So this is the Infection Monkey AMI in the AWS Marketplace,
and I wanted to show this to you guys because in my opinion,
hosting it out of AWS is, if you have access to an AWS account,
is really the fastest way to get the Monkey Island server up and going
without having to download it yourself and try to install it.
I find that when I try to install it on my local platform,
whether it be Windows or Linux based, there are usually dependencies missing,
and it makes the agent malfunction.
So this is the most seamless solution that I have found.
It is free‑tier eligible,
you do only need to have it spun up when you're actively using it; otherwise,
you can power down, so your data operations charges will go down.
However, it is Linux/Unix based,
so you do have to host it on a Linux instance inside AWS.
But it's really easy to configure, you can launch it with just a few clicks.
You just click Continue twice,
and then if you're going to host in a region that's not North Virginia,
you do need to specify that here because the AMI ID
will change in that case; however, I host mine out of North Virginia,
so this is the same for me.
And then all you would do is click Continue to Launch,
and it will launch the server automatically in an EC2
instance running in your environment.
Now the two things take to note of here are the IPv4
Oublic IP address and the Instance ID.
You will need both of these things to access the GUI aspect of
Infection Monkey if you're hosting it in AWS.
So all you would do to get to the GUI client is navigate to
your public IPv4 address on port 5000.
So for that, we're just going to go to 52.7.229.62 on port 5000.
It will give you this error, it'll say your collection is not private.
You're going to want to click advanced and proceed anyway.
You're hosting the server yourself, so you know it's safe.
Once it loads, you do have to log in in order to access the GUI.
So the username is always going to be Monkey,
and then your password is going to be that instance ID from the EC2 instance.
So I'm just going to come down here and copy mine,
and we're going to plug that in, and voila,
we are inside our Monkey Island server.
From here, this is the home page.
There's not really a lot to this page,
but what you're going to want to do is immediately come to
the Run Monkey tab because that's where you're either going
to get the payload to run it, or you can configure it.
Now,
depending on whether or not you're going to be running it on the same
machine where you're hosting your island server,
so if that's your local, if you're hosting it on your local machine,
and that's also the machine you want to start the Monkey on,
you can just click that button.
There's no copying and pasting, no interacting with the command shell at all,
and it'll run automatically, or if you're going to run it on an AWS EC2 instance,
it's a different payload,
so you would need to click that button in order to get that payload.
However,
we're going to be using the Run on a machine of your choice option because
we're going to set it loose on two VMs that I'm hosting,
but if you're going to configure the Monkey,
you need to do it here before it's run,
or the configuration changes won't save to the active agent.
Here on the ATT&CK tab, we have the MITRE ATT&CK‑aligned techniques identified,
and the dark‑green ones are mandatory in order for
the payload to propagate properly,
but the light‑green ones you do have the option to include or exclude,
depending on whether or not you're trying to retest for a specific
tactic to see if a remediation control is working or not,
and to do that, you would simply select it.
Now, certain modules are dependent on certain other modules; however,
if you're not testing for credential dumping,
you can de‑select those.
So you have a number of configuration options with ATT&CK.
I'm going to remove the things that I know we're not interested in,
and fortunately for us, all of the tactics that were concerned with,
even though the matrix has updated and moved one of
them over to Discovery for the Monkey, because of the version it's on,
are still all under lateral movement here,
so we can go ahead and de‑select anything that we are not going to use,
we're not going to be using private keys.
We do want to brute force, we do want to dump credentials if we can.
We are not going to be using execution through API,
and I believe the rest are dependencies that we will need to keep.
Next,
the Basic Exploits tab is where you'd include user
credentials to help the Monkey propagate deeper.
We aren't going to do that this time because I want to demonstrate the
Monkey's ability to brute force on its own; however,
these were the three that I originally included,
and the WINUSER02 and WINUSER01 admin share usernames right there,
those were discovered in a different scan,
and so once a username is discovered,
the Monkey actually saves them for you to your active
configuration for you to use in the future.
So we're going to just delete all of these,
and just go with Administrator, root, and user.
Make sure you click Submit to save your changes.
The Basic Network tab is where you can decide how many hops
away from the island the Monkey can penetrate.
So I am going to change this because it's at 2 right now,
and I don't have very many hops available on my virtual network,
but I do want to up it to 5, just in case it's able to discover anything else.
