Pass parameters to PowerShell script using real time response #481
-
|
Hi team, How can i pass a value as parameter to batch_admin_command and then receive this value on PowerShell invoked script? I want to scan a specific path.
|
Beta Was this translation helpful? Give feedback.
Replies: 5 comments 14 replies
-
|
Hi @hermanmaleiane - This question is similar to this one, so we can borrow his example. In this code segment, we're calling a previously uploaded CloudFile and then passing in a CommandLine for it to handle. (You can use Body Payload abstraction instead if you prefer.) BODY = {
"base_command": "runscript",
"command_string": "runscript -CloudFile=\"MyScriptName\" -CommandLine=\"\"",
"session_id": resource['session_id']
}
command_response = falcon_RTR_Session.RTR_ExecuteActiveResponderCommand(body=BODY)
print(json.dumps(command_response, indent=4)) As long as you know the name of the uploaded CloudFile, you should be able to do the same with RTR on single or multiple hosts. A couple of notes:
Let us know if you run into any questions! |
Beta Was this translation helpful? Give feedback.
-
PEP-8 / Body payload abstraction variation of the code aboveYou might find this syntax a little easier to use. response = falcon_RTR_Session.execute_active_responder_command(base_command="runscript",
command_string="runscript -CloudFile='SCRIPT_NAME' -CommandLine='COMMAND_LINE'",
session_id=resource["session_id"]
)
print(json.dumps(response, indent=4)) |
Beta Was this translation helpful? Give feedback.
-
|
Thank you so much. I can only see these logs. { Connecting to target...connected (5666bc2a-4394-4494-9b00-947379377239) |
Beta Was this translation helpful? Give feedback.
-
|
Excellent! The Check out the following code (taken from here): def execute_command(passed_payload: str, hdr: str, cmd: str):
"""
Executes a RTR Admin command, waits for it to complete,
and then returns the result
"""
passed_payload["command_string"] = cmd
req = falcon_rtra.execute_admin_command( # Call the command
passed_payload # Execute the command
)
if req["status_code"] != 201: # Confirm execution success
raise SystemExit( # There is no retry, crash out
"%80s" % f"{' ' * 80}\nUnable to execute command: "
f"[{req['body']['errors'][0]['code']}] "
f"{req['body']['errors'][0]['message']}"
)
request_id = req["body"]["resources"][0]["cloud_request_id"] # Retrieve the cloud_request_id
completed = False # Boolean to track our command status
inform(f" Waiting on {hdr} to finish executing")
while not completed: # Keep requesting status until the command is completed
inform(
f" Waiting on {hdr} to finish executing...{get_indicator()}"
)
requested = falcon_rtra.check_admin_command_status( # Retrieve the results command
cloud_request_id=request_id, # Passing in the cloud_request_id
sequence_id=0 # Results are chunked, but we just need the first result
)
completed = requested["body"]["resources"][0]["complete"] # Check to see if our command has finished executing
inform(
f" Waiting on {hdr} to finish executing...done!" # Inform the user of success
)
time.sleep(.1)
return requested # Return our resultThe loop runs until the value of "complete" is returned back as a |
Beta Was this translation helpful? Give feedback.
-
|
Just realized the command example above is using |
Beta Was this translation helpful? Give feedback.
-
|
Awesome, Thank you sir. |
Beta Was this translation helpful? Give feedback.
-
|
Hi @jshcodes !! I'm using this code to invoke the script and handle the time and if it's completed. ` The thing is, i am not able to see in the response when it completed and the result of the scan because it takes too much time. The other problem is that when i perform the scan using PowerShell directly on my machine it doesn't display nothing, maybe this behavior is because i don't have threats. |
Beta Was this translation helpful? Give feedback.
-
You should be able to do that, it would be the same request. (eg. You wouldn't need to find a log file, you could just request the result from the API later if you prefer.) You can also use a loop (like shown above) to wait for the result. To your point, this may take up to 10 - 15 minutes depending on the scan. (Although usually it is much faster.)
Are you referring to MpScan? My understanding is that doesn't return an output, you have to retrieve the results using |
Beta Was this translation helpful? Give feedback.
-
|
Hi @jshcodes!! I was forgetting to test the command line option as you explained on your first reply. command="Get-MpThreat -ThreatID 2147750106" status_cod:400 With runscript -CloudFile, using the script deployed on crowdstrike console works fine. |
Beta Was this translation helpful? Give feedback.
-
|
If you're just wanting the values within Resources, I believe you can do something like the following. (This is more of a PowerShell question, so we might need to poke @bk-cs. I tested using the Get-MpThreatCatalog command and expanded CimInstanceProperties since I didn't have an active threat on my current test box.) rtradmin.execute_admin_command(base_command="runscript",
command_string=f"runscript -Raw=```Get-MpThreat -ThreatId {THREAT_ID} | select -ExpandProperty Resources```",
session_id=session_id
) |
Beta Was this translation helpful? Give feedback.
-
|
Thanks again. Need one python advice if I'm not disturbing you. I have problems if i have more than one response. The response Then i try to convert to a valid json using this scripts stdout = response["body"]["resources"][0]["stdout"] The result [{"ActionSuccess":"True", "AdditionalActionsBitMask":"0", "AMProductVersion":"4"."18"."2110"."6", "CleaningActionID":"2", "CurrentThreatExecutionStatusID":"0", "DetectionID":{"69FCB542"-"3575"-"43EE"-"AEEC"-"2525E592B4FD"}, "DetectionSourceTypeID":"2", "DomainUser":"NT" "AUTHORITY""LOCAL" "SERVICE", "InitialDetectionTime":"08"/"12"/"2021" "12":"04":"32", "LastThreatStatusChangeTime":"08"/"12"/"2021" "12":"05":"21", "ProcessName":"Unknown", "RemediationTime":"08"/"12"/"2021" "12":"05":"21", "Resources":"System"."Collections"."ArrayList", "ThreatID":"2147768041", "ThreatStatusErrorCode":"0", "ThreatStatusID":"3", "CimClass":"ROOT"/"Microsoft"/"Windows"/"Defender":"MSFT_MpThreatDetection", "CimInstanceProperties":"System"."Collections"."ArrayList", "CimSystemProperties":"Microsoft"."Management"."Infrastructure"."CimSystemProperties", "PSComputerName":"localhost", "RunspaceId":"4b4489d6"-"1d3f"-"4155"-"b7ee"-"4f607520dc19", "PSShowComputerName":"False"} the problem is with values with special characters for example: The error data = json.loads(valuejson) File "C:\Users\Herman.Maleiane\lib\json\decoder.py", line 355, in raw_decode |
Beta Was this translation helpful? Give feedback.
-
|
I think you might be making it harder than it needs to be formatting the string. If you convert your PowerShell command to the following, do you get output you can parse? rtradmin.execute_admin_command(base_command="runscript",
command_string=f"runscript -Raw=```Get-MpThreat -ThreatId {THREAT_ID} | select -Property * | ConvertTo-Json```",
session_id=session_id
) |
Beta Was this translation helpful? Give feedback.
-
|
Sure @jshcodes !!! |
Beta Was this translation helpful? Give feedback.
-
|
W00t! Happy to help. 😄 |
Beta Was this translation helpful? Give feedback.
Hi @hermanmaleiane -
This question is similar to this one, so we can borrow his example.
In this code segment, we're calling a previously uploaded CloudFile and then passing in a CommandLine for it to handle. (You can use Body Payload abstraction instead if you prefer.)
As long as you know the name of the uploaded CloudFile, you should be able to do the same with RTR on single or multiple hosts.
A …