From 9576e965deeff305ee5f17884b2bb4542403583c Mon Sep 17 00:00:00 2001 From: Kien Pham Date: Thu, 12 Sep 2024 12:26:55 +0000 Subject: [PATCH 1/3] Update cbinterface --- lerc_control/__init__.py | 21 ++++++++++----------- lerc_control/deploy_lerc.py | 20 ++++++++++---------- lerc_control/lerc_api/__init__.py | 6 +++--- lerc_control/scripted.py | 2 +- setup.py | 2 +- 5 files changed, 25 insertions(+), 26 deletions(-) diff --git a/lerc_control/__init__.py b/lerc_control/__init__.py index 4f025b9..9fc6759 100644 --- a/lerc_control/__init__.py +++ b/lerc_control/__init__.py @@ -102,7 +102,7 @@ def main(): parser_run = subparsers.add_parser('run', help="Run a shell command on the host.") parser_run.add_argument('hostname', help="the host you'd like to work with") parser_run.add_argument('command', help='The shell command for the host to execute`') - parser_run.add_argument('-a', '--async', action='store_true', help='Set asynchronous to true (do NOT wait for output or command to complete)') + parser_run.add_argument('-a', '--asynchronous', action='store_true', help='Set asynchronous to true (do NOT wait for output or command to complete)') parser_run.add_argument('-p', '--print-only', action='store_true', help='Only print results to screen.') parser_run.add_argument('-w', '--write-only', action='store_true', help='Only write results to file.') parser_run.add_argument('-o', '--output-filename', default=None, action='store', help='Specify the name of the file to write any results to.') @@ -324,25 +324,24 @@ def main(): sys.exit(0) logger.info("Attempting to deploy lerc with CarbonBlack..") try: - from cbapi.response import CbResponseAPI - from cbapi.psc.threathunter import CbThreatHunterAPI + from cbc_sdk import CBCloudAPI from cbinterface.cli import load_configured_environments - from cbinterface.psc.device import find_device_by_hostname + from cbinterface.enterprise_edr.device import find_device_by_hostname from lerc_control.deploy_lerc import deploy_lerc, CbSensor_search - except: - logger.error("Failed to import deployment functions. Install and configure cbinterface, if you have Carbon Black.") + except Exception as e: + logger.error(f"{e}Failed to import deployment functions. Install and configure cbinterface, if you have Carbon Black.") sys.exit(1) logging.getLogger('lerc_control.deploy_lerc').setLevel(logging.ERROR) device_or_sensor = None configured_environments = load_configured_environments() - if "psc" in configured_environments or "cbc" in configured_environments: + if "enterprise_edr" in configured_environments or "cbc" in configured_environments: # search here first logger.info(f"searching for device...") - profiles = configured_environments.get("psc", []) + profiles = configured_environments.get("enterprise_edr", []) profiles.extend(configured_environments.get("cbc", [])) for profile in profiles: - cb = CbThreatHunterAPI(profile=profile) + cb = CBCloudAPI(profile=profile) device_or_sensor = find_device_by_hostname(cb, args.hostname) if device_or_sensor: break @@ -509,8 +508,8 @@ def main(): # Else, see if we're running a command directly cmd = None if args.instruction == 'run': - if args.async: - cmd = client.Run(args.command, async=args.async) + if args.asynchronous: + cmd = client.Run(args.command, asynchronous=args.asynchronous) else: cmd = client.Run(args.command) diff --git a/lerc_control/deploy_lerc.py b/lerc_control/deploy_lerc.py index ee98a4a..c7c7392 100755 --- a/lerc_control/deploy_lerc.py +++ b/lerc_control/deploy_lerc.py @@ -16,17 +16,17 @@ logger = logging.getLogger("lerc_control."+__name__) try: - from cbapi.psc import Device - from cbapi.psc.threathunter import CbThreatHunterAPI + from cbc_sdk.platform.devices import Device + from cbc_sdk import CBCloudAPI from cbapi.response import CbResponseAPI, Sensor - from cbapi.errors import ConnectionError, UnauthorizedError, ServerError, ClientError + from cbc_sdk.errors import ConnectionError, UnauthorizedError, ServerError, ClientError from cbinterface.cli import load_configured_environments - from cbinterface.config import get_default_cbapi_product, get_default_cbapi_profile + from cbinterface.config import get_default_cb_product, get_default_cb_profile from cbinterface.helpers import input_with_timeout from cbinterface.commands import ExecuteCommand, PutFile, GetFile, DeleteFile - from cbinterface.psc.device import find_device_by_hostname, is_device_online + from cbinterface.enterprise_edr.device import find_device_by_hostname, is_device_online from cbinterface.response.sensor import make_sensor_query, is_sensor_online except ModuleNotFoundError: sys.stderr.write("[ERROR] deploy_lerc only supports deployment with carbon black and cbinterface.") @@ -105,7 +105,7 @@ def deploy_lerc(device_or_sensor: Union[Device, Sensor], install_command: str, l hostname = device = sensor = None if isinstance(device_or_sensor, Device): - from cbinterface.psc.sessions import CustomLiveResponseSessionManager + from cbinterface.enterprise_edr.sessions import CustomLiveResponseSessionManager device = device_or_sensor hostname = device.name[device.name.rfind('\\')+1:] if '\\' in device.name else device.name elif isinstance(device_or_sensor, Sensor): @@ -138,7 +138,7 @@ def deploy_lerc(device_or_sensor: Union[Device, Sensor], install_command: str, l cb = device_or_sensor._cb offline = False - timeout = 1200 # default 20 minutes (same used by Cb) + timeout = 900 # default 15 minutes (same used by Cb) if device and not is_device_online(device): # Decision point: if the device is NOT online, give the analyst and option to wait logger.warning(f"{device.id}:{device.name} is offline.") @@ -170,18 +170,18 @@ def deploy_lerc(device_or_sensor: Union[Device, Sensor], install_command: str, l timeout = timeout * 86400 logger.info(f"waiting for active session on device ...") - session_manager = CustomLiveResponseSessionManager(cb, custom_session_keepalive=True) + session_manager = CustomLiveResponseSessionManager(cb, custom_session_keepalive=False) if not session_manager.wait_for_active_session(device_or_sensor, timeout=timeout): logger.error(f"reached timeout waiting for active session.") return False - download = PutFile(lerc_installer_path, 'lercSetup.msi') + download = PutFile(lerc_installer_path, 'C:\\Windows\\System32\\lercSetup.msi') execute = ExecuteCommand(install_command, wait_for_output=False, wait_timeout=60, wait_for_completion=True) logger.info(f"submitting commands to download and install lerc.") if previously_installed: # delete any old msi package, just in-case - session_manager.submit_command(DeleteFile('lercSetup.msi'), device_or_sensor) + session_manager.submit_command(DeleteFile('C:\\Windows\\System32\\lercSetup.msi'), device_or_sensor) session_manager.submit_command(download, device_or_sensor) session_manager.submit_command(execute, device_or_sensor) session_manager.process_completed_commands() # wait diff --git a/lerc_control/lerc_api/__init__.py b/lerc_control/lerc_api/__init__.py index 380a384..bf9478b 100644 --- a/lerc_control/lerc_api/__init__.py +++ b/lerc_control/lerc_api/__init__.py @@ -241,13 +241,13 @@ def _issue_command(self, command): return False - def Run(self, shell_command, async=False): + def Run(self, shell_command, asynchronous=False): """Execute a shell command on the host. :param str shell_command: The command to run on the host :param bool async: (optional) ``False``: LERC client will stream any results and wait until for completion. ``True``: Execute the command and return immediately. """ - command = { "operation":"run", "command": shell_command, "async": async } + command = { "operation":"run", "command": shell_command, "async": asynchronous } return self._issue_command(command) def Download(self, server_file_path, client_file_path=None, analyst_file_path=None): @@ -348,7 +348,7 @@ def contain(self): self.Run('del {}'.format(bat_name)) self.Download(safe_contain_bat_path) - containment_command = self.Run(contain_cmd.format(int(self.sleep_cycle)+5), async=True) + containment_command = self.Run(contain_cmd.format(int(self.sleep_cycle)+5), asynchronous=True) # Dummy command to give the containment command enough time to execute before lerc kills it with wmic flag_cmd = self.Run("dir") diff --git a/lerc_control/scripted.py b/lerc_control/scripted.py index 003a06c..a6db3cb 100644 --- a/lerc_control/scripted.py +++ b/lerc_control/scripted.py @@ -182,7 +182,7 @@ def execute_script(lerc, script_path, return_result_commands=False, execute_clea # assuming we never will want to async_run OR write_results_path OR print_results COMMON_CLEANUP_COMMANDS['RUN'].append(run_string) continue - cmd = lerc.Run(run_string, async=async_run) + cmd = lerc.Run(run_string, asynchronous=async_run) command_history[command] = cmd command_history[command].get_the_results = get_results