Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Handle limited payload size #4187

Open
VakarisZ opened this issue Jun 10, 2024 · 0 comments
Open

Handle limited payload size #4187

VakarisZ opened this issue Jun 10, 2024 · 0 comments
Labels
Feature Issue that describes a new feature to be implemented.

Comments

@VakarisZ
Copy link
Contributor

Is your feature request related to a problem? Please describe.
Some exploits have a limited payload size. Right now our payloads are long, they contain OTP's, binary download ID's, etc.

Describe the solution you'd like
Add infrastructure or shorten the payloads to be able to use exploits with limited size payload. The current goal is that the payload wouldn't exceed 64 characters (tied to https://www.exploit-db.com/exploits/47984)

Describe alternatives you've considered
@VakarisZ VakarisZ added the Feature Issue that describes a new feature to be implemented. label Jun 10, 2024
mssalvatore added a commit to guardicode/agentpluginapi that referenced this issue Jun 10, 2024
@mssalvatore
Change ReservationID from UUID to str
6c1489c 
UUIDs are 128 bits long and, in string format, consist of 36 characters.
This is a much larger set of possible values than is required for our
purposes. Furthermore, we can increase entropy by increasing the
character set used in generating ReservationIDs. This will allow us to
have a large enough set of possible values using much less characters,
allowing agent binary download URLs to be significantly shortened.

Issue guardicore/monkey#4187
mssalvatore added a commit that referenced this issue Jun 10, 2024
@mssalvatore
Agent: Shorten reservation ID
0b35c48 
Per Issue #4187, there are cases when download strings must be shorter.
In order to achieve this, random strings from a set of 62 characters are
generated. Using 5 characters gives something like 916M possible values,
which is more than enough for any single agent.
@VakarisZ VakarisZ mentioned this issue Jun 10, 2024
Merged
5 tasks
@mssalvatore mssalvatore mentioned this issue Jun 10, 2024
Merged
10 tasks
mssalvatore added a commit that referenced this issue Jun 10, 2024
@mssalvatore
Agent: Shorten reservation ID
ea03fe9 
Per Issue #4187, there are cases when download strings must be shorter.
In order to achieve this, random strings from a set of 62 characters are
generated. Using 5 characters gives something like 916M possible values,
which is more than enough for any single agent.

Issue #4187
PR #4189
mssalvatore added a commit that referenced this issue Jun 10, 2024
@mssalvatore
Agent: Shorten reservation ID
6a5f9a1 
Per Issue #4187, there are cases when download strings must be shorter.
In order to achieve this, random strings from a set of 62 characters are
generated. Using 5 characters gives something like 916M possible values,
which is more than enough for any single agent.

Issue #4187
PR #4189
@VakarisZ VakarisZ mentioned this issue Jun 11, 2024
Closed
5 tasks
mssalvatore pushed a commit that referenced this issue Jun 11, 2024
@VakarisZ @mssalvatore
Island: Shorten OTP to 16 characters
3ccd633 
16 characters is plenty secure for a token with a 2-minute lifespan and
shortens the payload sufficiently

Issue #4187
PR #4188
mssalvatore pushed a commit that referenced this issue Jun 11, 2024
@VakarisZ @mssalvatore
Island: Shorten OTP to 16 characters
9fa4e0c 
16 characters is plenty secure for a token with a 2-minute lifespan and
shortens the payload sufficiently

Issue #4187
PR #4188
mssalvatore pushed a commit that referenced this issue Jun 11, 2024
@VakarisZ @mssalvatore
Island: Shorten OTP to 16 characters
925c986 
16 characters is plenty secure for a token with a 2-minute lifespan and
shortens the payload sufficiently

Issue #4187
PR #4188
@VakarisZ VakarisZ mentioned this issue Jun 11, 2024
Merged
10 tasks
@mssalvatore mssalvatore mentioned this issue Jun 11, 2024
Merged
mssalvatore added a commit to guardicode/agentpluginapi that referenced this issue Jun 11, 2024
@mssalvatore
Merge branch 'add-chmod-command' into dev
37c9ba7 
Issue guardicore/monkey#4187
PR #10
mssalvatore added a commit that referenced this issue Jun 12, 2024
@mssalvatore
Merge branch '4187-use_permission_change_command' into develop
f962461 
Issue #4187
PR #4192
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Feature Issue that describes a new feature to be implemented.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@VakarisZ