Skip to content

Commit

Permalink
case change
Browse files Browse the repository at this point in the history
  • Loading branch information
elegantmoose committed Feb 11, 2024
1 parent db2e13c commit b22e13c
Show file tree
Hide file tree
Showing 13 changed files with 29 additions and 26 deletions.
4 changes: 2 additions & 2 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -101,9 +101,9 @@ If you'll be developing the UI, there are a few more additional installation ste

1. Add the Magma submodule if you haven't already: `git submodule add https://gitlab.mitre.org/caldera/other/magma`
1. Install NodeJS dependencies: `cd plugins/magma && npm install && cd ..`
1. Start the CALDERA server with an additional flag: `python3 server.py --uidev localhost`
1. Start the Caldera server with an additional flag: `python3 server.py --uidev localhost`

Your CALDERA server is available at http://localhost:8888 as usual, but there will now be a hot-reloading development server for the VueJS front-end available at http://localhost:3000. Both logs from the server and the front-end will display in the terminal you launched the server from.
Your Caldera server is available at http://localhost:8888 as usual, but there will now be a hot-reloading development server for the VueJS front-end available at http://localhost:3000. Both logs from the server and the front-end will display in the terminal you launched the server from.

## Docker Deployment
To build a Caldera docker image, ensure you have docker installed and perform the following actions:
Expand Down
6 changes: 3 additions & 3 deletions SECURITY.md
Original file line number Diff line number Diff line change
Expand Up @@ -28,14 +28,14 @@ Under this policy, "research" means activities in which you:

## Reporting a vulnerability

Information submitted under this policy will be used for defensive purposes only, i.e. to mitigate or remediate vulnerabilities. Since CALDERA is run by a not-for-profit and is open source by nature, by
Information submitted under this policy will be used for defensive purposes only, i.e. to mitigate or remediate vulnerabilities. Since Caldera is run by a not-for-profit and is open source by nature, by
submitting a vulnerability, you acknowledge that you have no expectation of payment. However, we will ensure that credit is given to the bug finder.

## What we would like to see from you

To help us triage and prioritize submissions, please include the following in your report:

- Affected version of CALDERA (committed hash or version number), operating system used, and python version.
- Affected version of Caldera (committed hash or version number), operating system used, and python version.

- Describe the location the vulnerability was discovered and the potential impact of exploitation.

Expand All @@ -49,7 +49,7 @@ When you choose to share your contact information with us, we commit to coordina

- Within ***10 business days***, we will acknowledge that your report has been received.

- After notifying the CALDERA team, we will open reported issues to the public within ***90 days***, or after a fix is released (whichever comes first).
- After notifying the Caldera team, we will open reported issues to the public within ***90 days***, or after a fix is released (whichever comes first).

- To the best of our ability, we will confirm the existence of the vulnerability to you and be as transparent as possible about what steps we are taking during the remediation process, including on issues or challenges that may delay resolution.

Expand Down
6 changes: 3 additions & 3 deletions app/api/v2/handlers/health_api.py
Original file line number Diff line number Diff line change
Expand Up @@ -19,15 +19,15 @@ def add_routes(self, app: web.Application):
router.add_get('/health', security.authentication_exempt(self.get_health_info))

@aiohttp_apispec.docs(tags=['health'],
summary='Health endpoints returns the status of CALDERA',
description='Returns the status of CALDERA and additional details including versions of system components')
summary='Health endpoints returns the status of Caldera',
description='Returns the status of Caldera and additional details including versions of system components')
@aiohttp_apispec.response_schema(CalderaInfoSchema, 200, description='Includes all loaded plugins and system components.')
async def get_health_info(self, request):
loaded_plugins_sorted = sorted(self._app_svc.get_loaded_plugins(), key=operator.attrgetter('name'))
access = await self._auth_svc.get_permissions(request)

mapping = {
'application': 'CALDERA',
'application': 'Caldera',
'version': app.get_version(),
'access': access[0].name,
'plugins': loaded_plugins_sorted
Expand Down
14 changes: 7 additions & 7 deletions app/api/v2/handlers/operation_api.py
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ def add_routes(self, app: web.Application):

@aiohttp_apispec.docs(tags=['operations'],
summary='Retrieve operations',
description='Retrieve all CALDERA operations from memory. Use fields from the '
description='Retrieve all Caldera operations from memory. Use fields from the '
'`BaseGetAllQuerySchema` in the request body to filter.')
@aiohttp_apispec.querystring_schema(BaseGetAllQuerySchema)
@aiohttp_apispec.response_schema(OperationSchema(many=True, partial=True),
Expand All @@ -49,7 +49,7 @@ async def get_operations(self, request: web.Request):

