Agent: Modify PBAs to yield PostBreachData instead of returning it

This is done mainly because of the hide files PBA which needs to send
telemetry two times. It also makes more sense to do it this way so that
it's easier to send telemetry multiple times in any PBA.
This commit is contained in:
Shreya Malviya 2022-03-28 17:16:50 +05:30 committed by vakarisz
parent 28ff112872
commit ec2b2beca5
6 changed files with 9 additions and 9 deletions

View File

@ -16,7 +16,7 @@ class ClearCommandHistory(PBA):
results = [pba.run() for pba in self.clear_command_history_PBA_list()]
if results:
# Note: `self.command` is empty here
return PostBreachData(self.name, self.command, results)
yield PostBreachData(self.name, self.command, results)
def clear_command_history_PBA_list(self):
return self.CommandHistoryPBAGenerator().get_clear_command_history_pbas()

View File

@ -53,4 +53,4 @@ class ProcessListCollection(PBA):
continue
# No command here; used psutil
return PostBreachData(self.name, "", (processes, success_state))
yield PostBreachData(self.name, "", (processes, success_state))

View File

@ -54,11 +54,11 @@ class CommunicateAsBackdoorUser(PBA):
)
# `command` is empty here; we could get the command from `new_user` but that
# doesn't work either since Windows doesn't use a command, it uses win32 modules
return PostBreachData(self.name, "", result)
yield PostBreachData(self.name, "", result)
except subprocess.CalledProcessError as e:
return PostBreachData(self.name, "", (e.output.decode(), False))
yield PostBreachData(self.name, "", (e.output.decode(), False))
except NewUserError as e:
return PostBreachData(self.name, "", (str(e), False))
yield PostBreachData(self.name, "", (str(e), False))
@staticmethod
def get_random_new_user_name():

View File

@ -29,7 +29,7 @@ class ModifyShellStartupFiles(PBA):
]
# `command` is empty here since multiple commands were run and the results
# were aggregated to send the telemetry just once
return PostBreachData(self.name, "", results).send()
yield PostBreachData(self.name, "", results).send()
def modify_shell_startup_PBA_list(self):
return self.ShellStartupPBAGenerator().get_modify_shell_startup_pbas()

View File

@ -35,7 +35,7 @@ class PBA:
T1064Telem(
ScanStatus.USED, f"Scripts were used to execute {self.name} post breach action."
).send()
return PostBreachData(self.name, self.command, result)
yield PostBreachData(self.name, self.command, result)
else:
logger.debug(f"No command available for PBA '{self.name}' on current OS, skipping.")

View File

@ -53,9 +53,9 @@ class MockPuppet(IPuppet):
logger.debug(f"run_pba({name}, {options})")
if name == "AccountDiscovery":
return PostBreachData(name, "pba command 1", ["pba result 1", True])
yield PostBreachData(name, "pba command 1", ["pba result 1", True])
else:
return PostBreachData(name, "pba command 2", ["pba result 2", False])
yield PostBreachData(name, "pba command 2", ["pba result 2", False])
def ping(self, host: str, timeout: float = 1) -> PingScanData:
logger.debug(f"run_ping({host}, {timeout})")