From 4116ebd24d4422ae219107a9b10ce79e07e1b552 Mon Sep 17 00:00:00 2001 From: Shreya Malviya Date: Tue, 26 Jul 2022 14:38:03 +0530 Subject: [PATCH 01/21] Common: Add docstring to CustomPBAConfiguration dataclass --- .../agent_sub_configurations.py | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/monkey/common/agent_configuration/agent_sub_configurations.py b/monkey/common/agent_configuration/agent_sub_configurations.py index ad321b3d0..d49bf970e 100644 --- a/monkey/common/agent_configuration/agent_sub_configurations.py +++ b/monkey/common/agent_configuration/agent_sub_configurations.py @@ -4,6 +4,24 @@ from typing import Dict, Tuple @dataclass(frozen=True) class CustomPBAConfiguration: + """ + Dataclass for the configuration of custom post-breach actions + + Attributes: + linux_command (str): Command to run on Linux victim machines. If a file is uploaded, + use this field to change its permissions, execute it, and/or delete + it. + Example: `chmod +x file.sh; ./file.sh; rm file.sh` + linux_filename (str): Name of the file to upload and run on Linux victim machines. + Example: `i-am-custom-pba-file.sh` + windows_command (str): Command to run on Windows victim machines. If a file is uploaded, + use this field to change its permissions, execute it, and/or delete + it. + Example: `file.bat & del file.bat` + windows_filename (str): Name of the file to upload and run on Windows victim machines. + Example: `i-am-custom-pba-file.bat` + """ + linux_command: str linux_filename: str windows_command: str From 626720ff9fd5ee9dee7bcb92629081e969359934 Mon Sep 17 00:00:00 2001 From: Shreya Malviya Date: Tue, 26 Jul 2022 16:10:20 +0530 Subject: [PATCH 02/21] Common: Add filename validation to CustomPBAConfigurationSchema --- .../agent_sub_configuration_schemas.py | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/monkey/common/agent_configuration/agent_sub_configuration_schemas.py b/monkey/common/agent_configuration/agent_sub_configuration_schemas.py index 0e4654406..7593b69e9 100644 --- a/monkey/common/agent_configuration/agent_sub_configuration_schemas.py +++ b/monkey/common/agent_configuration/agent_sub_configuration_schemas.py @@ -1,4 +1,6 @@ -from marshmallow import Schema, fields, post_load +import re + +from marshmallow import Schema, fields, post_load, validate from .agent_sub_configurations import ( CustomPBAConfiguration, @@ -13,12 +15,14 @@ from .agent_sub_configurations import ( ) from .utils import freeze_lists +valid_custom_pba_filename_regex = re.compile(r"^([a-zA-Z0-9\ \._-]+)$") + class CustomPBAConfigurationSchema(Schema): linux_command = fields.Str() - linux_filename = fields.Str() + linux_filename = fields.Str(validate=validate.Regexp(regex=valid_custom_pba_filename_regex)) windows_command = fields.Str() - windows_filename = fields.Str() + windows_filename = fields.Str(validate=validate.Regexp(regex=valid_custom_pba_filename_regex)) @post_load def _make_custom_pba_configuration(self, data, **kwargs): From bcf7a2e8ff95b6eda3d3dc0a7eb914caaea77de7 Mon Sep 17 00:00:00 2001 From: Shreya Malviya Date: Tue, 26 Jul 2022 16:14:52 +0530 Subject: [PATCH 03/21] Common: Change CustomPBAConfigriguration's filename validation to allow empty strings --- .../agent_configuration/agent_sub_configuration_schemas.