kcarretto / arsenal

Extensible Red Team Framework

Arsenal

Extensible Red Team Framework

Overview

Arsenal is a framework designed to be a back-end for Red Team command and control operations. It allows many Agent-C2 models to be integrated into one system, with a great interface and many useful features. The goal is to limit the time Red Team spends on back-end development, and invest more resources into the malware that is distributed to target systems.

Feature Highlights

• Integrates with custom implants and C2 servers with ease
• Easily group target machines and interact with all of them at once
• 3rd Party applications can integrate using outgoing webhooks (i.e. Slack Integration)
• Register agents and prevent them from receiving unsupported commands
• Protected by authentication and custom RBAC implementation to restrict what users have access to
• Easy to use console with autocomplete, history searching, and more
• Enable action attribution, know who on your team did what and when

Quick Start

Here are some quick deployment instructions to set up on Ubuntu 16.04 (The project will work across various distros however). It is recommended to loadbalance the teamserver for production use.

Fast install

Note: Fix permissions (i.e. not require sudo) at your leisure Optionally remove the new argument if you do not wish to populate the db with defaults.

sudo git clone https://github.com/kcarretto/arsenal /opt/arsenal
cd /opt/arsenal
sudo chmod +x install.sh
./install.sh new

Install dependencies

sudo apt-get update && sudo apt-get install docker.io git curl

Clone this repository

sudo git clone https://github.com/kcarretto/arsenal /opt/arsenal

Install docker compose

sudo curl -L https://github.com/docker/compose/releases/download/1.20.1/docker-compose-$(uname -s)-$(uname -m) -o /usr/local/bin/docker-compose

sudo chmod +x /usr/local/bin/docker-compose

Deploy with docker compose

mkdir -p /var/log/arsenal

cd /opt/arsenal; docker-compose up -d >> /var/log/arsenal/stdout.log 2>> /var/log/arsenal/stderr.log

Configure database defaults

docker exec -it arsenal_teamserver_1 /bin/sh -c "cd /opt/arsenal/bin; python3 setup.py" This will populate the database with default users and roles defined in bin/setup.py

Additional Information

The teamserver will now launch using docker-compose. To ensure that it is functioning properly, you may run curl 127.0.0.1/status and you should receive the teamserver's status back. You may also install the teamserver to the system without docker, please see /contrib for useful setup scripts, service files, and installation information.

arsenal's Issues

CancelAction does not seem to update status

Add logging to API

Implement Action API Functions

Add a "--quick" type to Actions

The --quick flag would specify that we want the output of the command as soon as possible, and so the teamserver should save the Action for the Target's lowest interval session.

GetTargetGroups

• Implement API Endpoint
• Write Unit Test

Add database schema documentation

Add API endpoint documentation

Note that this exists in the source code, it just needs to be pulled out into a markdown documentation file.

Implement Log Server functionality

ListGroups

• Implement API Endpoint
• Write Unit Test

Implement Session API Functions

Use ttl index for logs

https://docs.mongodb.com/v3.0/core/indexes-introduction/

Implement API Tokens and RBAC

Implement Credential Server Functionality

GetGroupAction

• Implement API Endpoint
• Write Unit Test

CreateGroup

• Implement API Endpoint
• Write Unit Test

Look into storing files in mongo

Implement Target API Functions

Add exception raising & handling

Eliminate the TODO's that say to raise / handle exceptions. Ensure proper exceptions are raised, and that they are handled such that the proper error message is relayed to the user.

Update Docs with correct Action ID's

Action type exec returns 1 on server. Docs say exec is Action 0.

Add --verify for config action

Allow an optional flag that causes the teamserver to verify connection to c2 servers (via icmp) when updating a session's config to point to new servers. This would only work if the C2 were public, but it could potentially help to avoid catastrophic errors.

CreateGroupAction

• Implement API Endpoint
• Write Unit Test

ListGroupActions

Add action string syntax documentation

Create a system for conducting unit tests, and integrate with Travis CI

Create documentation for custom Agent creation

Thorough documentation is needed for users to be able to create their own Agents, both for working with the existing C2 and working for a custom C2.

Add action object (agent json) documentation

Create a basic /api/v1 endpoint

Should handle JSON post requests and be able to call appropriate methods.

DeleteGroup

• Implement API Endpoint
• Write Unit Test

Improve Documentation

Ensure that all necessary things are documented.

Implement Group Action Functionality

AddGroupMember

• Implement API Endpoint
• Write Unit Test

Implement Webhook Functionality

RemoveGroupMember

• Implement API Endpoint
• Write Unit Test

Allow actions to be ordered

Set HTTP Response Code based on JSON status

Setup Travis-EC2 pipeline

Potential Problem: Asset Management

Plan on using dynamic facts to identify targets, meaning that we can configure the teamserver to use different criteria to distinguish targets.

1. Only use MAC Addresses (Default)
2. Use a combination of facts (i.e. MAC Address, external_ip)
3. Use a UUID file on the file system.

In the case that MAC Addresses are configured exactly the same for each team, and we cannot utilize a C2 on the internal network, we will be forced to resort to option 3. This will be enforced as follows:

1. The agent's configuration will be set with a special reserved key "uuid_file", which has the value of a path.
2. The agent checks to see if that file exists, if not, it will write the identifier from the "generated_uuid" field that will also be present in the config and write it to the file. If the file exists, it will read the identifier from the file.
3. It will then reinitialize (i.e. respond with no session id) and include the "uuid" field in it's JSON beacon.

This will clearly distinguish Targets in a worst case scenario situation, however file identification will only be used as a last resort.

GetGroup

• Implement API Endpoint
• Write Unit Test

Action API unit tests

Implement unit tests to ensure basic functionality of the Action API

Add target data to session check in event webhook

I need the target IP address included in the webhook

Implement a database structure using MongoEngine.

Group Model

• Implement Model Structure
• Implement relevant model functionality
• Implement Model Unit Tests

Implement Group Functionality

Fix target API tests

target API tests were broken during the unit test refactor, and they need to be fixed immediately.

Create and Document Mongo Schema

Determine an efficient way to store the required data.

Make HTTP response code match 'status' code

GroupAction Model

• Implement Model Structure
• Implement relevant model functionality
• Develop model unit tests

Action can be created if target does not exist.

CancelGroupAction

Make 'stale' status for Action cause GroupAction to be failing, not failed