ISTS Feedback

[hulto]

Collecting bugs and feedback from ISTS

[hulto]

Re-check for IP - some agents started before the host had an IP making them
Impossible to tag or decipher.

[hulto]

Track callback interval

[hulto]

Isssue with tomes - refresh fixed - maybe race condition?

[KCarretto]

General sysadmin tasks, would be useful to easily fix problems blueteamers cause for themselves

[KCarretto]

Seeing beacon ages would be incredible

[hulto]

Windows certs were scuffed. Unable to validate certs without running in an elevated auth prompt

[hulto]

Loosing DNS totally fucks up the agent. Can we cache the DNS results?

[hulto]

ISTS very specifically -
hard to move fast going from one thread to the next. Used re-run button to try and there but hitting back button was annoying.

User story:
I have a high priority team that I'm doing stuff to but then I need to reapply that tasking (with slight modifications) to another team or I need to conditionally do something to a team.

[hulto]

Can we solve this a reactive capability - if the tome seems X do Y

[hulto]

Pass files as an input parameter

[hulto]

Bring back the CDN.
Allow users to import assets to tavern and retrieve reported files.

[KCarretto]

• Polling would have been helpful, I was spam refreshing quests for outputs when I needed to move fast. Also refreshing the page can break some views, e.g if I have a "hosts" filter enabled. I also feel like there needs to be something in the UI moving, like a timestamp (e.g. last seen 5s ago) that would help my brain understand when I don't need to spam refresh (additionally "minutes" was not enough granularity)
• When rerunning the same tome, often beacons had died and I needed to select new ones or change parameter values, so I found myself very consistently going backwards through the flow to change things and then skip back to the end. I wonder if perhaps the rerun would benefit from its own ui flow.
• It was really hard to do group actions while pivoting, for example in order to use headshot from the teams lan to the router I needed to run them individually, because the target ip parameter for the tome was different for each beacon.
• The unique hosts toggle saved me upwards of 2hrs of time sorting through lists and clicking
• Imix was getting into a weird state on pfsense where the process was running but no callbacks were happening, likely due to how early in the boot chain we were. Might not be a realm-related issue but worth a look.
• SOCKS support / interactive shells would have been great for debugging
• It would be nice to create "campaigns" to group quests, I found myself consistently doing small variations of the same quests which I gave the same name to. This also cluttered the quests view with many of the same quests when I was trying to see what others were up to.
• A lot of commands I needed to run via shell (pfctl, writing a file, etc.) it would be great to address those gaps
• Some tome functionality we wrote could be abstracted into the language (e.g. checking that a process was spawned in the process list after a disown)
• after queuing a quest the associated beacon would die, which led me to rerunning quests more often (just to reassign them). It would be cool to optionally assign quests to a host, which would enable failover. It could also let us stage quests before we get a callback.
• Being able to report credentials / files / processes and display them in the UI would be incredible
• we should replace the pwndrop functionality
• We have a few typos to fix in the UI
• It's easy to tell how many hosts on a team I have, but hard to tell how many of a type of host I have in the comp (need to use hosts view instead of dashboard)
• if others want to set this up, there isn't a great supported way to have them setup tags
• More eldritch functionality for things like getting users and changing passwords would be cool
• We should report output during the callback it was claimed in instead of waiting until the next callback (race condition of a few ms probably)
• The tome import button for re-fetching doesn't spin or give any indication that something is happening until the toast says it's been completed
• Creating a quest can sometimes take a second, and if you click the submit button more than once it actually queues the quest again. To solve we could just change the button to a spinner once we've made the request
• The dashboards were really helpful and stunningly beautiful
• it would be great to see how long a beacon has been up (e.g. to tell if a host has been reverted / rebooted)
• it would be great to have a view of "recently lost" where I can see the latest hosts that we've lost access to.
• Sometimes if you don't refresh the ui it will say all the beacons are dead and scare the shit outta you
• Some folks think we need a "login with Google" landing page to make it seem less like a phishing site
• We need a way to manage imix callback config, so we can have multiple uris and intervals.
• We need to be able to tell more info about the beacons (process name, interval, etc)

[hulto]

Add more gradual control over dns queries in the transport

[hulto]

Add redirect to terraform

[hulto]

Add more gradual control over dns queries in the transport

[hulto]

Download and execute tome should support powershell too not sure it does rn 😢

[hulto]

Test with a SQUID proxy

[hulto]

✅ done #696

[hulto]

Test keylogger :/

[cmp5987]

• Host pagination
• More Polling
• Reporting based on teams/services
• Better ways of identifying errors (Things are erroring and partly succeeding )
• More ways to filter tables (Users / Tome Params )
• People are confused on what Tomes do even after reading their scripts
• Dropdown to sort tables by more than date (Output size / finished )