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/monkey/common/agent_configuration/agent_sub_configuration_schemas.py b/monkey/common/agent_configuration/agent_sub_configuration_schemas.py index 7593b69e9..b1ae1c458 100644 --- a/monkey/common/agent_configuration/agent_sub_configuration_schemas.py +++ b/monkey/common/agent_configuration/agent_sub_configuration_schemas.py @@ -15,7 +15,7 @@ from .agent_sub_configurations import ( ) from .utils import freeze_lists -valid_custom_pba_filename_regex = re.compile(r"^([a-zA-Z0-9\ \._-]+)$") +valid_custom_pba_filename_regex = re.compile(r"^([a-zA-Z0-9\ \._-]*)$") class CustomPBAConfigurationSchema(Schema): From 83e56a9028e8759eec66ca1b78f439d63ef75ff7 Mon Sep 17 00:00:00 2001 From: Shreya Malviya Date: Tue, 26 Jul 2022 16:30:10 +0530 Subject: [PATCH 04/21] UT: Add tests for CustomPBAConfiguration filename validation --- .../configuration/test_agent_configuration.py | 25 +++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/monkey/tests/unit_tests/common/configuration/test_agent_configuration.py b/monkey/tests/unit_tests/common/configuration/test_agent_configuration.py index d2029d84a..962d2cd4c 100644 --- a/monkey/tests/unit_tests/common/configuration/test_agent_configuration.py +++ b/monkey/tests/unit_tests/common/configuration/test_agent_configuration.py @@ -2,6 +2,7 @@ import json from copy import deepcopy import pytest +from marshmallow import ValidationError from tests.common.example_agent_configuration import ( AGENT_CONFIGURATION, BLOCKED_IPS, @@ -68,6 +69,30 @@ def test_custom_pba_configuration_schema(): assert config.windows_filename == WINDOWS_FILENAME +def test_custom_pba_configuration_schema__empty_filename_allowed(): + schema = CustomPBAConfigurationSchema() + + empty_filename_configuration = CUSTOM_PBA_CONFIGURATION.copy() + empty_filename_configuration.update({"linux_filename": ""}) + + config = schema.load(empty_filename_configuration) + + assert config.linux_command == LINUX_COMMAND + assert config.linux_filename == "" + assert config.windows_command == WINDOWS_COMMAND + assert config.windows_filename == WINDOWS_FILENAME + + +def test_custom_pba_configuration_schema__invalid_filename(): + schema = CustomPBAConfigurationSchema() + + invalid_filename_configuration = CUSTOM_PBA_CONFIGURATION.copy() + invalid_filename_configuration["linux_filename"] = "???" + + with pytest.raises(ValidationError): + schema.load(invalid_filename_configuration) + + def test_scan_target_configuration(): schema = ScanTargetConfigurationSchema() From 5b9ba9cd271b4c807ff811165e83c01c129535b5 Mon Sep 17 00:00:00 2001 From: Shreya Malviya Date: Tue, 26 Jul 2022 16:34:00 +0530 Subject: [PATCH 05/21] Common: Fix wording in CustomPBAConfiguration docstring --- monkey/common/agent_configuration/agent_sub_configurations.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/monkey/common/agent_configuration/agent_sub_configurations.py b/monkey/common/agent_configuration/agent_sub_configurations.py index d49bf970e..b4c2177d3 100644 --- a/monkey/common/agent_configuration/agent_sub_configurations.py +++ b/monkey/common/agent_configuration/agent_sub_configurations.py @@ -12,13 +12,13 @@ class CustomPBAConfiguration: use this field to change its permissions, execute it, and/or delete it. Example: `chmod +x file.sh; ./file.sh; rm file.sh` - linux_filename (str): Name of the file to upload and run on Linux victim machines. + linux_filename (str): Name of the file to upload on Linux victim machines. Example: `i-am-custom-pba-file.sh` windows_command (str): Command to run on Windows victim machines. If a file is uploaded, use this field to change its permissions, execute it, and/or delete it. Example: `file.bat & del file.bat` - windows_filename (str): Name of the file to upload and run