Island: Reformat network scan parameters before sending to agent

monkey/monkey_island/cc/services/config.py

@@ -2,7 +2,7 @@ import collections
 import copy
 import functools
 import logging
-from typing import Dict
+from typing import Dict, List
 
 from jsonschema import Draft4Validator, validators
 
@@ -419,6 +419,7 @@ class ConfigService:
         ConfigService._remove_credentials_from_flat_config(config)
         ConfigService._format_payloads_from_flat_config(config)
         ConfigService._format_pbas_from_flat_config(config)
+        ConfigService._format_network_scan_from_flat_config(config)
 
     @staticmethod
     def _remove_credentials_from_flat_config(config: Dict):
@@ -462,3 +463,86 @@ class ConfigService:
         config.pop(flat_linux_filename_field, None)
         config.pop(flat_windows_command_field, None)
         config.pop(flat_windows_filename_field, None)
+
+    @staticmethod
+    def _format_network_scan_from_flat_config(config: Dict):
+        formatted_network_scan_config = {"tcp": {}, "icmp": {}, "targets": {}}
+
+        formatted_network_scan_config["tcp"] = ConfigService._format_tcp_scan_from_flat_config(
+            config
+        )
+        formatted_network_scan_config["icmp"] = ConfigService._format_icmp_scan_from_flat_config(
+            config
+        )
+        formatted_network_scan_config[
+            "targets"
+        ] = ConfigService._format_scan_targets_from_flat_config(config)
+
+        config["network_scan"] = formatted_network_scan_config
+
+    @staticmethod
+    def _format_tcp_scan_from_flat_config(config: Dict):
+        flat_http_ports_field = "HTTP_PORTS"
+        flat_tcp_timeout_field = "tcp_scan_timeout"
+        flat_tcp_ports_field = "tcp_target_ports"
+
+        formatted_tcp_scan_config = {}
+
+        formatted_tcp_scan_config["timeout"] = config[flat_tcp_timeout_field]
+
+        ports = ConfigService._union_tcp_and_http_ports(
+            config[flat_tcp_ports_field], config[flat_http_ports_field]
+        )
+        formatted_tcp_scan_config["ports"] = ports
+
+        # Do not remove HTTP_PORTS field. Other components besides scanning need it.
+        config.pop(flat_tcp_timeout_field, None)
+        config.pop(flat_tcp_ports_field, None)
+
+        return formatted_tcp_scan_config
+
+    @staticmethod
+    def _union_tcp_and_http_ports(tcp_ports: List[int], http_ports: List[int]) -> List[int]:
+        combined_ports = list(set(tcp_ports) | set(http_ports))
+
+        return sorted(combined_ports)
+
+    @staticmethod
+    def _format_icmp_scan_from_flat_config(config: Dict):
+        flat_ping_timeout_field = "ping_scan_timeout"
+
+        formatted_icmp_scan_config = {}
+        formatted_icmp_scan_config["timeout"] = config[flat_ping_timeout_field]
+
+        config.pop(flat_ping_timeout_field, None)
+
+        return formatted_icmp_scan_config
+
+    @staticmethod
+    def _format_scan_targets_from_flat_config(config: Dict):
+        flat_blocked_ips_field = "blocked_ips"
+        flat_inaccessible_subnets_field = "inaccessible_subnets"
+        flat_local_network_scan_field = "local_network_scan"
+        flat_subnet_scan_list_field = "subnet_scan_list"
+
+        formatted_scan_targets_config = {}
+
+        formatted_scan_targets_config[flat_blocked_ips_field] = config[
+            flat_blocked_ips_field
+        ]
+        formatted_scan_targets_config[flat_inaccessible_subnets_field] = config[
+            flat_inaccessible_subnets_field
+        ]
+        formatted_scan_targets_config[flat_local_network_scan_field] = config[
+            flat_local_network_scan_field
+        ]
+        formatted_scan_targets_config[flat_subnet_scan_list_field] = config[
+            flat_subnet_scan_list_field
+        ]
+
+        config.pop(flat_blocked_ips_field, None)
+        config.pop(flat_inaccessible_subnets_field, None)
+        config.pop(flat_local_network_scan_field, None)
+        config.pop(flat_subnet_scan_list_field, None)
+
+        return formatted_scan_targets_config

monkey/tests/data_for_tests/monkey_configs/flat_config.json

@@ -13,7 +13,7 @@
     "aws_access_key_id": "",
     "aws_secret_access_key": "",
     "aws_session_token": "",
-    "blocked_ips": [],
+    "blocked_ips": ["192.168.1.1", "192.168.1.100"],
     "command_servers": [
         "10.197.94.72:5000"
     ],
@@ -70,7 +70,7 @@
         "MSSQLFinger",
         "ElasticFinger"
     ],
-    "inaccessible_subnets": [],
+    "inaccessible_subnets": ["10.0.0.0/24", "10.0.10.0/24"],
     "keep_tunnel_open_time": 60,
     "local_network_scan": true,
     "max_depth": null,
@@ -100,7 +100,7 @@
     "skip_exploit_if_file_exist": false,
     "smb_download_timeout": 300,
     "smb_service_name": "InfectionMonkey",
-    "subnet_scan_list": [],
+    "subnet_scan_list": ["192.168.1.50", "192.168.56.0/24", "10.0.33.0/30"],
     "system_info_collector_classes": [
         "AwsCollector",
         "ProcessListCollector",

monkey/tests/unit_tests/monkey_island/cc/services/test_config.py

@@ -93,3 +93,47 @@ def test_get_config_propagation_credentials_from_flat_config(flat_monkey_config)
 
     creds = ConfigService.get_config_propagation_credentials_from_flat_config(flat_monkey_config)
     assert creds == expected_creds
+
+
+def test_format_config_for_agent__network_scan(flat_monkey_config):
+    expected_network_scan_config = {
+        "tcp": {
+            "timeout": 3000,
+            "ports": [
+                22,
+                80,
+                135,
+                443,
+                445,
+                2222,
+                3306,
+                3389,
+                7001,
+                8008,
+                8080,
+                8088,
+                9200,
+            ],
+        },
+        "icmp": {
+            "timeout": 1000,
+        },
+        "targets": {
+            "blocked_ips": ["192.168.1.1", "192.168.1.100"],
+            "inaccessible_subnets": ["10.0.0.0/24", "10.0.10.0/24"],
+            "local_network_scan": True,
+            "subnet_scan_list": ["192.168.1.50", "192.168.56.0/24", "10.0.33.0/30"],
+        },
+    }
+    ConfigService.format_flat_config_for_agent(flat_monkey_config)
+
+    assert "network_scan" in flat_monkey_config
+    assert flat_monkey_config["network_scan"] == expected_network_scan_config
+
+    assert "tcp_scan_timeout" not in flat_monkey_config
+    assert "tcp_target_ports" not in flat_monkey_config
+    assert "ping_scan_timeout" not in flat_monkey_config
+    assert "blocked_ips" not in flat_monkey_config
+    assert "inaccessible_subnets" not in flat_monkey_config
+    assert "local_network_scan" not in flat_monkey_config
+    assert "subnet_scan_list" not in flat_monkey_config