Discovered Node Properties Don't Have to be Revealed for Property Dependent Precondition?
forrestmckee opened this issue · comments
I'm trying to setup an environment that first requires the agent to probe a remote system to learn a property. That property is a precondition to a different remote exploit on the system. In a variant of the manually solved notebook, I can bypass the precondition even though the property has yet to be discovered.
In other words, vulnerability A reveals PROPERTY and PROPERTY is the precondition to vulnerability B.
The attack sequence must be A->B.
This seems to be because in actions.py _check_prerequisites is dealing with the actual node properties instead of the discovered node properties.
If I try to instantiate a node with an empty properties list and then probe for the desired property, I hit the elif condition on line 329 of actions.py.
Am I misunderstanding the use case of a vulnerability with a ProbeSucceeded outcome, or is this a bug?
The vulnerability precondition in a vulnerability library offers a convenient way to assign vulnerabilities to the network nodes. It's meant to be a sufficient condition for the vulnerability to exist on a given node. It's not a necessary condition for it to be known to be exploited by the agent. This idea is to be able to express statements like "every node running Apache Version x suffers from vulnerability CVE y".
To achieve what you want you could try introducing a fictitious node F to represent the knowledge PROPERTY you want the attacker to acquire prior to exploiting vulnerability B. You could probably enforce the sequence A->B using some firewall rule that makes sure that vulnerability B can only be exploited from the fictitious node F that encodes PROPERTY.
@forrestmckee You may also be able to enforce the ordering A->B through the use of credentials, that is representing the knowledge of PROPERTY as the discovery of some specific credentials representing that property. Exploiting the vulnerability A would leak the credentials to the attacker agent; the agent would then need to use those credentials to connect/own another node.