on Windows victim machines. + windows_filename (str): Name of the file to upload on Windows victim machines. Example: `i-am-custom-pba-file.bat` """ From e7d9ed88bea012aa485e0f968231ae58b2224f8b Mon Sep 17 00:00:00 2001 From: Shreya Malviya Date: Tue, 26 Jul 2022 17:28:40 +0530 Subject: [PATCH 06/21] UT: Add Windows tests for CustomPBAConfiguration filename validation --- .../configuration/test_agent_configuration.py | 20 ++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/monkey/tests/unit_tests/common/configuration/test_agent_configuration.py b/monkey/tests/unit_tests/common/configuration/test_agent_configuration.py index 962d2cd4c..1991e726e 100644 --- a/monkey/tests/unit_tests/common/configuration/test_agent_configuration.py +++ b/monkey/tests/unit_tests/common/configuration/test_agent_configuration.py @@ -69,25 +69,35 @@ def test_custom_pba_configuration_schema(): assert config.windows_filename == WINDOWS_FILENAME -def test_custom_pba_configuration_schema__empty_filename_allowed(): +def test_custom_pba_configuration_schema__empty_filenames_allowed(): schema = CustomPBAConfigurationSchema() empty_filename_configuration = CUSTOM_PBA_CONFIGURATION.copy() - empty_filename_configuration.update({"linux_filename": ""}) + empty_filename_configuration.update({"linux_filename": "", "windows_filename": ""}) config = schema.load(empty_filename_configuration) assert config.linux_command == LINUX_COMMAND assert config.linux_filename == "" assert config.windows_command == WINDOWS_COMMAND - assert config.windows_filename == WINDOWS_FILENAME + assert config.windows_filename == "" -def test_custom_pba_configuration_schema__invalid_filename(): +def test_custom_pba_configuration_schema__invalid_linux_filename(): schema = CustomPBAConfigurationSchema() invalid_filename_configuration = CUSTOM_PBA_CONFIGURATION.copy() - invalid_filename_configuration["linux_filename"] = "???" + invalid_filename_configuration["linux_filename"] = "\\" + + with pytest.raises(ValidationError): + schema.load(invalid_filename_configuration) + + +def test_custom_pba_configuration_schema__invalid_windows_filename(): + schema = CustomPBAConfigurationSchema() + + invalid_filename_configuration = CUSTOM_PBA_CONFIGURATION.copy() + invalid_filename_configuration["windows_filename"] = "?" with pytest.raises(ValidationError): schema.load(invalid_filename_configuration) From 5063512764ef3388701e1cd958f6eaf3b5926388 Mon Sep 17 00:00:00 2001 From: Shreya Malviya Date: Tue, 26 Jul 2022 17:29:20 +0530 Subject: [PATCH 07/21] Common: Remove filename examples from CustomPBAConfiuration docstring --- monkey/common/agent_configuration/agent_sub_configurations.py | 2 -- 1 file changed, 2 deletions(-) diff --git a/monkey/common/agent_configuration/agent_sub_configurations.py b/monkey/common/agent_configuration/agent_sub_configurations.py index b4c2177d3..bc6c60397 100644 --- a/monkey/common/agent_configuration/agent_sub_configurations.py +++ b/monkey/common/agent_configuration/agent_sub_configurations.py @@ -13,13 +13,11 @@ class CustomPBAConfiguration: it. Example: `chmod +x file.sh; ./file.sh; rm file.sh` linux_filename (str): Name of the file to upload on Linux victim machines. - Example: `i-am-custom-pba-file.sh` windows_command (str): Command to run on Windows victim machines. If a file is uploaded, use this field to change its permissions, execute it, and/or delete it. Example: `file.bat & del file.bat` windows_filename (str): Name of the file to upload on Windows victim machines. - Example: `i-am-custom-pba-file.bat` """ linux_command: str From 52643315e22f5e61b55ffee315340432dc08b6de Mon Sep 17 00:00:00 2001 From: Shreya Malviya Date: Tue, 26 Jul 2022 17:30:01 +0530 Subject: [PATCH 08/21] Common: Reword CustomPBAConfiguration docstring description --- monkey/common/agent_configuration/agent_sub_configurations.