guardicore / guardicore/monkey

Change default agent binary destination, Windows

Open
#350 1 comment 0 reactions 0 assignees View on GitHub
Bug Complexity: Low Impact: Medium
Dominant language
Python
Stars
7.1k
Forks
830
PR merge metrics
No merged PRs in 30d

Description

**Describe the bug**
The Monkey assumes `C:\Windows\temp\monkey32.exe` is a good path for the dropper, for example in
https://github.com/guardicore/monkey/blob/5ecf626705b9bfd281136c8b6ed01ad6728537ce/monkey/infection_monkey/exploit/wmiexec.py#L79
https://github.com/guardicore/monkey/blob/5ecf626705b9bfd281136c8b6ed01ad6728537ce/monkey/infection_monkey/exploit/wmiexec.py#L81
but that path might not exist in the target machine, for example if Windows is installed on the D:\ drive.

**To Reproduce**
Didn't try to reproduce myself yet.

Steps to reproduce the behavior:
1. Configure the Monkey with default settings, only WMI exploiter
2. Run the monkey on specific machine, and try to use the WMI expoiter on a machine where the c:\windows\temp path isn't available
3. Failure of the exploit.

**Expected behavior**
On Windows exploiters, we should try to discover which folder is available to us for dropping the monkey, if at all possible - like in the wmi exploiter.

**Machine version(please complete the following information):**
- OS: Windows

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.