guardicore / guardicore/monkey
Change default agent binary destination, Windows
- Dominant language
- Python
- Stars
- 7.1k
- Forks
- 830
- PR merge metrics
- No merged PRs in 30d
Description
**Describe the bug**
The Monkey assumes `C:\Windows\temp\monkey32.exe` is a good path for the dropper, for example in
https://github.com/guardicore/monkey/blob/5ecf626705b9bfd281136c8b6ed01ad6728537ce/monkey/infection_monkey/exploit/wmiexec.py#L79
https://github.com/guardicore/monkey/blob/5ecf626705b9bfd281136c8b6ed01ad6728537ce/monkey/infection_monkey/exploit/wmiexec.py#L81
but that path might not exist in the target machine, for example if Windows is installed on the D:\ drive.
**To Reproduce**
Didn't try to reproduce myself yet.
Steps to reproduce the behavior:
1. Configure the Monkey with default settings, only WMI exploiter
2. Run the monkey on specific machine, and try to use the WMI expoiter on a machine where the c:\windows\temp path isn't available
3. Failure of the exploit.
**Expected behavior**
On Windows exploiters, we should try to discover which folder is available to us for dropping the monkey, if at all possible - like in the wmi exploiter.
**Machine version(please complete the following information):**
- OS: Windows
Contributor guide
Assessment
This issue has not been assessed yet.