Create Generic.Remediation.UploadFile.Glob.yaml#574
Create Generic.Remediation.UploadFile.Glob.yaml#574Che4ter wants to merge 3 commits intoVelocidex:masterfrom
Conversation
Create an artifact to upload a file to the target destination. If the target already exists, it will be overridden. The artefact uses the glob, so you can upload the file to multiple locations at once.
|
|
Fix copy past error in the directory exclusion
| SELECT OSPath,Overridden,Size,Mtime,Ctime,Btime,IsDir,IsLink | ||
| FROM if(condition=ReallyDoIt, | ||
| then= upload_targets, | ||
| else= { SELECT *, FALSE as Overridden FROM upload_targets } ) |
There was a problem hiding this comment.
Have you tested this actually stops it from overriding? I think it might be safer to just use an if() here:
if(condition = ReallyDoIt, then=copy(filename=UploadedFile.FullPath[0], accessor="file", dest=OSPath)) AS Overwritten
There was a problem hiding this comment.
Yes it works fine. I used it multiple times during my last engagement. Most of the logic is copied from another artefact: https://docs.velociraptor.app/exchange/artifacts/pages/globremediation/
There was a problem hiding this comment.
Its not really the same as that artifact - you can see in GlobRemediation the bottom query is
SELECT ...
FROM if(condition=ReallyDoIt,
then= delete_targets,
else= { SELECT *, FALSE as Removed FROM targets } )
So depending on the condition it will choose a completely different query - one for delete and one for just showing.
But in this artifact it chooses the same query in both cases, it just replaces the column that removes with FALSE. This generally also works because VQL is generally lazy and wont evaluate a column that got replaced but it is quite fragile and potentially dangerous in this case.
There was a problem hiding this comment.
Thanks for your explanations. I've changed it to an if statement and simplified the query a bit.
Fixed unsafe override protection.
3 participants
Create an artifact to upload a file to the target destination. If the target already exists, it will be overridden. The artefact uses the glob, so you can upload the file to multiple locations at once.