Merge pull request #81 from guardicore/revert-73-feature/async-scan

Revert "Feature/async scan"

chaos_monkey/exploit/rdpgrinder.py

@@ -13,7 +13,7 @@ from exploit import HostExploiter
 from exploit.tools import HTTPTools, get_monkey_depth
 from exploit.tools import get_target_monkey
 from model import RDP_CMDLINE_HTTP_BITS, RDP_CMDLINE_HTTP_VBS
-from network.tools import check_tcp_port
+from network.tools import check_port_tcp
 from tools import build_monkey_commandline
 
 __author__ = 'hoffer'
@@ -245,7 +245,7 @@ class RdpExploiter(HostExploiter):
             return True
 
         if not self.host.os.get('type'):
-            is_open, _ = check_tcp_port(self.host.ip_addr, RDP_PORT)
+            is_open, _ = check_port_tcp(self.host.ip_addr, RDP_PORT)
             if is_open:
                 self.host.os['type'] = 'windows'
                 return True
@@ -254,7 +254,7 @@ class RdpExploiter(HostExploiter):
     def exploit_host(self):
         global g_reactor
 
-        is_open, _ = check_tcp_port(self.host.ip_addr, RDP_PORT)
+        is_open, _ = check_port_tcp(self.host.ip_addr, RDP_PORT)
         if not is_open:
             LOG.info("RDP port is closed on %r, skipping", self.host)
             return False

chaos_monkey/exploit/smbexec.py

@@ -7,7 +7,7 @@ from exploit import HostExploiter
 from exploit.tools import SmbTools, get_target_monkey, get_monkey_depth
 from model import MONKEY_CMDLINE_DETACHED_WINDOWS, DROPPER_CMDLINE_DETACHED_WINDOWS
 from network import SMBFinger
-from network.tools import check_tcp_port
+from network.tools import check_port_tcp
 from tools import build_monkey_commandline
 
 LOG = getLogger(__name__)
@@ -31,12 +31,12 @@ class SmbExploiter(HostExploiter):
             return True
 
         if not self.host.os.get('type'):
-            is_smb_open, _ = check_tcp_port(self.host.ip_addr, 445)
+            is_smb_open, _ = check_port_tcp(self.host.ip_addr, 445)
             if is_smb_open:
                 smb_finger = SMBFinger()
                 smb_finger.get_host_fingerprint(self.host)
             else:
-                is_nb_open, _ = check_tcp_port(self.host.ip_addr, 139)
+                is_nb_open, _ = check_port_tcp(self.host.ip_addr, 139)
                 if is_nb_open:
                     self.host.os['type'] = 'windows'
             return self.host.os.get('type') in self._TARGET_OS_TYPE

chaos_monkey/exploit/sshexec.py

@@ -7,7 +7,7 @@ import monkeyfs
 from exploit import HostExploiter
 from exploit.tools import get_target_monkey, get_monkey_depth
 from model import MONKEY_ARG
-from network.tools import check_tcp_port
+from network.tools import check_port_tcp
 from tools import build_monkey_commandline
 
 __author__ = 'hoffer'
@@ -41,7 +41,7 @@ class SSHExploiter(HostExploiter):
             if servdata.get('name') == 'ssh' and servkey.startswith('tcp-'):
                 port = int(servkey.replace('tcp-', ''))
 
-        is_open, _ = check_tcp_port(self.host.ip_addr, port)
+        is_open, _ = check_port_tcp(self.host.ip_addr, port)
         if not is_open:
             LOG.info("SSH port is closed on %r, skipping", self.host)
             return False

chaos_monkey/exploit/win_ms08_067.py

@@ -17,7 +17,7 @@ from impacket.dcerpc.v5 import transport
 from exploit.tools import SmbTools, get_target_monkey, get_monkey_depth
 from model import DROPPER_CMDLINE_WINDOWS, MONKEY_CMDLINE_WINDOWS
 from network import SMBFinger
-from network.tools import check_tcp_port
+from network.tools import check_port_tcp
 from tools import build_monkey_commandline
 from . import HostExploiter
 
@@ -168,7 +168,7 @@ class Ms08_067_Exploiter(HostExploiter):
 
         if not self.host.os.get('type') or (
                         self.host.os.get('type') in self._TARGET_OS_TYPE and not self.host.os.get('version')):
-            is_smb_open, _ = check_tcp_port(self.host.ip_addr, 445)
+            is_smb_open, _ = check_port_tcp(self.host.ip_addr, 445)
             if is_smb_open:
                 smb_finger = SMBFinger()
                 if smb_finger.get_host_fingerprint(self.host):

chaos_monkey/network/sshfinger.py

@@ -1,8 +1,7 @@
 import re
-
-from model.host import VictimHost
 from network import HostFinger
-from network.tools import check_tcp_port
+from network.tools import check_port_tcp
+from model.host import VictimHost
 