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/monkey/common/agent_configuration/agent_sub_configurations.py b/monkey/common/agent_configuration/agent_sub_configurations.py index bc6c60397..9da21641c 100644 --- a/monkey/common/agent_configuration/agent_sub_configurations.py +++ b/monkey/common/agent_configuration/agent_sub_configurations.py @@ -5,7 +5,7 @@ from typing import Dict, Tuple @dataclass(frozen=True) class CustomPBAConfiguration: """ - Dataclass for the configuration of custom post-breach actions + A configuration for custom post-breach actions Attributes: linux_command (str): Command to run on Linux victim machines. If a file is uploaded, From f823e9c7aee1bedbbca41d60b5acbb9b751cca9f Mon Sep 17 00:00:00 2001 From: Shreya Malviya Date: Tue, 26 Jul 2022 17:31:21 +0530 Subject: [PATCH 09/21] Common: Modify docstring format in CustomPBAConfiguration --- .../agent_sub_configurations.py | 20 +++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/monkey/common/agent_configuration/agent_sub_configurations.py b/monkey/common/agent_configuration/agent_sub_configurations.py index 9da21641c..4dbd9a3f2 100644 --- a/monkey/common/agent_configuration/agent_sub_configurations.py +++ b/monkey/common/agent_configuration/agent_sub_configurations.py @@ -8,16 +8,16 @@ class CustomPBAConfiguration: A configuration for custom post-breach actions Attributes: - linux_command (str): Command to run on Linux victim machines. If a file is uploaded, - use this field to change its permissions, execute it, and/or delete - it. - Example: `chmod +x file.sh; ./file.sh; rm file.sh` - linux_filename (str): Name of the file to upload on Linux victim machines. - windows_command (str): Command to run on Windows victim machines. If a file is uploaded, - use this field to change its permissions, execute it, and/or delete - it. - Example: `file.bat & del file.bat` - windows_filename (str): Name of the file to upload on Windows victim machines. + :param linux_command: Command to run on Linux victim machines. If a file is uploaded, + use this field to change its permissions, execute it, and/or delete + it. + Example: `chmod +x file.sh; ./file.sh; rm file.sh` + :param linux_filename: Name of the file to upload on Linux victim machines. + :param windows_command: Command to run on Windows victim machines. If a file is uploaded, + use this field to change its permissions, execute it, and/or delete + it. + Example: `file.bat & del file.bat` + :param windows_filename: Name of the file to upload on Windows victim machines. """ linux_command: str From cacfb7755d9f152b9b1643ee4762a3648efa0a00 Mon Sep 17 00:00:00 2001 From: Shreya Malviya Date: Tue, 26 Jul 2022 17:47:54 +0530 Subject: [PATCH 10/21] Common: Seperate regex for Windows and Linux filenames in CustomPBAConfigurationSchema --- .../agent_sub_configuration_schemas.py | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/monkey/common/agent_configuration/agent_sub_configuration_schemas.py b/monkey/common/agent_configuration/agent_sub_configuration_schemas.py index b1ae1c458..aaece7067 100644 --- a/monkey/common/agent_configuration/agent_sub_configuration_schemas.py +++ b/monkey/common/agent_configuration/agent_sub_configuration_schemas.py @@ -15,14 +15,19 @@ from .agent_sub_configurations import ( ) from .utils import freeze_lists -valid_custom_pba_filename_regex = re.compile(r"^([a-zA-Z0-9\ \._-]*)$") +valid_windows_custom_pba_filename_regex = re.compile(r"^[^<>:\"\\\/|?