So from here, we're going to run on a machine of our choice.
I'm running both Windows and Linux instances in my environment,
so I'm going to show you how both of those look.
I'm going to pick the Window 64 bit because that's what I run.
So something I want to point out to you is that currently the payload
reflects the internal IP address for the EC2 instance,
and I don't know if this works differently if you are
self hosting the island server, but because I'm hosting it out of AWS,
you need to change this IP address to call out to the public‑facing IP address.
So I will show you how to do that in the command prompt
when we're actually going to deploy it.
So I'm going to come on over to my Windows box.
We're going to open up the command shell,
use the command shell and not PowerShell shell because
the word PowerShell is in the script,
and it's going to mess with itself if you try and execute it in PowerShell.
So before we execute this bad boy,
let's change the IP address everywhere that it appears incorrectly.
Okay, now we should be ready to roll.
So we're pretty much going to hit Enter,
give it a minute, and this is a good sign.
If this second window does not pop up and start running,
then your Monkey has not executed successfully,
and you will need to go back and troubleshoot it,
and try again.
So now let's pop back over to our GUI client,
and take a look at our infection map.
You will see that my island host is there,
as well as the first host that I have just given it.
So that's it's jumping‑off point, is my VM on my 21.
subnet.
So the Monkey has started, it's identifying that no tunnel is being used,
it's collecting system information, it's going to identify the operating system,
the running services, open ports,
and then start trying to authenticate its way in.
So the other thing we're going to do just for fun is to
set it loose on a Linux instance.
So I've already puttied myself into my Linux instance and made myself root,
which is something you will need to do.
Now I'm running CentOS on mine, so actually,
I'm going to need to install Wget,
and you will need to install Wget if you're running a CentOS‑based Linux image.
Trying to use Yum is not going to work out well for you.
So I would just always install Wget.
It takes 2 seconds, it's very easy to do, and then everything works flawlessly.
Perfect.
So now we will go ahead and paste in our payload,
and again,
we're going to change that IP address to the externally‑facing IP address,
or the agent is going to fail.
Alright, it's looking good, so we're going to hit Ente,
and the Monkey is running successfully.
So we're going to get rid of that.
Come back over to our infection map,
where we can see that it's now identified my CentOS machine.
And we're basically going to let it run here.
It can run for up to, it's never taken mine longer than 45 minutes,
but it does run for a while,
so we're going to pause it here and come back when we've
got some snazzy results to check out.
Alright, welcome, welcome back.
Our monkeys are done propagating.
I did receive a notification about 20 minutes in that I
had results in my security report,
but I decided to let it run longer than that
because the longer you do let it run,
the more information will populate in the report.
So the longer it goes, the more information you get.
The report is living, it's still going.
As long as the monkeys are still going, the report is still building.
So I'm not going to spend too much time on what we see here because
I'm going to go over that more in the second demo.
Really the two things I want to show you are our infection map,
so that got pretty extensive pretty quickly,
and really what we want to know is whether or not we
were able to exploit over SSH and SMB, and it looks like we were,
also post‑breach actions were accomplished.
And if we want to take this a step further,
we can come over here to the ATT&CK tab,
and again the table doesn't display correctly,
I'm not sure why, but you can just go ahead and click List all techniques.
And you can come on down to the Lateral movement section, where you
will see that SSH, SMB ,abnormal protocol over TCP port, and HTTP
were all successful in being exploited.
Additionally,
remote file copy, the Monkey was able to copy itself onto all
of these systems, and last but not least,
remote services.
We have SSH, SMB, MSSQL, WMI was used, and it was used on quite a few hosts.
So, you could always drill down into this, see which hosts were compromised,
how it was done, when it was done, from which other
host it was done, and as you can see,
the Monkey has several other pretty cool capabilities that
we're not going to cover, such a C2, data exfil, discovery,
credential access, execution.
As you can see,
the Infection Monkey does apply to several tactic
categories within the MITRE matrix; however,
this one's just focused on the lateral movement functions.
The last thing I'm going to show you is the Zero Trust Report.
We're not going to spend a lot of time on this because
this is not a Zero Trust course,
but if you are familiar with Zero Trust, and you wanted to come
over here, and see your results, and drill down into which
principles and tests were run against those principles to validate
them, and go through your findings, you have that option as well.
So that is the Monkey, I hope you enjoyed, and I will see you in the next demo.