fix(3078, 3079): Resolve issues in Operations API Manager and Plugin Hooks

[HackedRico]

Description

This pull request uses the proposed fix in #3101 to address issues #3078 and #3079.

Prior to PR, adding a ability with Builder Plugin does not build Payload using Potential Links in a Operation. It requires the ability to be added to an Adversary, then creating a Operation from that Adversary. The changes made allows for dynamic compilation of Builder Plugin ability payloads when adding a Potential Link to a Operation during runtime.

Changes I Made to #3101

After testing the proposed fix, running an operation with an ability that doesn't utilize a plugin fails, and raises a AttributeError. Error Message:

AttributeError: 'NoneType' object has no attribute 'startswith'                                                                                                        
ERROR    'NoneType' object has no attribute 'startswith'

The error occurs because the implementation assumes that every ability uses the Builder Plugin for dynamic compilation. However, there are abilities that do not utilize the Builder Plugin. When the builder service attempts to build these abilities, it encounters a NoneType object where a payload or plugin-related attribute is expected.

TL;DR: Required conditional to validate an ability utilizes Builder Plugin

• caldera/app/api/v2/managers/operation_api_manager.py

  Line 177 in de989ef

  if executor.HOOKS and executor.language and executor.language in executor.HOOKS:

• caldera/app/service/planning_svc.py

  Line 395 in de989ef

  if executor.HOOKS and executor.language and executor.language in executor.HOOKS:

Full Logs: 3101_logs.txt

Type of change

Please delete options that are not relevant.

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

How Has This Been Tested?

I have tested these changes in Caldera v5.3.0 with a staged SandCat agent with abilities that use and not use Builder Plugin.

1. Adding a Potential Link to Operation using a POST Requested Ability that does not use Builder plugin executes successfully.

{
	"tactic": "curl",
	"technique_name": "curl",
	"technique_id": "curl",
	"name": "test_curl_regular",
	"description": "testing curl regular ability",
	"executors": [
		{
			"name": "sh",
			"platform": "linux",
			"command": "whoami",
			"code": null,
			"language": null,
			"build_target": null,
			"payloads": [],
			"uploads": [],
			"timeout": 60,
			"parsers": [],
			"cleanup": [],
			"variations": [],
			"additional_info": {}
		}
	],
	"requirements": [],
	"privilege": "",
	"repeatable": false,
	"buckets": [
		"curl"
	],
	"additional_info": {},
	"access": {},
	"singleton": false,
	"plugin": "",
	"delete_payload": true,
	"id": "86a058d5-c71d-409b-a4f3-209f534c71ce"
}

2. Adding a Potential Link to Operation using a POST Requested Ability that does use Builder plugin executes successfully, compiled payload, and planted on SandCat Agent system.

{
  "tactic": "curl",
  "technique_name": "curl",
  "technique_id": "curl",
  "name": "test_curl_builder_csharp",
  "description": "testing curl creation of builder ability",
  "executors": [
    {
      "name": "sh",
      "platform": "linux",
      "command": "./CSHelloWorld.sh",
      "code": "using System;\n\nnamespace HelloWorld\n{\n    class Program\n    {\n        static void Main(string[] args)\n        {\n            Console.WriteLine(\"Hello World!\");\n        }\n    }\n}\n",
      "language": "csharp",
      "build_target": "CSHelloWorld.sh",
      "payloads": [],
      "uploads": [],
      "timeout": 60,
      "parsers": [],
      "cleanup": [],
      "variations": [],
      "additional_info": {}
    }
  ],
  "requirements": [],
  "privilege": "",
  "repeatable": false,
  "buckets": [
    "curl"
  ],
  "additional_info": {},
  "access": {},
  "singleton": false,
  "plugin": "builder",
  "delete_payload": false,
  "id": "19a058d5-c71d-409b-a4f3-209f534c71rr"
}

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have made corresponding changes to the documentation
• I have added tests that prove my fix is effective or that my feature works