 SSH_PORT = 22
 SSH_SERVICE_DEFAULT = 'tcp-22'
@@ -39,7 +38,7 @@ class SSHFinger(HostFinger):
                 self._banner_match(name, host, banner)
                 return
 
-        is_open, banner = check_tcp_port(host.ip_addr, SSH_PORT, TIMEOUT, True)
+        is_open, banner = check_port_tcp(host.ip_addr, SSH_PORT, TIMEOUT, True)
 
         if is_open:
             host.services[SSH_SERVICE_DEFAULT] = {}

chaos_monkey/network/tcp_scanner.py

@@ -1,7 +1,8 @@
+import time
 from random import shuffle
-
 from network import HostScanner, HostFinger
-from network.tools import check_tcp_ports
+from model.host import VictimHost
+from network.tools import check_port_tcp
 
 __author__ = 'itamar'
 
@@ -16,24 +17,29 @@ class TcpScanner(HostScanner, HostFinger):
         return self.get_host_fingerprint(host, True)
 
     def get_host_fingerprint(self, host, only_one_port=False):
-        """
+        assert isinstance(host, VictimHost)
-        Scans a target host to see if it's alive using the tcp_target_ports specified in the configuration.
-        :param host: VictimHost structure
-        :param only_one_port: Currently unused.
-        :return: T/F if there is at least one open port. In addition, the host object is updated to mark those services as alive.
-        """
 
+        count = 0
         # maybe hide under really bad detection systems
         target_ports = self._config.tcp_target_ports[:]
         shuffle(target_ports)
 
-        ports, banners = check_tcp_ports(host.ip_addr, target_ports, self._config.tcp_scan_timeout / 1000.0)
+        for target_port in target_ports:
-        for target_port, banner in zip(ports, banners):
-            service = 'tcp-' + str(target_port)
-            host.services[service] = {}
-            if banner:
-                host.services[service]['banner'] = banner
-            if only_one_port:
-                break
 
-        return len(ports) != 0
+            is_open, banner = check_port_tcp(host.ip_addr,
+                                             target_port,
+                                             self._config.tcp_scan_timeout / 1000.0,
+                                             self._config.tcp_scan_get_banner)
+
+            if is_open:
+                count += 1
+                service = 'tcp-' + str(target_port)
+                host.services[service] = {}
+                if banner:
+                    host.services[service]['banner'] = banner
+                if only_one_port:
+                    break
+            else:
+                time.sleep(self._config.tcp_scan_interval / 1000.0)
+
+        return count != 0

chaos_monkey/network/tools.py

@@ -1,11 +1,9 @@
-import logging
-import select
 import socket
+import select
+import logging
 import struct
-import time
 
 DEFAULT_TIMEOUT = 10
-SLEEP_BETWEEN_POLL = 0.5
 BANNER_READ = 1024
 
 LOG = logging.getLogger(__name__)
@@ -34,18 +32,10 @@ def struct_unpack_tracker_string(data, index):
     """
     ascii_len = data[index:].find('\0')
     fmt = "%ds" % ascii_len
-    return struct_unpack_tracker(data, index, fmt)
+    return struct_unpack_tracker(data,index,fmt)
 
 
-def check_tcp_port(ip, port, timeout=DEFAULT_TIMEOUT, get_banner=False):
+def check_port_tcp(ip, port, timeout=DEFAULT_TIMEOUT, get_banner=False):
-    """
-    Checks if a given TCP port is open
-    :param ip: Target IP
-    :param port: Target Port
-    :param timeout: Timeout for socket connection
-    :param get_banner:  if true, pulls first BANNER_READ bytes from the socket.
-    :return: Tuple, T/F + banner if requested.
-    """
     sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
     sock.settimeout(timeout)
 
@@ -53,7 +43,7 @@ def check_tcp_port(ip, port, timeout=DEFAULT_TIMEOUT, get_banner=False):
         sock.connect((ip, port))
     except socket.timeout:
         return False, None
-    except socket.error as exc:
+    except socket.error, exc:
         LOG.debug("Check port: %s:%s, Exception: %s", ip, port, exc)
         return False, None
 
