Define credentials collectors plugin interface

[mssalvatore]

Description

In order to migrate the SSH and Mimikatz credentials collectors to plugins, we must first define a plugin interface for credentials collectors.

Tasks

• Define what should be passed to Plugin.__init__() for credentials collector plugins (0d) @cakekoa
• Define what should be passed to Plugin.run() for credentials collector plugins and modify the puppet as necessary (0d) @ilija-lazoroski
• Define what should be returned from Plugin.run() for credentials collector plugins and modify the puppet as necessary (0d) @ilija-lazoroski
• Modify PluginLoader._load_plugin_from_island() to load credentials collector plugins (0d) @cakekoa
• Make the UI work for credentials collector plugins (0.25d) @ilija-lazoroski
• Build a mock/test credentials collector plugin and test the system end-to-end (0.5d) @cakekoa

[cakekoa]

For Plugin.__init__():

Our existing credentials collectors require an IAgentEventQueue and an AgentID. We use IAgentEventPublisher in our plugins, which allows us to pass data from the plugin process to the main process agent event queue. These dependencies are used for publishing the credentials stolen event.

• IAgentEventPublisher
• AgentID

[ilija-lazoroski]

For Plugin.run() we should only pass host, optionsand interrupt.

host is needed so we can specify the target when sending CredentialStolenEvent.
For the options I am not 100% sure because that is something that we will decide when we actually do the collectors. The only thing that I can see that could be an option is CREDENTIAL_TYPES from MimikatzCollector .

[ilija-lazoroski]

The collectors are returning a list of Credentials which the master only uses to log a debug message. I think we don't really need to return anything as we publish the credentials in CredentialStolenEvent.

[shreyamalviya]

host is needed so we can specify the target when sending CredentialStolenEvent.

Plugin.run() doesn't need the host since credential collectors run on the local system. In the events, target will be None meaning the event took place on the local system.

For the options I am not 100% sure because that is something that we will decide when we actually do the collectors.

We're implementing the plugin system so that everyone can write their own plugins. We can't foresee what kind of plugins will be written so we need to pass options to all of them regardless of whether it's useful for us right now.

[shreyamalviya]

The collectors are returning a list of Credentials which the master only uses to log a debug message. I think we don't really need to return anything as we publish the credentials in CredentialStolenEvent.

We don't need to return the credentials stolen because the event handles it, but we do need a CredentialCollectorResultData (just like we have ExploiterResultData).

[ilija-lazoroski]

The collectors are returning a list of Credentials which the master only uses to log a debug message. I think we don't really need to return anything as we publish the credentials in CredentialStolenEvent.

We don't need to return the credentials stolen because the event handles it, but we do need a CredentialCollectorResultData (just like we have ExploiterResultData).

CredentialCollectorResultData should have collection_success, os?, info? and error_message?

[cakekoa]

We've settled on the following interface:

• __init__() will accept an IAgentEventPlubisher and an AgentID
• run() will accept an options dict and an interrupt event, and return the sequence of credentials stolen