cisagov / ESXiArgs-Recover

A tool to recover from ESXiArgs ransomware
Creative Commons Zero v1.0 Universal
295 stars 41 forks source link

Improve for filename with space in it. #1

Closed A-R-I-C-O closed 1 year ago

A-R-I-C-O commented 1 year ago

I modify the script so it can handle filename with space.

mkdir encrypted_files

echo -e "Moving encrypted $1.vmdk to encrypted_files"
mv "$1.vmdk" "encrypted_files/$1.vmdk"
file_size=$(ls -la "$1-flat.vmdk" | awk '{print $5}')

echo -e "\nCreating copy of $1-flat.vmdk"
vmkfstools -c $file_size -d thin temp.vmdk
rm temp-flat.vmdk

echo -e "\nAdding $1.vmdk"
sed -i "s/temp-flat/${1}-flat/" temp.vmdk
if [ "$#" -ne 1 ]; then
  if [ $2 != "thin" ]; then
    sed -i '/ddb.thinProvisioned/d' temp.vmdk
  fi
fi
mv temp.vmdk "$1.vmdk"

echo -e "\nCopying $1.vmx"
mv "$1.vmx" "encrypted_files/$1.vmx"
cp "$1.vmx~" "$1.vmx"

retVal=$?
if [ $retVal -ne 0 ]; then
    echo -e "Error: unable to find vmx backup. You may be unable to re-register the virtual machine."
fi

echo -e "\nMoving encrypted $1.vmsd to encrypted_files"
mv "$1.vmsd" "encrypted_files/$1.vmsd"

echo -e "\nMoving encrypted $1.nvram to encrypted_files"
mv "$1.nvram" "encrypted_files/$1.nvram"

echo -e ""

echo -e "\nValidating..."
vmkfstools -e "$1.vmdk"

retVal=$?
if [ $retVal -ne 0 ]; then
    echo -e "\nError. Trying to update the file size."
    file_size_num=$(( file_size / 512 ))
    file_size_num_plus_one=$(( file_size_num + 1 ))
    sed -i "s/${file_size_num_plus_one}/${file_size_num}/" "$1.vmdk"
    vmkfstools -e "$1.vmdk"
    retVal=$?
    if [ $retVal -ne 0 ]; then
        echo -e "\nError. Could not decrypt. Please consult CISA's guidance for further assistance."
    else
        echo -e "\nSuccess! Unregister the virtual machine and re-register it and you should be good to go.\n"
    fi
else
    echo -e "\nSuccess! Unregister the virtual machine and re-register it and you should be good to go.\n"
fi
exit $retVal
cablej commented 1 year ago

Thank you!! Incorporated in https://github.com/cisagov/ESXiArgs-Recover/commit/3dba6d8aac56397b139dc71a516a1956a405f5f6