*]+[^<>:\"\\\/|?* \.]$") +valid_linux_custom_pba_filename_regex = re.compile(r"^[^\\]+$") class CustomPBAConfigurationSchema(Schema): linux_command = fields.Str() - linux_filename = fields.Str(validate=validate.Regexp(regex=valid_custom_pba_filename_regex)) + linux_filename = fields.Str( + validate=validate.Regexp(regex=valid_linux_custom_pba_filename_regex) + ) windows_command = fields.Str() - windows_filename = fields.Str(validate=validate.Regexp(regex=valid_custom_pba_filename_regex)) + windows_filename = fields.Str( + validate=validate.Regexp(regex=valid_windows_custom_pba_filename_regex) + ) @post_load def _make_custom_pba_configuration(self, data, **kwargs): From 2b56f039eeade6476afadacf005ec47e9f2763d0 Mon Sep 17 00:00:00 2001 From: Shreya Malviya Date: Tue, 26 Jul 2022 18:10:45 +0530 Subject: [PATCH 11/21] Common: Add reserved filename validation for Windows in CustomPBAConfigurationSchema --- .../agent_sub_configuration_schemas.py | 31 ++++++++++++++++++- 1 file changed, 30 insertions(+), 1 deletion(-) diff --git a/monkey/common/agent_configuration/agent_sub_configuration_schemas.py b/monkey/common/agent_configuration/agent_sub_configuration_schemas.py index aaece7067..e3f2fe16a 100644 --- a/monkey/common/agent_configuration/agent_sub_configuration_schemas.py +++ b/monkey/common/agent_configuration/agent_sub_configuration_schemas.py @@ -1,6 +1,6 @@ import re -from marshmallow import Schema, fields, post_load, validate +from marshmallow import Schema, ValidationError, fields, post_load, validate, validates from .agent_sub_configurations import ( CustomPBAConfiguration, @@ -29,6 +29,35 @@ class CustomPBAConfigurationSchema(Schema): validate=validate.Regexp(regex=valid_windows_custom_pba_filename_regex) ) + @validates("windows_filename") + def validate_windows_filename_not_reserved(self, windows_filename): + # filename shouldn't start with any of these and be followed by a period + if windows_filename.split(".")[0].upper() in [ + "CON", + "PRN", + "AUX", + "NUL", + "COM1", + "COM2", + "COM3", + "COM4", + "COM5", + "COM6", + "COM7", + "COM8", + "COM9", + "LPT1", + "LPT2", + "LPT3", + "LPT4", + "LPT5", + "LPT6", + "LPT7", + "LPT8", + "LPT9", + ]: + raise ValidationError("Invalid Windows filename: reserved name used") + @post_load def _make_custom_pba_configuration(self, data, **kwargs): return CustomPBAConfiguration(**data) From 9c7b69dd7b5bf9f3625ef438747a66d26aa8ecf3 Mon Sep 17 00:00:00 2001 From: Shreya Malviya Date: Tue, 26 Jul 2022 18:11:27 +0530 Subject: [PATCH 12/21] Project: Add 'validate_windows_filename_not_reserved' to Vulture's allowlist --- vulture_allowlist.py | 1 + 1 file changed, 1 insertion(+) diff --git a/vulture_allowlist.py b/vulture_allowlist.py index bca89e07b..2ef02daaa 100644 --- a/vulture_allowlist.py +++ b/vulture_allowlist.py @@ -251,3 +251,4 @@ IFindingRepository.get_findings key_list simulation netmap +validate_windows_filename_not_reserved From 8d84bdafe18e6d6f4d1f3a3b93775aaf50f264bc Mon Sep 17 00:00:00 2001 From: Shreya Malviya Date: Tue, 26 Jul 2022 18:13:23 +0530 Subject: [PATCH 13/21] Common: Modify filename validation regex in CustomPBAConfigurationSchema to allow empty strings --- .../agent_configuration/agent_sub_configuration_schemas.