Check for job results overwriting about sledre HOT 2 OPEN

sledre commented on June 14, 2024

Check for job results overwriting

from sledre.

Comments (2)

kn0wl3dge commented on June 14, 2024 1

When a worker submit its results through the Django API:

sledre/backend/workers/views.py

Lines 84 to 108 in de74681

    
               @action(detail=True, methods=["POST"]) 
        
               def submit_results(self, request, pk=None): 
        
                   """Extra API endpoint used by the Windows Agent to submit results 
        
                   of its job. The results are send through a file (currently being 
        
                   a JSON or a ZIP)/ 
        
                   Args: 
        
                       request (Request): Request made by the Agent. 
        
                       pk (UUID, optional): Worker UUID. Defaults to None. 
        
                   Returns: 
        
                       Response: Send back if results storing was a success or if any 
        
                           error has been encoutered. 
        
                   """ 
        
                   worker = get_object_or_404(Worker, pk=pk) 
        
                   if worker.job and worker.job.state != JobState.DONE: 
        
                       if "results" in request.data.keys(): 
        
                           worker.job.end(request.data["results"]) 
        
                           worker.job.save() 
        
                           process_results.delay(worker.job.id) 
        
                           return Response({"success": "Results successfully stored"}) 
        
                       else: 
        
                           return Response({"error": "Can't find 'results' param"}) 
        
                   return Response({"error": "Worker is in an incorrect state"})

the file is saved via the job instance with the following computed path:

sledre/backend/jobs/models.py

Lines 10 to 25 in de74681

    
           RESULTS_DIR = "results"  # /data/results 
        
           def get_upload_filename(instance, filename): 
        
               """Compute path where the job result will be stored. 
        
               Args: 
        
                   instance (Job): Job instance associated to the results. 
        
                   filename (String): Name of the uploaded file. 
        
               Returns: 
        
                   String: Computed path where the results will be stored. 
        
               """ 
        
               dirs = wrap(instance.malware.sha256, 2) 
        
               ext = filename.split(".")[-1] 
        
               return f"{RESULTS_DIR}/{'/'.join(dirs[:5])}/{instance.malware.sha256}_{instance.job_type}.{ext}"

So, if I launch two jobs of the same type and on the same malware, the files paths will be identical. As a consequences, the result file will be overwritten and both jobs will be associated to the same result file.

from sledre.

0pendev commented on June 14, 2024

Could you elaborate ? Maybe add some way of producing the bug etc.

from sledre.

Check for job results overwriting about sledre HOT 2 OPEN

Comments (2)

Related Issues (1)

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent

	@action(detail=True, methods=["POST"])
	def submit_results(self, request, pk=None):
	"""Extra API endpoint used by the Windows Agent to submit results
	of its job. The results are send through a file (currently being
	a JSON or a ZIP)/

	Args:
	request (Request): Request made by the Agent.
	pk (UUID, optional): Worker UUID. Defaults to None.

	Returns:
	Response: Send back if results storing was a success or if any
	error has been encoutered.
	"""
	worker = get_object_or_404(Worker, pk=pk)
	if worker.job and worker.job.state != JobState.DONE:
	if "results" in request.data.keys():
	worker.job.end(request.data["results"])
	worker.job.save()
	process_results.delay(worker.job.id)

	return Response({"success": "Results successfully stored"})
	else:
	return Response({"error": "Can't find 'results' param"})
	return Response({"error": "Worker is in an incorrect state"})

	RESULTS_DIR = "results" # /data/results


	def get_upload_filename(instance, filename):
	"""Compute path where the job result will be stored.

	Args:
	instance (Job): Job instance associated to the results.
	filename (String): Name of the uploaded file.

	Returns:
	String: Computed path where the results will be stored.
	"""
	dirs = wrap(instance.malware.sha256, 2)
	ext = filename.split(".")[-1]
	return f"{RESULTS_DIR}/{'/'.join(dirs[:5])}/{instance.malware.sha256}_{instance.job_type}.{ext}"