If you're at the maturity point where you've adopted MITRE
and have a robust testing program in place,
then you might be wondering to yourself if weak or inconsistent
configurations present a real risk to your environment.
You may also be questioning if there is a series of holes
convenient enough that a virus could worm its way from a basic
user endpoint to an administrative share.
Better yet, maybe you know which CVEs might apply to your environment,
but you aren't sure of the effectiveness of your secondary controls,
such as segmentation and group policies.
What if there was a tool that could not only enumerate
the connected network shares and hosts, even if they are not supposed to be,
and the credentials for those servers that might be leveraged in an attack,
but actually confirmed it?
Are you looking for a tool that can show beyond a proof of concept that a
configuration vulnerability exists before it is exploited?
Well, today we're going to show you how to do just that.
Hi, I'm Maril Vernon, and in this course,
I'll be showing you how to use Infection Monkey to
compromise a path of traversable hosts on a virtual
network consisting of multiple endpoints,
a few web servers, and domain controllers.
We will see how Monkey can be used to discover,
compromise, and map a vulnerable network.
In this course,
I will also show you how infection Monkey can be configured
to employ specific MITRE tactics and discover rogue assets
connected to your network.
But before we get to how it's used,
let's take a few moments to understand what the
Infection Monkey is and how it works.
Guardicore, the creator of infection Monkey,
has always been a prominent vendor in cybersecurity with regards
to microsegmentation and are once again leading the industry in
zero trust networking implementation.
Initially, they had sought to develop a tool to test their own environment,
but decided to create something openly available to
organizations of any size and maturity level for whom a
penetration test might be out of reach.
Thus, the Infection Monkey was born.
You can get Infection Monkey by requesting a download link from
Guardicore's website for your preferred platform.
It currently comes in Linux, Windows, Azure,
VMware, and Google Cloud Platform formats.
It is also AWS compatible,
but this is an AMI built an updated by Guardicore that you subscribe
to an launch directly through the AWS Marketplace.
Since it is Python‑based, its source code,
which is openly available,
can also be customized for privately configured environments.
Infection Monkey consists of two parts,
a team server called Monkey Island and a web‑based
GUI client where you configure, deploy, control,
and eventually kill your monkeys.
For smaller teams with little expertise,
Infection Monkey can be run immediately out of the
box with its default settings.
But for the more advanced organizations,
it is highly configurable down to specific exploits,
assets to include and exclude, such as legacy systems,
and which attacks to use in its payload for tactic‑specific testing,
The Monkey is not an adversary emulation tool.
It works by using a real payload with real attacks and techniques to
try and exploit its way deeper into a network.
The only difference between a payload from a real attacker and the
Monkey's payload is that the Monkey is not malicious.
It will not attempt to steal,
encrypt, or corrupt data or to DoS a compromised host.
Functions of this tool are used in the network discovery and lateral
movement phase of an attack when you seek to discover what's on a network
and steal credentials to access additional resources. The Monkey's
built‑in discovery tool allows it to visualize compromised end‑to‑end
paths across the network in real time. Monkey also has built‑in exploits
to brute force existing user accounts and create an attempt to escalate
its own user.