@@ -64,21 +54,14 @@ def check_tcp_port(ip, port, timeout=DEFAULT_TIMEOUT, get_banner=False):
             read_ready, _, _ = select.select([sock], [], [], timeout)
             if len(read_ready) > 0:
                 banner = sock.recv(BANNER_READ)
-    except socket.error:
+    except:
         pass
     
     sock.close()
     return True, banner
 
 
-def check_udp_port(ip, port, timeout=DEFAULT_TIMEOUT):
+def check_port_udp(ip, port, timeout=DEFAULT_TIMEOUT):
-    """
-    Checks if a given UDP port is open by checking if it replies to an empty message
-    :param ip:  Target IP
-    :param port: Target port
-    :param timeout: Timeout to wait
-    :return: Tuple, T/F + banner
-    """
     sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
     sock.settimeout(timeout)
     
@@ -89,71 +72,8 @@ def check_udp_port(ip, port, timeout=DEFAULT_TIMEOUT):
         sock.sendto("-", (ip, port))
         data, _ = sock.recvfrom(BANNER_READ)
         is_open = True
-    except socket.error:
+    except:
         pass
     sock.close()
 
     return is_open, data
-
-
-def check_tcp_ports(ip, ports, timeout=DEFAULT_TIMEOUT, get_banner=False):
-    """
-    Checks whether any of the given ports are open on a target IP.
-    :param ip:  IP of host to attack
-    :param ports: List of ports to attack. Must not be empty.
-    :param timeout: Amount of time to wait for connection.
-    :param get_banner: T/F if to get first packets from server
-    :return: list of open ports. If get_banner=True, then a matching list of banners.
-    """
-    sockets = [socket.socket(socket.AF_INET, socket.SOCK_STREAM) for _ in range(len(ports))]
-    [s.setblocking(0) for s in sockets]
-    port_attempts = []
-    try:
-        for sock, port in zip(sockets, ports):
-            LOG.debug("Connecting to port %d" % port)
-            err = sock.connect_ex((ip, port))
-            if err == 0:
-                port_attempts.append((port, sock))
-            if err == 10035:  # WSAEWOULDBLOCK is valid, see https://msdn.microsoft.com/en-us/library/windows/desktop/ms740668%28v=vs.85%29.aspx?f=255&MSPPError=-2147217396
-                port_attempts.append((port, sock))
-        if len(port_attempts) != 0:
-            num_replies = 0
-            timeout = int(round(timeout))  # clamp to integer, to avoid checking input
-            time_left = timeout
-            write_sockets = []
-            read_sockets = []
-            while num_replies != len(port_attempts):
-                # bad ports show up as err_sockets
-                read_sockets, write_sockets, err_sockets = \
-                    select.select(
-                        [s[1] for s in port_attempts],
-                        [s[1] for s in port_attempts],
-                        [s[1] for s in port_attempts],
-                        time_left)
-                # any read_socket is automatically a writesocket
-                num_replies = len(write_sockets) + len(err_sockets)
-                if num_replies == len(port_attempts) or time_left <= 0:
-                    break
-                else:
-                    time_left -= SLEEP_BETWEEN_POLL
-                    time.sleep(SLEEP_BETWEEN_POLL)
-
-            connected_ports_sockets = [x for x in port_attempts if x[1] in write_sockets]
-            LOG.debug(
-                "On host %s discovered the following ports %s" %
-                (str(ip), ",".join([str(x) for x in connected_ports_sockets])))
-            banners = []
-            if get_banner:
-                # read first X bytes
-                banners = [sock.recv(BANNER_READ) if sock in read_sockets else ""
-                           for port, sock in connected_ports_sockets]
-                pass
-            # try to cleanup
-            [s[1].close() for s in port_attempts]
-            return [port for port, sock in connected_ports_sockets], banners
-        else:
-            return [], []
-
-    except socket.error as exc:
-        LOG.warning("Exception when checking ports on host %s, Exception: %s", str(ip), exc)
-        return [], []

chaos_monkey/tunnel.py

@@ -8,7 +8,7 @@ from threading import Thread
 from model import VictimHost
 from network.firewall import app as firewall
 from network.info import local_ips, get_free_tcp_port
-from network.tools import check_tcp_port
+from network.tools import check_port_tcp
 from transport.base import get_last_serve_time
 
 __author__ = 'hoffer'
@@ -40,7 +40,7 @@ def _check_tunnel(address, port, existing_sock=None):
         sock = existing_sock
 
     LOG.debug("Checking tunnel %s:%s", address, port)
-    is_open, _ = check_tcp_port(address, int(port))
+    is_open, _ = check_port_tcp(address, int(port))
     if not is_open:
         LOG.debug("Could not connect to %s:%s", address, port)
         if not existing_sock: