Doubts about RTR get and ls commands

[alexgumo7]

Hi!

This time I'm focusing on RTR commands and I have some doubts. I'm using the Real Time Response service collection, specifically the BatchGetCmd. I have the following doubts:

• When I try to get a file/directory that has spaces, it doesn't work. I've tried several formats (escaping the spaces, specifying the path with double quotes, etc) but none of them seems to work. I'm not able to find the proper format in the documentation. Could you point me where to find this information, or it is not possible to work with files/directories with spaces?
• Similar to the previous one, with the env command I'm able to get a list of the environment variables associated with a host, however, I'm not able to use the environment variables using the get (or the ls) command. For instance: %%systemdrive%%\path or $env:environment_variable\path, etc. I don't know if I'm not using the proper format or if this is not possible. I haven't found any documentation related to this.
• Other issue is that I haven't been able to fins documentation regarding the different possibilities of getting files recursively (for instance using *, or **). I've tried it and it works but I don't know if there are specific formats to take into account regarding recursion.
• Finally, I'd like to know if checking separately if files have been downloaded with the function BatchGetCmdStatus is the only method to check if the get action has been finished, instead of checking independently if every single file has been already downloaded.

Sorry for the amount of questions.

Thanks in advanced!

[jshcodes]

Hi @alexgumo7!

Taking your questions in order. 😄

• When I try to get a file/directory that has spaces, it doesn't work. I've tried several formats (escaping the spaces, specifying the path with double quotes, etc) but none of them seems to work.

Can you give me an example file path / file name and then a sample of the code you're executing? I believe the issue is related to how the filename is being passed to the API (i.e. like you point out, perhaps swapping your single quotes and double quotes, or escaping the space on the command line) but can't be sure until I try and recreate it.

• Similar to the previous one, with the env command I'm able to get a list of the environment variables associated with a host, however, I'm not able to use the environment variables using the get (or the ls) command. For instance: %%systemdrive%%\path or $env:environment_variable\path, etc. I don't know if I'm not using the proper format or if this is not possible. I haven't found any documentation related to this.

You are connecting to this environment as SYSTEM (or root) and do not have the entire environment profile available to you, so depending on the scenario some environment variables will not work.

• Other issue is that I haven't been able to fins documentation regarding the different possibilities of getting files recursively (for instance using *, or **). I've tried it and it works but I don't know if there are specific formats to take into account regarding recursion.

Get currently only supports retrieving a single file. For scenarios like this, I would recommend archiving the target folder (or files) and then retrieving the archive file.

• Finally, I'd like to know if checking separately if files have been downloaded with the function BatchGetCmdStatus is the only method to check if the get action has been finished, instead of checking independently if every single file has been already downloaded.

BatchGetCmdStatus returns every file in the batch, so you should be able to call it once and check for all the files you requested.

[alexgumo7]

Thanks for the answers!

• Regarding file path containing spaces, these are some of the examples I've tried:

    body = {"batch_id": batch_id,
            "file_path": file}
    response = rtr.batch_get_command(body=body)

With file being one of the following:

file = "C:/Windows/Program Files/example.exe"
file = 'C:/Windows/Program Files/example.exe'
file = "C:/Windows/Program\ Files/example.exe"
file = "C:/Windows/Program\\ Files/example.exe"
file = "C:/Windows/Program\\\\ Files/example.exe"
file = "C:/Windows/Program%20Files/example.exe"

• For the environment variables that are available, which would be the correct format to use? I've tried the following:

file = "%%ENV_VARIABLE%%\example.exe"
file = "$env:ENV_VARIABLE\example.exe"

[jshcodes]

Hi @alexgumo7 -

You'll need to double up on the quotes to pass that so the space is retained.

Note: The double then single quote.

body_payload = {
    "batch_id": batch_id,
    "file_path": "'C:/Windows/Program Files/example.exe'"
}
response = rtr.batch_get_command(body=body)

You can also use body payload abstraction to perform this call.

response = rtr.batch_get_command(batch_id=batch_id, file_path="'C:/Windows/Program Files/example.exe'")

Here's a quick sample to demonstrate.

import os
import py7zr
from falconpy import RealTimeResponse

TARGET_IDS = ["TARGET AID(s) GO HERE"]
TARGET_FILE = "'C:/target folder/file name.txt'"

# This example assumes you've stored your CrowdStrike API credentials
# in two environment variables, FALCON_CLIENT_ID and FALCON_CLIENT_SECRET.
rtr = RealTimeResponse(client_id=os.getenv("FALCON_CLIENT_ID"),
                       client_secret=os.getenv("FALCON_CLIENT_SECRET")
                       )

session_init = rtr.batch_init_sessions(host_ids=TARGET_IDS, queue_offline=True)
batch_id = session_init["body"]["batch_id"]
sessions = session_init["body"]["resources"]
for session in sessions:
    session_id = sessions[session]["session_id"]
    result = rtr.batch_get_command(batch_id=batch_id, file_path=TARGET_FILE)
    if result["status_code"] != 201:
        for err in result["body"]["errors"]:
            ecode = err["code"]
            emsg = err["message"]
            print(f"[{ecode}] {emsg}")
    else:
        batch_get_cmd_req_id = result["body"]["batch_get_cmd_req_id"]

    response = rtr.batch_get_command_status(batch_get_cmd_req_id=batch_get_cmd_req_id)
    if response["status_code"] == 200:
        for key in response["body"]["resources"]:
            file_sha = response["body"]["resources"][key]["sha256"]
            dl_filename = "downloaded_file.zip"
            with open(dl_filename, "wb") as file_download:
                file_download.write(rtr.get_extracted_file_contents(
                    sha256=file_sha,
                    session_id=session_id,
                    filename=dl_filename
                    )
                )
            with py7zr.SevenZipFile(dl_filename, mode="r", password="infected") as archive:
                archive.extractall(path=f"./{session_id}")
    else:
        print("Unable to retrieve batch command status")
    if rtr.delete_session(session_id=session_id)["status_code"] != 204:
        print("Unable to delete session.")

Regarding environment variables, you should be able to reference them using $VARIABLE syntax.

rtr_admin.batch_admin_command(base_command="runscript",
                              command_string="echo $PATH"
                              )