Agent: Small style improvements in PBA code

This commit is contained in:
vakarisz 2022-03-29 14:17:50 +03:00
parent 1f2867a70a
commit ba49e4d23e
5 changed files with 19 additions and 14 deletions

View File

@ -53,5 +53,5 @@ class ProcessListCollection(PBA):
continue
# No command here; used psutil
self.pba_data.append(PostBreachData(self.name, "", (processes, success_state)))
self.pba_data.append(PostBreachData(self.name, self.command, (processes, success_state)))
return self.pba_data

View File

@ -49,16 +49,18 @@ class CommunicateAsBackdoorUser(PBA):
)
)
exit_status = new_user.run_as(http_request_commandline)
result = self._get_result_for_telemetry(
result = CommunicateAsBackdoorUser._get_result_for_telemetry(
exit_status, http_request_commandline, username
)
# `command` is empty here; we could get the command from `new_user` but that
# doesn't work either since Windows doesn't use a command, it uses win32 modules
self.pba_data.append(PostBreachData(self.name, "", result))
self.pba_data.append(PostBreachData(self.name, self.command, result))
except subprocess.CalledProcessError as e:
self.pba_data.append(PostBreachData(self.name, "", (e.output.decode(), False)))
self.pba_data.append(
PostBreachData(self.name, self.command, (e.output.decode(), False))
)
except NewUserError as e:
self.pba_data.append(PostBreachData(self.name, "", (str(e), False)))
self.pba_data.append(PostBreachData(self.name, self.command, (str(e), False)))
finally:
return self.pba_data
@ -86,7 +88,8 @@ class CommunicateAsBackdoorUser(PBA):
format_string = "wget -O/dev/null -q {url} --method=HEAD --timeout=10"
return format_string.format(url=url)
def _get_result_for_telemetry(self, exit_status, commandline, username):
@staticmethod
def _get_result_for_telemetry(exit_status, commandline, username):
"""
Parses the result of the command and returns it to be sent as telemetry from the master.

View File

@ -34,7 +34,7 @@ class HiddenFiles(PBA):
if is_windows_os(): # use winAPI
result, status = get_winAPI_to_hide_files()
# no command here, used WinAPI
self.pba_data.append(PostBreachData(self.name, "", (result, status)))
self.pba_data.append(PostBreachData(self.name, self.command, (result, status)))
# cleanup hidden files and folders
cleanup_hidden_files(is_windows_os())

View File

@ -29,14 +29,16 @@ class ModifyShellStartupFiles(PBA):
]
# `command` is empty here since multiple commands were run and the results
# were aggregated to send the telemetry just once
self.pba_data.append(PostBreachData(self.name, "", results))
self.pba_data.append(PostBreachData(self.name, self.command, results))
return self.pba_data
def modify_shell_startup_PBA_list(self):
return self.ShellStartupPBAGenerator().get_modify_shell_startup_pbas()
@classmethod
def modify_shell_startup_PBA_list(cls):
return cls.ShellStartupPBAGenerator.get_modify_shell_startup_pbas()
class ShellStartupPBAGenerator:
def get_modify_shell_startup_pbas(self):
@classmethod
def get_modify_shell_startup_pbas(cls):
(cmds_for_linux, shell_startup_files_for_linux, usernames_for_linux), (
cmds_for_windows,
shell_startup_files_per_user_for_windows,
@ -46,14 +48,14 @@ class ModifyShellStartupFiles(PBA):
for startup_file_per_user in shell_startup_files_per_user_for_windows:
windows_cmds = " ".join(cmds_for_windows).format(startup_file_per_user)
pbas.append(self.ModifyShellStartupFile(linux_cmds="", windows_cmds=windows_cmds))
pbas.append(cls.ModifyShellStartupFile(linux_cmds="", windows_cmds=windows_cmds))
for username in usernames_for_linux:
for shell_startup_file in shell_startup_files_for_linux:
linux_cmds = (
" ".join(cmds_for_linux).format(shell_startup_file).format(username)
)
pbas.append(self.ModifyShellStartupFile(linux_cmds=linux_cmds, windows_cmds=""))
pbas.append(cls.ModifyShellStartupFile(linux_cmds=linux_cmds, windows_cmds=""))
return pbas

View File

@ -18,8 +18,8 @@ class SignedScriptProxyExecution(PBA):
super().__init__(POST_BREACH_SIGNED_SCRIPT_PROXY_EXEC, windows_cmd=" ".join(windows_cmds))
def run(self):
original_comspec = ""
try:
original_comspec = ""
if is_windows_os():
original_comspec = subprocess.check_output( # noqa: DUO116
"if defined COMSPEC echo %COMSPEC%", shell=True