mitre / stockpile

A CALDERA plugin

MITRE Caldera plugin: Stockpile

A plugin supplying Caldera with TTPs and adversary profiles.

Read the full docs

For collection and exfiltration abilities added January 2022 (see list below), additional information for configuring these abilities can be found in the examples in the stockpile/docs/ folder.

2022 Included abilities:

• Advanced File Search and Stager
• Find Git Repositories & Compress Git Repository
• Compress Staged Directory (Password Protected)
• Compress Staged Directory (Password Protected) and Break Into Smaller Files
• Exfil Compressed Archive to FTP
• Exfil Compressed Archive to Dropbox
• Exfil Compressed Archive to GitHub Repositories | Gists
• Exfil Compressed Archive to GitHub Gist
• Exfil Directory Files to Github (this exfiltrates files without archiving)
• Exfil Compressed Archive to S3 via AWS CLI
• Transfer Compressed Archive to Separate S3 Bucket via AWS CLI
• Scheduled Exfiltration

Potential Issues

• The donut-shellcode python package is not currently supported for ARM chip architectures. Thus the package cannot be installed on newer Mac systems with the M chip series.

stockpile's Issues

Wrong argument type

stockpile/app/buckets.py

Line 21 in aaf42f3

await self.planning_svc.exhaust_bucket(self, [bucket], self.operation)

bucket is passed as a list of string while exhaust bucket requires a string

What the different between Find domain controller and Discover domain controller?

In stockpile we have two abilities: Find domain controller and Discover domain controller? (they are very similar)

Update technique id of abilities

Some abilities are still not updated according to the new attck matrix
Example in stockpile (there "T1071") and similar in atomic (there "T1071.001")
Also in T1071 only one ability from stockpile

Although in T1071.001 already three abilities from atomic with the same meaning

So, I think we should update all abilities according new numeration (with sub technique) since using old numeration is a bit confusing

Reporting - Abilities presented in MITRE Navigator

For reporting purposes.

Script which will generate from already developed abilities JSON file compatible with MITRE Navigator (https://mitre-attack.github.io/attack-navigator/enterprise/) where the results can be presented.

Incorrect date time format in ragdoll.py

Describe the bug
The data time format used to send the agent_reported_time does not match with the time used in the Caldera server.

This causes it to crash when processing the response before showing the results

Traceback (most recent call last):
  File "/home/ubuntu/caldera/app/service/contact_svc.py", line 123, in _save
    link.agent_reported_time = self.get_timestamp_from_string(result.agent_reported_time)
  File "/home/ubuntu/caldera/app/utility/base_world.py", line 87, in get_timestamp_from_string
    return datetime.strptime(datetime_str, date_format)
  File "/usr/lib/python3.10/_strptime.py", line 568, in _strptime_datetime
    tt, fraction, gmtoff_fraction = _strptime(data_string, format)
  File "/usr/lib/python3.10/_strptime.py", line 349, in _strptime
    raise ValueError("time data %r does not match format %r" %
ValueError: time data '2024-02-03 15:47:46' does not match format '%Y-%m-%dT%H:%M:%SZ'

To Reproduce
Steps to reproduce the behavior:

1. Run the most recent version of Caldera
2. Start a ragdoll.py agent
3. Run any command expecting an output
4. See that the output is not shown and a error message is shown in the Caldera console

Expected behavior
The commands output to be seen on Caldera and no error message in the console

Fix
Change line 66 of ragdoll.py to:

execution_timestamp = datetime.datetime.now().strftime('%Y-%m-%dT%H:%M:%SZ')

Desktop (please complete the following information):

• OS: Ubuntu
• Browser: Chrome
• Version: Caldera 4.2.0

Missing pip requirement matplotlib?

Describe the bug
When running an operation using the new guided planner and enabling the debug attack graph output, the conditional matplotlib.pyplot import in line 232 of the guided planner causes a ModuleNotFoundError: No module named 'matplotlib'.

To Reproduce
Steps to reproduce the behavior:

1. Fresh install CALDERA 4.1.0
2. Set debug output for guided planner to True
3. Start new operation using the guided planner

Expected behavior
The operation should run successfully and the debug output should be shown.

Screenshots

2022-10-05 09:05:56 - ERROR (c_operation.py:344 run) No module named 'matplotlib'
Traceback (most recent call last):
  File "/home/kalidera/Desktop/caldera/app/objects/c_operation.py", line 341, in run
    await self.cede_control_to_planner(services)
  File "/home/kalidera/Desktop/caldera/app/objects/c_operation.py", line 331, in cede_control_to_planner
    await planner.execute()
  File "/home/kalidera/Desktop/caldera/plugins/stockpile/app/guided.py", line 138, in execute
    await self.planning_svc.execute_planner(self)
  File "/home/kalidera/Desktop/caldera/app/service/planning_svc.py", line 135, in execute_planner
    await getattr(planner, planner.next_bucket)()
  File "/home/kalidera/Desktop/caldera/plugins/stockpile/app/guided.py", line 141, in guided
    await self.execute_subop(ability_ids=self.ability_ids, goals=self.goals)
  File "/home/kalidera/Desktop/caldera/plugins/stockpile/app/guided.py", line 153, in execute_subop
    await self._show_attack_graph(attack_graph)
  File "/home/kalidera/Desktop/caldera/plugins/stockpile/app/guided.py", line 232, in _show_attack_graph
    import matplotlib.pyplot as plt
ModuleNotFoundError: No module named 'matplotlib'

Desktop (please complete the following information):

• OS: Kali
• Version: 4.1.0

Additional context
I did not find any information about matplotlib being a requirement, so I think this is not a desired/expected behavior.
This could be fixed by adding matplotlib to the requirements of the stockpile plugin.

Possible duplicates in abilities

We have two "Start 54ndc47 (WMI)" abilities (1 and 2)
I think the first can be removed because it looks like the second and no usage in any adversary