From c497962d9ee61298b39ce59ca9c540360a07c126 Mon Sep 17 00:00:00 2001 From: Mike Salvatore Date: Wed, 8 Dec 2021 15:28:10 -0500 Subject: [PATCH] Island: Reformat network scan parameters before sending to agent --- monkey/monkey_island/cc/services/config.py | 86 ++++++++++++++++++- .../monkey_configs/flat_config.json | 6 +- .../monkey_island/cc/services/test_config.py | 44 ++++++++++ 3 files changed, 132 insertions(+), 4 deletions(-) diff --git a/monkey/monkey_island/cc/services/config.py b/monkey/monkey_island/cc/services/config.py index 1daec8a76..3bc0a4f16 100644 --- a/monkey/monkey_island/cc/services/config.py +++ b/monkey/monkey_island/cc/services/config.py @@ -2,7 +2,7 @@ import collections import copy import functools import logging -from typing import Dict +from typing import Dict, List from jsonschema import Draft4Validator, validators @@ -419,6 +419,7 @@ class ConfigService: ConfigService._remove_credentials_from_flat_config(config) ConfigService._format_payloads_from_flat_config(config) ConfigService._format_pbas_from_flat_config(config) + ConfigService._format_network_scan_from_flat_config(config) @staticmethod def _remove_credentials_from_flat_config(config: Dict): @@ -462,3 +463,86 @@ class ConfigService: config.pop(flat_linux_filename_field, None) config.pop(flat_windows_command_field, None) config.pop(flat_windows_filename_field, None) + + @staticmethod + def _format_network_scan_from_flat_config(config: Dict): + formatted_network_scan_config = {"tcp": {}, "icmp": {}, "targets": {}} + + formatted_network_scan_config["tcp"] = ConfigService._format_tcp_scan_from_flat_config( + config + ) + formatted_network_scan_config["icmp"] = ConfigService._format_icmp_scan_from_flat_config( + config + ) + formatted_network_scan_config[ + "targets" + ] = ConfigService._format_scan_targets_from_flat_config(config) + + config["network_scan"] = formatted_network_scan_config + + @staticmethod + def _format_tcp_scan_from_flat_config(config: Dict): + flat_http_ports_field = "HTTP_PORTS" + flat_tcp_timeout_field = "tcp_scan_timeout" + flat_tcp_ports_field = "tcp_target_ports" + + formatted_tcp_scan_config = {} + + formatted_tcp_scan_config["timeout"] = config[flat_tcp_timeout_field] + + ports = ConfigService._union_tcp_and_http_ports( + config[flat_tcp_ports_field], config[flat_http_ports_field] + ) + formatted_tcp_scan_config["ports"] = ports + + # Do not remove HTTP_PORTS field. Other components besides scanning need it. + config.pop(flat_tcp_timeout_field, None) + config.pop(flat_tcp_ports_field, None) + + return formatted_tcp_scan_config + + @staticmethod + def _union_tcp_and_http_ports(tcp_ports: List[int], http_ports: List[int]) -> List[int]: + combined_ports = list(set(tcp_ports) | set(http_ports)) + + return sorted(combined_ports) + + @staticmethod + def _format_icmp_scan_from_flat_config(config: Dict): + flat_ping_timeout_field = "ping_scan_timeout" + + formatted_icmp_scan_config = {} + formatted_icmp_scan_config["timeout"] = config[flat_ping_timeout_field] + + config.pop(flat_ping_timeout_field, None) + + return formatted_icmp_scan_config + + @staticmethod + def _format_scan_targets_from_flat_config(config: Dict): + flat_blocked_ips_field = "blocked_ips" + flat_inaccessible_subnets_field = "inaccessible_subnets" + flat_local_network_scan_field = "local_network_scan" + flat_subnet_scan_list_field = "subnet_scan_list" + + formatted_scan_targets_config = {} + + formatted_scan_targets_config[flat_blocked_ips_field] = config[ + flat_blocked_ips_field + ] + formatted_scan_targets_config[flat_inaccessible_subnets_field] = config[ + flat_inaccessible_subnets_field + ] + formatted_scan_targets_config[flat_local_network_scan_field] = config[ + flat_local_network_scan_field + ] + formatted_scan_targets_config[flat_subnet_scan_list_field] = config[ + flat_subnet_scan_list_field + ] + + config.pop(flat_blocked_ips_field, None) + config.pop(flat_inaccessible_subnets_field, None) + config.pop(flat_local_network_scan_field, None) + config.pop(flat_subnet_scan_list_field, None) + + return formatted_scan_targets_config diff --git a/monkey/tests/data_for_tests/monkey_configs/flat_config.json b/monkey/tests/data_for_tests/monkey_configs/flat_config.json index 8edb45a86..031dfd35a 100644 --- a/monkey/tests/data_for_tests/monkey_configs/flat_config.json +++ b/monkey/tests/data_for_tests/monkey_configs/flat_config.json @@ -13,7 +13,7 @@ "aws_access_key_id": "", "aws_secret_access_key": "", "aws_session_token": "", - "blocked_ips": [], + "blocked_ips": ["192.168.1.1", "192.168.1.100"], "command_servers": [ "10.197.94.72:5000" ], @@ -70,7 +70,7 @@ "MSSQLFinger", "ElasticFinger" ], - "inaccessible_subnets": [], + "inaccessible_subnets": ["10.0.0.0/24", "10.0.10.0/24"], "keep_tunnel_open_time": 60, "local_network_scan": true, "max_depth": null, @@ -100,7 +100,7 @@ "skip_exploit_if_file_exist": false, "smb_download_timeout": 300, "smb_service_name": "InfectionMonkey", - "subnet_scan_list": [], + "subnet_scan_list": ["192.168.1.50", "192.168.56.0/24", "10.0.33.0/30"], "system_info_collector_classes": [ "AwsCollector", "ProcessListCollector", diff --git a/monkey/tests/unit_tests/monkey_island/cc/services/test_config.py b/monkey/tests/unit_tests/monkey_island/cc/services/test_config.py index 1aece8180..ec78ad054 100644 --- a/monkey/tests/unit_tests/monkey_island/cc/services/test_config.py +++ b/monkey/tests/unit_tests/monkey_island/cc/services/test_config.py @@ -93,3 +93,47 @@ def test_get_config_propagation_credentials_from_flat_config(flat_monkey_config) creds = ConfigService.get_config_propagation_credentials_from_flat_config(flat_monkey_config) assert creds == expected_creds + + +def test_format_config_for_agent__network_scan(flat_monkey_config): + expected_network_scan_config = { + "tcp": { + "timeout": 3000, + "ports": [ + 22, + 80, + 135, + 443, + 445, + 2222, + 3306, + 3389, + 7001, + 8008, + 8080, + 8088, + 9200, + ], + }, + "icmp": { + "timeout": 1000, + }, + "targets": { + "blocked_ips": ["192.168.1.1", "192.168.1.100"], + "inaccessible_subnets": ["10.0.0.0/24", "10.0.10.0/24"], + "local_network_scan": True, + "subnet_scan_list": ["192.168.1.50", "192.168.56.0/24", "10.0.33.0/30"], + }, + } + ConfigService.format_flat_config_for_agent(flat_monkey_config) + + assert "network_scan" in flat_monkey_config + assert flat_monkey_config["network_scan"] == expected_network_scan_config + + assert "tcp_scan_timeout" not in flat_monkey_config + assert "tcp_target_ports" not in flat_monkey_config + assert "ping_scan_timeout" not in flat_monkey_config + assert "blocked_ips" not in flat_monkey_config + assert "inaccessible_subnets" not in flat_monkey_config + assert "local_network_scan" not in flat_monkey_config + assert "subnet_scan_list" not in flat_monkey_config