@aiohttp_apispec.docs(tags=['operations'],
summary='Retrieve an operation by operation id',
description='Retrieve one CALDERA operation from memory based on the operation id (String '
description='Retrieve one Caldera operation from memory based on the operation id (String '
'UUID). Use fields from the `BaseGetOneQuerySchema` in the request body to add '
'`include` and `exclude` filters.',
parameters=[{
Expand All @@ -68,7 +68,7 @@ async def get_operation_by_id(self, request: web.Request):

@aiohttp_apispec.docs(tags=['operations'],
summary='Retrieve operations (alternate)',
description='Retrieve all CALDERA operations from memory, with an alternate selection'
description='Retrieve all Caldera operations from memory, with an alternate selection'
' of properties. Use fields from the `BaseGetAllQuerySchema` in the request'
' body to filter.')
@aiohttp_apispec.querystring_schema(BaseGetAllQuerySchema)
Expand All @@ -89,8 +89,8 @@ async def get_operations_summary(self, request: web.Request):
return web.json_response(operations_mod)

@aiohttp_apispec.docs(tags=['operations'],
summary='Create a new CALDERA operation record',
description='Create a new CALDERA operation using the format provided in the '
summary='Create a new Caldera operation record',
description='Create a new Caldera operation using the format provided in the '
'`OperationSchema`. Required schema fields are as follows: "name", '
'"adversary.adversary_id", "planner.id", and "source.id"')
@aiohttp_apispec.request_schema(OperationSchema)
Expand All @@ -102,7 +102,7 @@ async def create_operation(self, request: web.Request):

@aiohttp_apispec.docs(tags=['operations'],
summary='Update fields within an operation',
description='Update one CALDERA operation in memory based on the operation id (String '
description='Update one Caldera operation in memory based on the operation id (String '
'UUID). The `state`, `autonomous` and `obfuscator` fields in the operation '
'object may be edited in the request body using the `OperationSchema`.',
parameters=[{
Expand All @@ -121,7 +121,7 @@ async def update_operation(self, request: web.Request):

@aiohttp_apispec.docs(tags=['operations'],
summary='Delete an operation by operation id',
description='Delete one CALDERA operation from memory based on the operation id (String '
description='Delete one Caldera operation from memory based on the operation id (String '
'UUID).',
parameters=[{
'in': 'path',
Expand Down
4 changes: 2 additions & 2 deletions app/api/v2/handlers/planner_api.py
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ def add_routes(self, app: web.Application):

@aiohttp_apispec.docs(tags=['planners'],
summary='Retrieve planners',
description='Retrieve CALDERA planners by criteria. Supply fields from the `PlannerSchema` '
description='Retrieve Caldera planners by criteria. Supply fields from the `PlannerSchema` '
'to the `include` and `exclude` fields of the `BaseGetAllQuerySchema` in the '
'request body to filter retrieved planners.')
@aiohttp_apispec.querystring_schema(BaseGetAllQuerySchema)
Expand All @@ -32,7 +32,7 @@ async def get_planners(self, request: web.Request):

