SECCDC Quals Feedback (2024)

[KCarretto]

A place to record feedback for SECCDC Quals realm usage.

Missing Eldritch Features

• Ensure we include a list of all starlark provided functionality in eldritch documentation
• File Permissions (chattr, chmod, lsattr)
  • Be able to set permissions during file.write()
• Regex (e.g. replace with regex)
• globbing (*)

[KCarretto]

We should have a defacto "test" group so that prebuilt dashboards can prefilter these out

[KCarretto]

File list tome says "Error: Invalid Path" when file doesn't exist, we should update this to say the file doesn't exist

[hulto]

Feature request: show output size in quest output to allow fast checks on how much data is back.

[hulto]

Pain point: User didn't realize that create quests filters out dead beacons.

[hulto]

Feature request: SOCK5 proxy or at least a tome to drop chisel.

[KCarretto]

Feature: Personal quest view (e.g. list quests that I've created), likely a "My Quests" sidenav option

[KCarretto]

Feature: View of recently killed beacons (answer the question "what have I lost recently")

[KCarretto]

Feature: Preserve filters when refreshing page (or add polling), noticed on hosts view

[KCarretto]

Feature: Maybe an eval tome? People a little sad with the lack of tomes available

[KCarretto]

Feature: Consider enabling multiple tomes to be queued for a quest, it could be useful to maintain context (e.g. I want to do this thing across these hosts).

[hulto]

An alternative @cmp5987 and I discussed is adding "run and task more beacons" button on the quest output or at the end of the quest creation flow.
The button would preserver state of selected beacons.

[KCarretto]

Feature: Filter quest view by creator

[KCarretto]

Feature: Track metrics on success rates by Tome

[KCarretto]

Feature: Recon Tome

• Process list / netstat
• User list
• Report common service configs as structured file output to tavern (SSH, Apache, etc.)

[KCarretto]

Feature: Consider merging Quest History and Quest Outputs view, if we add enhanced search to Quest History (e.g. searching output) then we wouldn't require the top-level Quest Outputs view

[KCarretto]

Feature: Include Process Group ID (pgid) in results of process.list

[nullmonk]

Bugfix: The print function does not add a newline at the end. This goes against the starlark spec

[nullmonk]

Bugfix/feature: Immutable bit does not show up in permissions on file objects returned by file.list

[nullmonk]

Discussion: user and group are returning different values in file objects returned by file.list. User returns the user as a string, Group is the GID. Should they both be GID/UID or both be a string?

[nullmonk]

Followup, group should be a string, as sys.get_user() returns the groups as strings. Since there is no way to convert the group name to an int, it is impossible to tell if the user has the ability to read a file via file.permissions

[hulto]

Ability to cancel jobs if they haven't been picked up yet

[hulto]

An easier way to test a quest before rolling it out.
Maybe if we have a test team provide a run on test team option to the quest creation view.

[hulto]

pspy tome https://github.com/DominicBreuker/pspy

[nullmonk]

How do you want this to work? Each new proc gets queued to be sent to the c2? Or a run-and-done and dump the output?

[hulto]

Two implementations in mind:

1. Re-implement the inotify watcher as an eldritch function. The function would take a function as an input param which would handle reporting the data. A simple example being: sys.pspy(func_handle=print) which would just print the string rep of the proc.

2. Write a tome that copies out the real pspy, execute it with disown, use file.follow on the output file to grab everything.

[hulto]

Desktop streaming / long running tome running screenshot

[hulto]

The copy pasting the input params in task details

[nullmonk]

Ability to pass input params in golem for testing tomes

[hulto]

Docs to backup and restore the SQL database.
Also maybe docs on import the SQL DB into a local dev instance. (And manually approving your user)

[hulto]

Code freeze on the 26th leading up to ISTS?

[hulto]

oauth state errors on first login

[KCarretto]

Naming for file transfers:

• Files reported by the agent to the c2 (currently report.file() in eldritch, report_file in gRPC)
• Files requested by the agent (assets.copy() in eldritch, download_file in gRPC)

[hulto]

Do reusable helper functions belong in tomes, as eldritch functions, or in a "common" tome library.