initial commit

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2020 Ca Devrait Le Daire
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

Makefile

@@ -0,0 +1,49 @@
+.PHONY: cache composer-install composer-update create-network help install jwt up update
+
+CONFIG_DIR=api/config
+DC=docker-compose
+DC_UP=$(DC) up -d
+DC_EXEC=$(DC) exec php
+BIN_CONSOLE=$(DC_EXEC) bin/console
+
+help:
+	@grep -E '(^[0-9a-zA-Z_-]+:.*?##.*$$)|(^##)' $(MAKEFILE_LIST) | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[32m%-25s\033[0m %s\n", $$1, $$2}' | sed -e 's/\[32m##/[33m/'
+
+cache: ## Clear cache
+	$(BIN_CONSOLE) cache:clear
+
+composer-install: ## Install composer packages
+	$(DC_EXEC) composer install
+
+composer-update: ## Update composer
+	$(DC_EXEC) composer update
+
+copy-files-prod: ## Copy prod files to dev
+	cp .env.prod .env
+	cp docker-compose.prod.yml docker-compose.yml
+
+create-network: ## Create docker network if not exists
+	docker network create smersh || true
+
+init-db:
+	$(BIN_CONSOLE) do:da:dr --force
+	$(BIN_CONSOLE) do:da:cr
+	$(BIN_CONSOLE) do:sc:up --force
+
+install: create-network up jwt composer-install cache ## Install and setup project
+
+jwt: ## Generate jwt
+	cd api && sh ./generateJWT.sh
+
+load-data:
+	$(BIN_CONSOLE) do:fi:load --quiet
+
+reset-db: init-db load-data
+
+up: ## Start containers
+	$(DC_UP)
+
+update: ## Update containers composer packages then re-up containers
+	$(DC) pull
+	$(MAKE) composer-update
+	$(MAKE) up

README.md

@@ -0,0 +1,96 @@
+# SMERSH
+<img width="1280" alt="logo" src="https://raw.githubusercontent.com/CMEPW/Smersh/master/logo.png">
+
+Smersh is a pentest oriented collaborative tool used to track the progress of your company's missions.
+
+# Preview front (Angular):
+<img width="1280" alt="showmission" src="https://raw.githubusercontent.com/CMEPW/Smersh/master/showMission.png">
+<img width="1280" alt="homepage" src="https://raw.githubusercontent.com/CMEPW/Smersh/master/homepage.png">
+
+
+# preview API (Symfony + Api Platform) :
+<img width="1280" alt="swagger" src="https://raw.githubusercontent.com/CMEPW/Smersh/master/api.png">
+
+
+# Ports mapping
+| Container | Internal port | External port |
+| ------ | ----------- | ---- |
+| Vulcain | 443 | 8443 |
+| Api | 80 | 8000 |
+| Db | 5432 | 5432 |
+| Mercure | 443, 80, 2019 | 1337 |
+| dev-tls | 80 | 80 |
+| php | 9000 | / |
+| CodiMD | 3000 | 3000 |
+| db-codiMD | 5432 | / |
+
+
+# How to install server
+
+
+>If you are using windows, please switch to linux
+
+Run `docker-compose up -d` then use theses command
+
+```
+make install  
+make init-db
+make load-data # to have exemple data
+```
+
+Finaly go to  `http://localhost:8000/api` and use "jenaye:jenaye" to log in.
+
+
+## You can also do it manualy like this :  
+
+```
+docker-compose exec php bin/console do:da:cr  # create database
+docker-compose exec php bin/console do:sc:up --force # generation of tables
+docker-compose exec php bin/console make:entity --overwrite # 
+docker-compose exec php bin/console doctrine:fixtures:load # load fake data
+```
+
+>For dummy data, think to edit files locate in `api/src/DataFixtures` and edit object.
+
+
+## Generate keys ( jwt ) 
+
+```
+docker-compose exec php sh -c '                
+    set -e
+    apk add openssl
+    mkdir -p config/jwt
+    jwt_passphrase=${JWT_PASSPHRASE:-$(grep ''^JWT_PASSPHRASE='' .env | cut -f 2 -d ''='')}
+    echo "$jwt_passphrase" | openssl genpkey -out config/jwt/private.pem -pass stdin -aes256 -algorithm rsa -pkeyopt rsa_keygen_bits:4096
+    echo "$jwt_passphrase" | openssl pkey -in config/jwt/private.pem -passin stdin -out config/jwt/public.pem -pubout
+    setfacl -R -m u:www-data:rX -m u:"$(whoami)":rwX config/jwt
+    setfacl -dR -m u:www-data:rX -m u:"$(whoami)":rwX config/jwt
+'
+```
+
+
+# How to install front
+
+> requirements : node & npm 
+
+```
+npm i
+ng serve
+```
+
+## Todo
+- Generate report
+- Add field for language ?
+- Progress bar on mission ?
+- Externe : host/vuln - interne : account pwned, privilieges ? perimeter
+- Better display of credentials info mission view
+- Maybe use chips to create new vulns into host ?
+- Select by default current vuln by host cuz at add vuln override ( i tried to use 'Content-type': 'application/merge-patch+json' with patch method but isn't working )
+- Add color by impact into mission-single-view
+- Add possibility to select impact when u're editing vuln
+- Fix select vuln by host (add-vulns-to-host-external)
+
+## Contributors 
+- Darkweak - https://github.com/orgs/CMEPW/people/Darkweak
+- michmich1000 - https://github.com/orgs/CMEPW/people/michmich1000
+- SilouFr  - https://github.com/orgs/CMEPW/people/SilouFr

