CERT-Polska / karton-archive-extractor

Extractor of various archive formats for Karton framework
https://github.com/CERT-Polska/karton
GNU General Public License v3.0
5 stars 6 forks source link

Improve handling of NSIS archives in debloat #55

Closed nazywam closed 9 months ago

nazywam commented 9 months ago
[2024-02-04 12:46:36,012][INFO] The files are being written to /tmp/tmpxv8g0wj6/Steup The Damned.exe
[2024-02-04 12:46:36,013][INFO] File: $PLUGINSDIR/StdUtils.dll
[2024-02-04 12:46:36,014][INFO] File: $PLUGINSDIR/System.dll
[2024-02-04 12:46:36,079][INFO] File: $PLUGINSDIR/app-64.7z
[2024-02-04 12:46:36,081][INFO] File: $PLUGINSDIR/nsis7z.dll
[2024-02-04 12:46:36,082][INFO] File: setup.nsis
[2024-02-04 12:46:36,082][INFO]
[2024-02-04 12:46:36,082][INFO] The user will need to determine which file is malicious if any.
[2024-02-04 12:46:36,083][INFO] If a file is bloated: resubmit it through the tool to debloat it.
[2024-02-04 12:46:36,083][INFO] Consider reviewing the 'setup.nsis' from the installer to determine how the files were meant to be used.
[2024-02-04 12:46:36,097][ERROR] Failed to process task - e25994f0-8a5e-45c0-9e25-9cb26ef97e2b
Traceback (most recent call last):
  File "/usr/local/lib/python3.10/site-packages/karton/core/karton.py", line 181, in internal_process
    self.process(self.current_task)
  File "/usr/local/lib/python3.10/site-packages/karton/archive_extractor/archive_extractor.py", line 179, in process
    debloated = self.debloat_pe(fname, contents)
  File "/usr/local/lib/python3.10/site-packages/karton/archive_extractor/archive_extractor.py", line 91, in debloat_pe
    return (f_name, unpacked_file.read_bytes())
  File "/usr/local/lib/python3.10/pathlib.py", line 1126, in read_bytes
    with self.open(mode='rb') as f:
  File "/usr/local/lib/python3.10/pathlib.py", line 1119, in open
    return self._accessor.open(self, mode, buffering, encoding, errors,
IsADirectoryError: [Errno 21] Is a directory: '/tmp/tmpxv8g0wj6/Steup The Damned.exe'