@aiohttp_apispec.docs(tags=['planners'],
summary='Retrieve a planner by planner id',
description='Retrieve one CALDERA planner based on the planner id (String `UUID`). '
description='Retrieve one Caldera planner based on the planner id (String `UUID`). '
'Supply fields from the `PlannerSchema` to the `include` and `exclude` fields '
'of the `BaseGetOneQuerySchema` in the request body to filter retrieved '
'planners.',
Expand Down
2 changes: 1 addition & 1 deletion app/service/file_svc.py
Original file line number Diff line number Diff line change
Expand Up @@ -243,7 +243,7 @@ def _read(self, filename):
try:
buf = self.encryptor.decrypt(buf[len(FILE_ENCRYPTION_FLAG):])
except InvalidToken:
self.log.error('Failed to decrypt saved CALDERA state due to incorrect encryption key.\n'
self.log.error('Failed to decrypt saved Caldera state due to incorrect encryption key.\n'
' - If attempting to restore secure backup, verify that conf/local.yml exists with '
'correct encryption_key value, and that the server is being run without --insecure.\n'
' - If attempting to restore insecure backup, verify that conf/default.yml exists '
Expand Down
2 changes: 1 addition & 1 deletion app/utility/payload_encoder.py
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
This module contains helper functions for encoding and decoding payload files.
If AV is running on the server host, then it may sometimes flag, quarantine, or delete
CALDERA payloads. To help prevent this, encoded payloads can be used to prevent AV
Caldera payloads. To help prevent this, encoded payloads can be used to prevent AV
from breaking the server. The convention expected by the server is that
encoded payloads will be XOR'ed with the DEFAULT_KEY contained in the payload_encoder.py
module.
Expand Down
4 changes: 2 additions & 2 deletions app/utility/rule_set.py
Original file line number Diff line number Diff line change
Expand Up @@ -80,9 +80,9 @@ async def _is_ip_rule_match(self, rule, fact):
| DENY: 127.0.0.0/24 | 127.0.0.0/23 |
-------------------------------------
In the above case, we do not match on this fact, since the fact is a supernet of the rule (it "contains" the
rule subnet). Therefore, the rule subnet is only a portion of the fact subnet. Thus, CALDERA would ignore the
rule subnet). Therefore, the rule subnet is only a portion of the fact subnet. Thus, Caldera would ignore the
DENY rule and scan /23 anyway. But this would include a denied subnet range, which is undesired behavior.
This being the case, CALDERA does not match on non-equivalent subnets.
This being the case, Caldera does not match on non-equivalent subnets.
"""
if rule.match != '.*':
is_fact_address = await self._is_ip_address(fact.value)
Expand Down
5 changes: 4 additions & 1 deletion server.py
Original file line number Diff line number Diff line change
Expand Up @@ -90,7 +90,7 @@ def init_swagger_documentation(app):
)
aiohttp_apispec.setup_aiohttp_apispec(
app=app,
title='CALDERA',
title='Caldera',
version=version.get_version(),
swagger_path='/api/docs',
url='/api/docs/swagger.json',
Expand All @@ -99,12 +99,14 @@ def init_swagger_documentation(app):
app.middlewares.append(apispec_request_validation_middleware)
app.middlewares.append(validation_middleware)


async def enable_cors(request, response):
response.headers['Access-Control-Allow-Origin'] = 'http://' + args.uiDevHost + ':3000'
response.headers['Access-Control-Allow-Credentials'] = 'true'
response.headers['Access-Control-Allow-Methods'] = 'GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD'
response.headers['Access-Control-Allow-Headers'] = 'Access-Control-Allow-Headers, Origin, Accept, X-Requested-With, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers'


async def start_vue_dev_server():
await asyncio.create_subprocess_shell(
'npm run dev',
Expand All @@ -113,6 +115,7 @@ async def start_vue_dev_server():
cwd='./plugins/magma/')
logging.info('VueJS development server is live.')


if __name__ == '__main__':
def list_str(values):
return values.split(',')
Expand Down
2 changes: 1 addition & 1 deletion templates/abilities.html
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
<div x-ref="headerAbilities">
<h2>Abilities</h2>
<p>
An ability is a specific ATT&CK tactic/technique implementation which can be executed on running agents. Abilities will include the command(s) to run, the platforms / executors the commands can run on (ex: Windows / PowerShell), payloads to include, and a reference to a module to parse the output on the CALDERA server.
An ability is a specific ATT&CK tactic/technique implementation which can be executed on running agents. Abilities will include the command(s) to run, the platforms / executors the commands can run on (ex: Windows / PowerShell), payloads to include, and a reference to a module to parse the output on the Caldera server.
</p>
</div>
<hr>
Expand Down
2 changes: 1 addition & 1 deletion templates/login.html
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
<html>
<head>
<title>Login | CALDERA</title>
<title>Login | Caldera</title>
<link rel="shortcut icon" type="image/png" href="/gui/img/favicon.png"/>
<link rel="stylesheet" href="/gui/css/lib/custom-bulma.css">
<link rel="stylesheet" href="/gui/css/core.css">
Expand Down
2 changes: 1 addition & 1 deletion tests/api/v2/handlers/test_health_api.py
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
@pytest.fixture
def expected_caldera_info():
return {
'application': 'CALDERA',
'application': 'Caldera',
'plugins': [],
'version': app.get_version()
}
Expand Down
2 changes: 1 addition & 1 deletion tests/conftest.py
Original file line number Diff line number Diff line change
Expand Up @@ -384,7 +384,7 @@ async def initialize():
app_svc.register_subapp('/api/v2', make_app(svcs=services))
aiohttp_apispec.setup_aiohttp_apispec(
app=app_svc.application,
title='CALDERA',
title='Caldera',
version=version.get_version(),
swagger_path='/api/docs',
url='/api/docs/swagger.json',
Expand Down

0 comments on commit b22e13c

Please sign in to comment.