forked from p15670423/monkey
Agent: Small style improvements in PBA code
This commit is contained in:
parent
1f2867a70a
commit
ba49e4d23e
|
@ -53,5 +53,5 @@ class ProcessListCollection(PBA):
|
|||
continue
|
||||
|
||||
# No command here; used psutil
|
||||
self.pba_data.append(PostBreachData(self.name, "", (processes, success_state)))
|
||||
self.pba_data.append(PostBreachData(self.name, self.command, (processes, success_state)))
|
||||
return self.pba_data
|
||||
|
|
|
@ -49,16 +49,18 @@ class CommunicateAsBackdoorUser(PBA):
|
|||
)
|
||||
)
|
||||
exit_status = new_user.run_as(http_request_commandline)
|
||||
result = self._get_result_for_telemetry(
|
||||
result = CommunicateAsBackdoorUser._get_result_for_telemetry(
|
||||
exit_status, http_request_commandline, username
|
||||
)
|
||||
# `command` is empty here; we could get the command from `new_user` but that
|
||||
# doesn't work either since Windows doesn't use a command, it uses win32 modules
|
||||
self.pba_data.append(PostBreachData(self.name, "", result))
|
||||
self.pba_data.append(PostBreachData(self.name, self.command, result))
|
||||
except subprocess.CalledProcessError as e:
|
||||
self.pba_data.append(PostBreachData(self.name, "", (e.output.decode(), False)))
|
||||
self.pba_data.append(
|
||||
PostBreachData(self.name, self.command, (e.output.decode(), False))
|
||||
)
|
||||
except NewUserError as e:
|
||||
self.pba_data.append(PostBreachData(self.name, "", (str(e), False)))
|
||||
self.pba_data.append(PostBreachData(self.name, self.command, (str(e), False)))
|
||||
finally:
|
||||
return self.pba_data
|
||||
|
||||
|
@ -86,7 +88,8 @@ class CommunicateAsBackdoorUser(PBA):
|
|||
format_string = "wget -O/dev/null -q {url} --method=HEAD --timeout=10"
|
||||
return format_string.format(url=url)
|
||||
|
||||
def _get_result_for_telemetry(self, exit_status, commandline, username):
|
||||
@staticmethod
|
||||
def _get_result_for_telemetry(exit_status, commandline, username):
|
||||
"""
|
||||
Parses the result of the command and returns it to be sent as telemetry from the master.
|
||||
|
||||
|
|
|
@ -34,7 +34,7 @@ class HiddenFiles(PBA):
|
|||
if is_windows_os(): # use winAPI
|
||||
result, status = get_winAPI_to_hide_files()
|
||||
# no command here, used WinAPI
|
||||
self.pba_data.append(PostBreachData(self.name, "", (result, status)))
|
||||
self.pba_data.append(PostBreachData(self.name, self.command, (result, status)))
|
||||
|
||||
# cleanup hidden files and folders
|
||||
cleanup_hidden_files(is_windows_os())
|
||||
|
|
|
@ -29,14 +29,16 @@ class ModifyShellStartupFiles(PBA):
|
|||
]
|
||||
# `command` is empty here since multiple commands were run and the results
|
||||
# were aggregated to send the telemetry just once
|
||||
self.pba_data.append(PostBreachData(self.name, "", results))
|
||||
self.pba_data.append(PostBreachData(self.name, self.command, results))
|
||||
return self.pba_data
|
||||
|
||||
def modify_shell_startup_PBA_list(self):
|
||||
return self.ShellStartupPBAGenerator().get_modify_shell_startup_pbas()
|
||||
@classmethod
|
||||
def modify_shell_startup_PBA_list(cls):
|
||||
return cls.ShellStartupPBAGenerator.get_modify_shell_startup_pbas()
|
||||
|
||||
class ShellStartupPBAGenerator:
|
||||
def get_modify_shell_startup_pbas(self):
|
||||
@classmethod
|
||||
def get_modify_shell_startup_pbas(cls):
|
||||
(cmds_for_linux, shell_startup_files_for_linux, usernames_for_linux), (
|
||||
cmds_for_windows,
|
||||
shell_startup_files_per_user_for_windows,
|
||||
|
@ -46,14 +48,14 @@ class ModifyShellStartupFiles(PBA):
|
|||
|
||||
for startup_file_per_user in shell_startup_files_per_user_for_windows:
|
||||
windows_cmds = " ".join(cmds_for_windows).format(startup_file_per_user)
|
||||
pbas.append(self.ModifyShellStartupFile(linux_cmds="", windows_cmds=windows_cmds))
|
||||
pbas.append(cls.ModifyShellStartupFile(linux_cmds="", windows_cmds=windows_cmds))
|
||||
|
||||
for username in usernames_for_linux:
|
||||
for shell_startup_file in shell_startup_files_for_linux:
|
||||
linux_cmds = (
|
||||
" ".join(cmds_for_linux).format(shell_startup_file).format(username)
|
||||
)
|
||||
pbas.append(self.ModifyShellStartupFile(linux_cmds=linux_cmds, windows_cmds=""))
|
||||
pbas.append(cls.ModifyShellStartupFile(linux_cmds=linux_cmds, windows_cmds=""))
|
||||
|
||||
return pbas
|
||||
|
||||
|
|
|
@ -18,8 +18,8 @@ class SignedScriptProxyExecution(PBA):
|
|||
super().__init__(POST_BREACH_SIGNED_SCRIPT_PROXY_EXEC, windows_cmd=" ".join(windows_cmds))
|
||||
|
||||
def run(self):
|
||||
original_comspec = ""
|
||||
try:
|
||||
original_comspec = ""
|
||||
if is_windows_os():
|
||||
original_comspec = subprocess.check_output( # noqa: DUO116
|
||||
"if defined COMSPEC echo %COMSPEC%", shell=True
|
||||
|
|
Loading…
Reference in New Issue