command_history[command].write_results_path = write_results_path diff --git a/setup.py b/setup.py index c269122..35af36e 100644 --- a/setup.py +++ b/setup.py @@ -8,7 +8,7 @@ from codecs import open from os import path -__version__ = "0.0.24" +__version__ = "0.0.25" description = "Libraries and utilities for controling and working with Live Endpoint Response Clients." here = path.abspath(path.dirname(__file__)) From a82cbd15478fc00a7f59cf359ab587fa1cc95fd6 Mon Sep 17 00:00:00 2001 From: Kien Pham Date: Wed, 26 Feb 2025 11:14:23 -0500 Subject: [PATCH 2/3] Update .NET Framework 4.8 --- lerc_client/lercConsole/App.config | 2 +- lerc_client/lercConsole/lercConsole.csproj | 4 +++- lerc_client/lercLib/lercLib.csproj | 2 +- lerc_client/lercService/App.config | 2 +- lerc_client/lercService/lercService.csproj | 6 +++--- lerc_client/packages.config | 2 +- 6 files changed, 10 insertions(+), 8 deletions(-) diff --git a/lerc_client/lercConsole/App.config b/lerc_client/lercConsole/App.config index 40ff78a..8b37fa7 100644 --- a/lerc_client/lercConsole/App.config +++ b/lerc_client/lercConsole/App.config @@ -1,7 +1,7 @@  - + diff --git a/lerc_client/lercConsole/lercConsole.csproj b/lerc_client/lercConsole/lercConsole.csproj index b0dbf62..78682ae 100644 --- a/lerc_client/lercConsole/lercConsole.csproj +++ b/lerc_client/lercConsole/lercConsole.csproj @@ -9,7 +9,7 @@ Properties lercConsole lercConsole - v4.5.2 + v4.8 512 true @@ -22,6 +22,7 @@ DEBUG;TRACE prompt 4 + v4.8 AnyCPU @@ -31,6 +32,7 @@ TRACE prompt 4 + v4.8 diff --git a/lerc_client/lercLib/lercLib.csproj b/lerc_client/lercLib/lercLib.csproj index a7e97df..f0a4cd9 100644 --- a/lerc_client/lercLib/lercLib.csproj +++ b/lerc_client/lercLib/lercLib.csproj @@ -9,7 +9,7 @@ Properties lercLib lercLib - v4.5.2 + v4.8 512 diff --git a/lerc_client/lercService/App.config b/lerc_client/lercService/App.config index f826dde..b08d813 100644 --- a/lerc_client/lercService/App.config +++ b/lerc_client/lercService/App.config @@ -1,7 +1,7 @@  - + diff --git a/lerc_client/lercService/lercService.csproj b/lerc_client/lercService/lercService.csproj index a145736..3dbaee8 100644 --- a/lerc_client/lercService/lercService.csproj +++ b/lerc_client/lercService/lercService.csproj @@ -9,7 +9,7 @@ Properties lercService lerc - v4.5.2 + v4.8 512 true publish\ @@ -92,9 +92,9 @@ - + False - Microsoft .NET Framework 4.5.2 %28x86 and x64%29 + Microsoft .NET Framework 4.8 %28x86 and x64%29 true diff --git a/lerc_client/packages.config b/lerc_client/packages.config index 508c490..1f23437 100644 --- a/lerc_client/packages.config +++ b/lerc_client/packages.config @@ -1,4 +1,4 @@  - + \ No newline at end of file From 00bcb0f4dcf169f04f3a60b6c67e0b3b37cdac60 Mon Sep 17 00:00:00 2001 From: Kien Pham Date: Mon, 21 Apr 2025 12:30:56 -0400 Subject: [PATCH 3/3] Update version and minor syntaxes --- .../lercConsole/Properties/AssemblyInfo.cs | 4 ++-- lerc_client/lercConsole/lercConsole.csproj | 4 ++-- .../lercLib/Properties/AssemblyInfo.cs | 4 ++-- lerc_client/lercLib/lercLib.csproj | 2 +- .../lercService/Properties/AssemblyInfo.cs | 4 ++-- lerc_client/lercService/lercService.csproj | 2 +- lerc_client/lercSetup/lercSetup.vdproj | 24 +++++++++---------- 7 files changed, 22 insertions(+), 22 deletions(-) diff --git a/lerc_client/lercConsole/Properties/AssemblyInfo.cs b/lerc_client/lercConsole/Properties/AssemblyInfo.cs index fa377f7..41a5235 100644 --- a/lerc_client/lercConsole/Properties/AssemblyInfo.cs +++ b/lerc_client/lercConsole/Properties/AssemblyInfo.cs @@ -32,5 +32,5 @@ // You can specify all the values or you can default the Build and Revision Numbers // by using the '*' as shown below: // [assembly: AssemblyVersion("1.0.*")] -[assembly: AssemblyVersion("1.0.0.0")] -[assembly: AssemblyFileVersion("1.0.0.0")] +[assembly: AssemblyVersion("1.0.0.2")] +[assembly: AssemblyFileVersion("1.0.0.2")] diff --git a/lerc_client/lercConsole/lercConsole.csproj b/lerc_client/lercConsole/lercConsole.csproj index 78682ae..f3e93f0 100644 --- a/lerc_client/lercConsole/lercConsole.csproj +++ b/lerc_client/lercConsole/lercConsole.csproj @@ -59,8 +59,8 @@ - copy /Y $(SolutionDir)certs\lerc.ca.pem $(TargetDir)lerc.ca.pem -copy /Y $(SolutionDir)certs\lerc.client.pfx $(TargetDir)lerc.client.pfx + copy /Y "$(SolutionDir)certs\lerc.ca.pem" "$(TargetDir)lerc.ca.pem" +copy /Y "$(SolutionDir)certs\lerc.client.pfx" "$(TargetDir)lerc.client.pfx"