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/monkey/common/agent_configuration/agent_sub_configuration_schemas.py b/monkey/common/agent_configuration/agent_sub_configuration_schemas.py index e3f2fe16a..50593da83 100644 --- a/monkey/common/agent_configuration/agent_sub_configuration_schemas.py +++ b/monkey/common/agent_configuration/agent_sub_configuration_schemas.py @@ -15,8 +15,8 @@ from .agent_sub_configurations import ( ) from .utils import freeze_lists -valid_windows_custom_pba_filename_regex = re.compile(r"^[^<>:\"\\\/|?*]+[^<>:\"\\\/|?* \.]$") -valid_linux_custom_pba_filename_regex = re.compile(r"^[^\\]+$") +valid_windows_custom_pba_filename_regex = re.compile(r"^[^<>:\"\\\/|?*]+[^<>:\"\\\/|?* \.]$|^$") +valid_linux_custom_pba_filename_regex = re.compile(r"^[^\\]+$|^$") class CustomPBAConfigurationSchema(Schema): From c4b5e9fb2d151ce35c0776ddfc2c03e872b75a98 Mon Sep 17 00:00:00 2001 From: Shreya Malviya Date: Tue, 26 Jul 2022 18:27:10 +0530 Subject: [PATCH 14/21] Common: Fix Windows filename regex in CustomPBAConfigurationSchema validation --- .../agent_configuration/agent_sub_configuration_schemas.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/monkey/common/agent_configuration/agent_sub_configuration_schemas.py b/monkey/common/agent_configuration/agent_sub_configuration_schemas.py index 50593da83..11ae8cd70 100644 --- a/monkey/common/agent_configuration/agent_sub_configuration_schemas.py +++ b/monkey/common/agent_configuration/agent_sub_configuration_schemas.py @@ -15,7 +15,7 @@ from .agent_sub_configurations import ( ) from .utils import freeze_lists -valid_windows_custom_pba_filename_regex = re.compile(r"^[^<>:\"\\\/|?*]+[^<>:\"\\\/|?* \.]$|^$") +valid_windows_custom_pba_filename_regex = re.compile(r"^[^<>:\"\\\/|?*]*[^<>:\"\\\/|?* \.]+$|^$") valid_linux_custom_pba_filename_regex = re.compile(r"^[^\\]+$|^$") From 80d3aec1f8a3153ba36dd5989556e7f532ff33b1 Mon Sep 17 00:00:00 2001 From: Shreya Malviya Date: Tue, 26 Jul 2022 18:30:46 +0530 Subject: [PATCH 15/21] Common: Simplify filename validation regex in CustomPBAConfigurationSchema --- .../agent_configuration/agent_sub_configuration_schemas.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/monkey/common/agent_configuration/agent_sub_configuration_schemas.py b/monkey/common/agent_configuration/agent_sub_configuration_schemas.py index 11ae8cd70..979f2b401 100644 --- a/monkey/common/agent_configuration/agent_sub_configuration_schemas.py +++ b/monkey/common/agent_configuration/agent_sub_configuration_schemas.py @@ -16,7 +16,7 @@ from .agent_sub_configurations import ( from .utils import freeze_lists valid_windows_custom_pba_filename_regex = re.compile(r"^[^<>:\"\\\/|?*]*[^<>:\"\\\/|?* \.]+$|^$") -valid_linux_custom_pba_filename_regex = re.compile(r"^[^\\]+$|^$") +valid_linux_custom_pba_filename_regex = re.compile(r"^[^\\]*$") class CustomPBAConfigurationSchema(Schema): From 58ce293909b95510b7b507d9dab0604728c087f5 Mon Sep 17 00:00:00 2001 From: Shreya Malviya Date: Tue, 26 Jul 2022 18:38:44 +0530 Subject: [PATCH 16/21] UT: Add cases to CustomPBAConfigurationSchema filename validation tests --- .../common/configuration/test_agent_configuration.py | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/monkey/tests/unit_tests/common/configuration/test_agent_configuration.py b/monkey/tests/unit_tests/common/configuration/test_agent_configuration.py index 1991e726e..7941b9c17 100644 --- a/monkey/tests/unit_tests/common/configuration/test_agent_configuration.py +++ b/monkey/tests/unit_tests/common/configuration/test_agent_configuration.py @@ -83,21 +83,25 @@ def test_custom_pba_configuration_schema__empty_filenames_allowed(): assert config.windows_filename == "" -def test_custom_pba_configuration_schema__invalid_linux_filename(): +@pytest.mark.parametrize("linux_filename", ["\\", "\\\\\\"]) +def test_custom_pba_configuration_schema__invalid_linux_filename(linux_filename): schema = CustomPBAConfigurationSchema() invalid_filename_configuration = CUSTOM_PBA_CONFIGURATION.copy() - invalid_filename_configuration["linux_filename"] = "\\" + invalid_filename_configuration["linux_filename"] = linux_filename with pytest.raises(ValidationError): schema.load(invalid_filename_configuration) -def test_custom_pba_configuration_schema__invalid_windows_filename(): +@pytest.mark.parametrize( + "windows_filename", ["CON", "CON.txt", "con.abc.pdf", " ", "abc.", "a?b", "d\\e"] +) +def test_custom_pba_configuration_schema__invalid_windows_filename(windows_filename): schema = CustomPBAConfigurationSchema() invalid_filename_configuration = CUSTOM_PBA_CONFIGURATION.copy() - invalid_filename_configuration["windows_filename"] = "?" + invalid_filename_configuration["windows_filename"] = windows_filename with pytest.raises(ValidationError): schema.load(invalid_filename_configuration) From a9b9a13c404e56da25d1e1d22f12748d9875d6ca Mon Sep 17 00:00:00 2001 From: Shreya Malviya Date: Tue, 26 Jul 2022 18:52:17 +0530 Subject: [PATCH 17/21] Common: Update CustomPBAConfigurationSchema's linux filename validation regex to prevent null bytes --- .../agent_configuration/agent_sub_configuration_schemas.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/monkey/common/agent_configuration/agent_sub_configuration_schemas.py b/monkey/common/agent_configuration/agent_sub_configuration_schemas.py index 979f2b401..d60e31b6e 100644 --- a/monkey/common/agent_configuration/agent_sub_configuration_schemas.py +++ b/monkey/common/agent_configuration/agent_sub_configuration_schemas.py @@ -16,7 +16,7 @@ from .agent_sub_configurations import ( from .utils import freeze_lists valid_windows_custom_pba_filename_regex = re.compile(r"^[^<>:\"\\\/|?*]*[^<>:\"\\\/|?* \.]+$|^$") -valid_linux_custom_pba_filename_regex = re.compile(r"^[^\\]*$") +valid_linux_custom_pba_filename_regex = re.compile(r"^[^\0\\]*$") class CustomPBAConfigurationSchema(Schema): From 35c2cf26e8b8605d7eb17a2879ff760d6e9a096e Mon Sep 17 00:00:00 2001 From: Shreya Malviya Date: Tue, 26 Jul 2022 18:52:59 +0530 Subject: [PATCH 18/21] UT: Add null byte case in CustomPBAConfigurationSchema linux filename validation test --- .../unit_tests/common/configuration/test_agent_configuration.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/monkey/tests/unit_tests/common/configuration/test_agent_configuration.py b/monkey/tests/unit_tests/common/configuration/test_agent_configuration.py index 7941b9c17..f32337e71 100644 --- a/monkey/tests/unit_tests/common/configuration/test_agent_configuration.py +++ b/monkey/tests/unit_tests/common/configuration/test_agent_configuration.py @@ -83,7 +83,7 @@ def test_custom_pba_configuration_schema__empty_filenames_allowed(): assert config.windows_filename == "" -@pytest.mark.parametrize("linux_filename", ["\\", "\\\\\\"]) +@pytest.mark.parametrize("linux_filename", ["\\", "\\\\\\", "\0"]) def test_custom_pba_configuration_schema__invalid_linux_filename(linux_filename): schema = CustomPBAConfigurationSchema() From a017a661370b07f83d4fa9f2ba0cebcbe8db0c2d Mon Sep 17 00:00:00 2001 From: Shreya Malviya Date: Tue, 26 Jul 2022 19:01:07 +0530 Subject: [PATCH 19/21] Common: Fix CustomPBAConfigurationSchema's linux filename validation regex to check for forward slashes instead of back slashes --- .../agent_configuration/agent_sub_configuration_schemas.