Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Validate ransomware target directories #1288

Merged
merged 13 commits into from
Jul 6, 2021
Merged
Show file tree
Hide file tree
Changes from 4 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions monkey/common/common_consts/validation_formats.py
Original file line number Diff line number Diff line change
@@ -1,3 +1,5 @@
# Defined in UI on ValidationFormats.js
IP_RANGE = "ip-range"
IP = "ip"
VALID_DIR_LINUX = "valid-directory-linux"
VALID_DIR_WINDOWS = "valid-directory-windows"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same as the other comment, the name is misleading as this validator doesn't check if the directory is valid, it only checks if the start of the path looks like the start of an absolute path.

4 changes: 4 additions & 0 deletions monkey/monkey_island/cc/services/config_schema/ransomware.py
Original file line number Diff line number Diff line change
@@ -1,3 +1,5 @@
from common.common_consts.validation_formats import VALID_DIR_LINUX, VALID_DIR_WINDOWS

RANSOMWARE = {
"title": "Ransomware",
"type": "object",
Expand All @@ -20,6 +22,7 @@
"linux_target_dir": {
"title": "Linux target directory",
"type": "string",
"format": VALID_DIR_LINUX,
"default": "",
"description": "A path to a directory on Linux systems that contains "
"files that you will allow Infection Monkey to encrypt. If no "
Expand All @@ -28,6 +31,7 @@
"windows_target_dir": {
"title": "Windows target directory",
"type": "string",
"format": VALID_DIR_WINDOWS,
"default": "",
"description": "A path to a directory on Windows systems that contains "
"files that you will allow Infection Monkey to encrypt. If no "
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,6 @@
import {IP, IP_RANGE} from './ValidationFormats';
import {IP, IP_RANGE, VALID_DIR_LINUX, VALID_DIR_WINDOWS} from './ValidationFormats';

let invalidDirMessage = 'Invalid directory. Path should be absolute or begin with an environment variable.';

export default function transformErrors(errors) {
return errors.map(error => {
Expand All @@ -8,6 +10,10 @@ export default function transformErrors(errors) {
error.message = 'Invalid IP range, refer to description for valid examples.'
} else if (error.name === 'format' && error.params.format === IP) {
error.message = 'Invalid IP.'
} else if (error.name === 'format' && error.params.format === VALID_DIR_LINUX) {
error.message = invalidDirMessage
} else if (error.name === 'format' && error.params.format === VALID_DIR_WINDOWS) {
error.message = invalidDirMessage
}
return error;
});
Expand Down
Original file line number Diff line number Diff line change
@@ -1,13 +1,22 @@
const ipRegex = '((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)'
const cidrNotationRegex = '([0-9]|1[0-9]|2[0-9]|3[0-2])'
const hostnameRegex = '^([A-Za-z0-9]*[A-Za-z]+[A-Za-z0-9]*.?)*([A-Za-z0-9]*[A-Za-z]+[A-Za-z0-9]*)$'
// path starts with `/` OR `$`
const linuxDirRegex = '^/|\\$'
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

afdbfasd$ is a valid absolute path according to this regex. Maybe change to ^/|^\\$?

// path starts like `C:\` OR `C:/` OR `$` OR `%abc%`
const windowsDirRegex = '^([A-Za-z]:(\\\\|\\/))|\\$|(%\\w*\\d*\\s*%)'


export const IP_RANGE = 'ip-range';
export const IP = 'ip';
export const VALID_DIR_LINUX = 'valid-directory-linux'
export const VALID_DIR_WINDOWS = 'valid-directory-windows'

export const formValidationFormats = {
[IP_RANGE]: buildIpRangeRegex(),
[IP]: buildIpRegex()
[IP]: buildIpRegex(),
[VALID_DIR_LINUX]: buildValidDirLinuxRegex(),
[VALID_DIR_WINDOWS]: buildValidDirWindowsRegex()
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This doesn't check if it's a valid directory. Doesn't even check if it's a directory, the regex would match a file as well. Maybe rename to getRegexWindowsStartsLikeAbsolutePath or getRegexWindowsIsAbsolutePath something?

};

function buildIpRangeRegex(){
Expand All @@ -22,3 +31,11 @@ function buildIpRangeRegex(){
function buildIpRegex(){
return new RegExp('^'+ipRegex+'$')
}

function buildValidDirLinuxRegex() {
return new RegExp(linuxDirRegex)
}

function buildValidDirWindowsRegex() {
return new RegExp(windowsDirRegex)
}