api/Dockerfile

@@ -0,0 +1,138 @@
+# the different stages of this Dockerfile are meant to be built into separate images
+# https://docs.docker.com/develop/develop-images/multistage-build/#stop-at-a-specific-build-stage
+# https://docs.docker.com/compose/compose-file/#target
+
+
+# https://docs.docker.com/engine/reference/builder/#understand-how-arg-and-from-interact
+ARG PHP_VERSION=7.4
+ARG OPENRESTY_VERSION=1.15.8.3
+ARG VARNISH_VERSION=6.4
+
+
+# "php" stage
+FROM php:${PHP_VERSION}-fpm-alpine AS api_platform_php
+
+# persistent / runtime deps
+RUN apk add --no-cache \
+		acl \
+		fcgi \
+		file \
+		gettext \
+		git \
+	;
+
+ARG APCU_VERSION=5.1.18
+RUN set -eux; \
+	apk add --no-cache --virtual .build-deps \
+		$PHPIZE_DEPS \
+		icu-dev \
+		libzip-dev \
+		postgresql-dev \
+		zlib-dev \
+	; \
+	\
+	docker-php-ext-configure zip; \
+	docker-php-ext-install -j$(nproc) \
+		intl \
+		pdo_pgsql \
+		zip \
+	; \
+	pecl install \
+		apcu-${APCU_VERSION} \
+	; \
+	pecl clear-cache; \
+	docker-php-ext-enable \
+		apcu \
+		opcache \
+	; \
+	\
+	runDeps="$( \
+		scanelf --needed --nobanner --format '%n#p' --recursive /usr/local/lib/php/extensions \
+			| tr ',' '\n' \
+			| sort -u \
+			| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
+	)"; \
+	apk add --no-cache --virtual .api-phpexts-rundeps $runDeps; \
+	\
+	apk del .build-deps
+
+COPY --from=composer:latest /usr/bin/composer /usr/bin/composer
+
+RUN ln -s $PHP_INI_DIR/php.ini-production $PHP_INI_DIR/php.ini
+COPY docker/php/conf.d/api-platform.prod.ini $PHP_INI_DIR/conf.d/api-platform.ini
+
+RUN set -eux; \
+	{ \
+		echo '[www]'; \
+		echo 'ping.path = /ping'; \
+	} | tee /usr/local/etc/php-fpm.d/docker-healthcheck.conf
+
+# https://getcomposer.org/doc/03-cli.md#composer-allow-superuser
+ENV COMPOSER_ALLOW_SUPERUSER=1
+# install Symfony Flex globally to speed up download of Composer packages (parallelized prefetching)
+RUN set -eux; \
+	composer global require "symfony/flex" --prefer-dist --no-progress --no-suggest --classmap-authoritative; \
+	composer clear-cache
+ENV PATH="${PATH}:/root/.composer/vendor/bin"
+
+WORKDIR /srv/api
+
+# build for production
+ARG APP_ENV=prod
+
+# prevent the reinstallation of vendors at every changes in the source code
+COPY composer.json composer.lock symfony.lock ./
+RUN set -eux; \
+	composer install --prefer-dist --no-dev --no-scripts --no-progress --no-suggest; \
+	composer clear-cache
+
+# do not use .env files in production
+COPY .env ./
+RUN composer dump-env prod; \
+	rm .env
+
+# copy only specifically what we need
+COPY bin bin/
+COPY config config/
+COPY public public/
+COPY src src/
+
+RUN set -eux; \
+	mkdir -p var/cache var/log; \
+	composer dump-autoload --classmap-authoritative --no-dev; \
+	composer run-script --no-dev post-install-cmd; \
+	chmod +x bin/console; sync
+VOLUME /srv/api/var
+
+COPY docker/php/docker-healthcheck.sh /usr/local/bin/docker-healthcheck
+RUN chmod +x /usr/local/bin/docker-healthcheck
+
+HEALTHCHECK --interval=10s --timeout=3s --retries=3 CMD ["docker-healthcheck"]
+
+COPY docker/php/docker-entrypoint.sh /usr/local/bin/docker-entrypoint
+RUN chmod +x /usr/local/bin/docker-entrypoint
+
+ENTRYPOINT ["docker-entrypoint"]
+CMD ["php-fpm"]
+
+
+# "nginx" stage
+# depends on the "php" stage above
+# The OpenResty distribution of NGINX is only needed for Kubernetes compatiblity (dynamic upstream resolution)
+FROM openresty/openresty:${OPENRESTY_VERSION}-alpine AS api_platform_nginx
+
+RUN echo -e "env UPSTREAM;\n$(cat /usr/local/openresty/nginx/conf/nginx.conf)" > /usr/local/openresty/nginx/conf/nginx.conf
+COPY docker/nginx/conf.d/default.conf /etc/nginx/conf.d/default.conf
+
+WORKDIR /srv/api/public
+
+COPY --from=api_platform_php /srv/api/public ./
+
+
+# "varnish" stage
+# does not depend on any of the above stages, but placed here to keep everything in one Dockerfile
+FROM varnish:${VARNISH_VERSION} AS api_platform_varnish
+
+COPY docker/varnish/conf/default.vcl /etc/varnish/default.vcl
+
+CMD ["varnishd", "-F", "-f", "/etc/varnish/default.vcl", "-p", "http_resp_hdr_len=65536", "-p", "http_resp_size=98304"]