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/monkey/common/agent_configuration/agent_sub_configuration_schemas.py b/monkey/common/agent_configuration/agent_sub_configuration_schemas.py index d60e31b6e..3c46cd0fe 100644 --- a/monkey/common/agent_configuration/agent_sub_configuration_schemas.py +++ b/monkey/common/agent_configuration/agent_sub_configuration_schemas.py @@ -16,7 +16,7 @@ from .agent_sub_configurations import ( from .utils import freeze_lists valid_windows_custom_pba_filename_regex = re.compile(r"^[^<>:\"\\\/|?*]*[^<>:\"\\\/|?* \.]+$|^$") -valid_linux_custom_pba_filename_regex = re.compile(r"^[^\0\\]*$") +valid_linux_custom_pba_filename_regex = re.compile(r"^[^\0/]*$") class CustomPBAConfigurationSchema(Schema): From 8361ed14534bf68a8228a8c3d794b2ff9f0a41f8 Mon Sep 17 00:00:00 2001 From: Shreya Malviya Date: Tue, 26 Jul 2022 19:02:12 +0530 Subject: [PATCH 20/21] UT: Update cases for CustomPBAConfigurationSchema's linux filename validation test --- .../unit_tests/common/configuration/test_agent_configuration.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/monkey/tests/unit_tests/common/configuration/test_agent_configuration.py b/monkey/tests/unit_tests/common/configuration/test_agent_configuration.py index f32337e71..d7e4bebd4 100644 --- a/monkey/tests/unit_tests/common/configuration/test_agent_configuration.py +++ b/monkey/tests/unit_tests/common/configuration/test_agent_configuration.py @@ -83,7 +83,7 @@ def test_custom_pba_configuration_schema__empty_filenames_allowed(): assert config.windows_filename == "" -@pytest.mark.parametrize("linux_filename", ["\\", "\\\\\\", "\0"]) +@pytest.mark.parametrize("linux_filename", ["/", "/abc/", "\0"]) def test_custom_pba_configuration_schema__invalid_linux_filename(linux_filename): schema = CustomPBAConfigurationSchema() From 4c86b1bd3d8fe9806d0889f00baf8a72c7dda882 Mon Sep 17 00:00:00 2001 From: Mike Salvatore Date: Tue, 26 Jul 2022 10:47:19 -0400 Subject: [PATCH 21/21] Common: Remove periods from CustomPBAConfiguration docstrings --- .../agent_configuration/agent_sub_configurations.py | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/monkey/common/agent_configuration/agent_sub_configurations.py b/monkey/common/agent_configuration/agent_sub_configurations.py index 4dbd9a3f2..188b9d1bb 100644 --- a/monkey/common/agent_configuration/agent_sub_configurations.py +++ b/monkey/common/agent_configuration/agent_sub_configurations.py @@ -9,15 +9,14 @@ class CustomPBAConfiguration: Attributes: :param linux_command: Command to run on Linux victim machines. If a file is uploaded, - use this field to change its permissions, execute it, and/or delete - it. + use this field to change its permissions, execute it, and/or delete it Example: `chmod +x file.sh; ./file.sh; rm file.sh` - :param linux_filename: Name of the file to upload on Linux victim machines. + :param linux_filename: Name of the file to upload on Linux victim machines :param windows_command: Command to run on Windows victim machines. If a file is uploaded, use this field to change its permissions, execute it, and/or delete - it. + it Example: `file.bat & del file.bat` - :param windows_filename: Name of the file to upload on Windows victim machines. + :param windows_filename: Name of the file to upload on Windows victim machines """ linux_command: str