Post-MVP Discussion Notes

[KCarretto]

Agenda

• What went well?

  • Scale
    • Not even close to performance issues
  • Reliability
    • Imix "just worked", no major issues with agents falling off due to bad tomes, no known crashes
    • Infra was fairly available, low latency
    • Deployment was straightforward, "drop binary, drop config file"
      • Config file was smooth for deployment
  • The generated names were very cute and enjoyable
  • Testing was very lovely
    • Enabled us to completely refactor some backend code during the engagement with confidence 😎
  • Possibly stealthy enough, pending IR investigation
  • Worked well on Windows, was pretty neato, did some sneaky things

• What didn't go so well 👀 ?

  • Misunderstanding about parameters (Will resolve with [feature][Tavern] Rename params on tome to paramdefs #134 )
    • Perhaps look into codegen for Rust <> GraphQL
  • String quotation while running commands
    • To be fair, this is partially because I was using the GraphQL Playground which forces me to surround everything in double quotes
      • Tome embedded files may help to resolve this for more complex commands
    • If we enable tome updates, make sure we track what version of tomes were run
  • Preventing invalid tomes from reaching agents
    • UX --> In the create job form, can we display errors for issues we detect?
    • Canaries may also help (low pri, nice to have, long term feature request)
  • Error Reporting was a bit quiet / things failed silently
    • Stdout/Stderr & Exit codes from sys.shell would be great here
    • Try to report errors when main loop crashes
  • Would be nice to have pwnboard integration
  • Queuing tasks for hosts (e.g. as sessions die)
    • Might be a bit complex, hold off for now

• UI Functionality --> Will schedule follow up discussion

• Eldritch Feature Updates

  • Service functionality (e.g. start/restart services) --> Will investigate

• In-Memory File Management (Tome embedded files)

  • Start with new library "assets", implement a read function which copies file contents into starlark
    • Later implement pointer things to avoid copying large files (complicated)
    • Set limit to prevent copying large files via read function
    • Maybe implement buffer reader in starlark?
  • Rename tome.files to tome.assets

• Config Management

  • Add environment variables as an option, CLI will override these
  • We can precompile defaults, update executable with new values
    • Being able to avoid CLI flags and Env variables can help avoid detection / IOCs

Follow Up Issues

• [bug][nit] We should change rdev to something else. #143
• [bug][Tavern] Eldritch Length Limit #141
• ClaimTasks Additional Testing #140
• Query Tests #137
• [feature][Eldritch] Add function to obtain primary IP #139
• Record session IPs #138
• [bug] SQL Connection Errors #136
• Maintain history of checkin timestamps #135
• [feature][Tavern] Rename params on tome to paramdefs #134
• [feature] Add Creator to jobs #133
• [feature] Add platform information to callbacks #132
• [bug] Report output on error #131
• add updateTome / deleteTome API #130
• [feature][Tavern] Add where parameters as optional query vars for root queries #129