api/bin/console

@@ -0,0 +1,42 @@
+#!/usr/bin/env php
+<?php
+
+use App\Kernel;
+use Symfony\Bundle\FrameworkBundle\Console\Application;
+use Symfony\Component\Console\Input\ArgvInput;
+use Symfony\Component\ErrorHandler\Debug;
+
+if (!in_array(PHP_SAPI, ['cli', 'phpdbg', 'embed'], true)) {
+    echo 'Warning: The console should be invoked via the CLI version of PHP, not the '.PHP_SAPI.' SAPI'.PHP_EOL;
+}
+
+set_time_limit(0);
+
+require dirname(__DIR__).'/vendor/autoload.php';
+
+if (!class_exists(Application::class)) {
+    throw new LogicException('You need to add "symfony/framework-bundle" as a Composer dependency.');
+}
+
+$input = new ArgvInput();
+if (null !== $env = $input->getParameterOption(['--env', '-e'], null, true)) {
+    putenv('APP_ENV='.$_SERVER['APP_ENV'] = $_ENV['APP_ENV'] = $env);
+}
+
+if ($input->hasParameterOption('--no-debug', true)) {
+    putenv('APP_DEBUG='.$_SERVER['APP_DEBUG'] = $_ENV['APP_DEBUG'] = '0');
+}
+
+require dirname(__DIR__).'/config/bootstrap.php';
+
+if ($_SERVER['APP_DEBUG']) {
+    umask(0000);
+
+    if (class_exists(Debug::class)) {
+        Debug::enable();
+    }
+}
+
+$kernel = new Kernel($_SERVER['APP_ENV'], (bool) $_SERVER['APP_DEBUG']);
+$application = new Application($kernel);
+$application->run($input);