any way to export which CVEs are used/linked to each used TTP?
Thanks in advance!

Dependencies

Hi! I am new here and I am trying to use pathfinder.
I have already installed CALDERA and enabled the Pathfinder plugin.
However, I faced the following difficulty and I cannot "use" the Pathfinder:
nmap: Please install scanner dependencies before scanning, scanning disabled!
Can you help me to overcome this difficulty?
Thank you in advance.

nmap-vulners submodule - out of date?

Hello!

It seems the sumbodule link for your nmap-vulners is broken. Version mismatch perhaps?

caldera_pathfinder/scanners/nmap/scripts/

Error Message when clicking the Pathfinder plugin.

Does anyone know how to get around this?

Plugin update issue

I got this message how can i update the plugin

Warning: You're currently using the legacy plugin interface for pathfinder. While it might function, we cannot guarantee its full compatibility or stability. For the best experience, we recommend updating to the latest UI version

search for vulnerabilities pathfinder and connect nessus scanner

Hello )
Please tell me, when I run the pathfinder scanner to search for the vulnerability of my network, and set the "script": "nmap-vulners" parameter, then the pathfinder plugin gives an error, what is the problem?
And the second question is how can I connect a third-party scanner such as nessus to the pathfinder plugin?

data_svc.py:349 _verify_adversary_profiles

I installed pathfinder on caldera 3.0.0, and when I started caldera with the command "python3 server.py --insecure", a warning appeared.

Screenshot：

Does it have any impact on subsequent operations? How to eliminate the warning?

error setting up scanner

Hi,

after the steps which are needed to get this up and running (i think), when i go to the plugins and select pathfinder and initiate a new scan i get the error 'error setting up scanner'

any pointers on this issue?

regards

Lennart

Nmap parsing error with pathfinder_gui.py

Hey guys. I'm using Caldera v4.0.0 and I added pathfinder plugin. I made a vulnerable vm (https://github.com/timurozkul/HeartBleed) to test it with the ssl-heartbleed.nse script but I get an error that tells me to ensure that the target has a CVE. I tried it manually with nmap and it worked. Another error that I get is on the terminal. Can anybody help me solve this problem? Thank you so much.

error importing plugin=pathfinder, no module named 'networkx'

Trying to use the pathfinder plugin with Caldera Docker image and getting the error:

error importing plugin=pathfinder, no module named 'networkx'

Have correctly cloned repository into caldera/plugins/pathfinder

ran pip3 install -r requirements.txt in caldera/plugins/pathfinder subdir

Rebuilt docker caldera docker image but still getting the above.

Anyone have any ideas?

Thanks