nexxai / CryptoBlocker

A script to deploy File Server Resource Manager and associated scripts to block infected users
GNU General Public License v2.0
200 stars 73 forks source link

Stopping script execution if error detected before deleting and creating FSRM features #38

Open davidande opened 6 years ago

davidande commented 6 years ago

Hello, If an error occurs during the download of extension list or in the listing of shares, it should be a good thing to stop the execution of the script. this way it avoid the deleting and creating process of all FSRM files group, screen template with empty things. there is the trap command in Powershell but don't know really how to make it work

nexxai commented 6 years ago

The easy way to check if it failed is immediately after it grabs the list from our server, see if there's anything actually in the array. I'm not good enough at PS to do that, but if you (or someone else) wants to submit a pull request with that functionality added, I'd be more than happy to merge it.

Rooven-tech commented 6 years ago

I run filescrn f l /f:"CryptoBlockerGroup6" andfilescrn f l /f:"CryptoBlockerGroup1"` to make sure all is working with script. If Group 1 fails that usually means it was unable to download. The reason I run the check on group6 is make sure it running current version

nexxai commented 6 years ago

The only potential problem with that method is that it presumes that Group1 and Group6 were also deleted by the script properly. If they weren't, your test would pass even if the server also wasn't working.

The original problem (is the website/API responding) should also be checked for "rightness" before we even start attempting any processing on it.

davidande commented 6 years ago

maybe be adding simply -ErrorAction Stop at the end of cmdlet:

$jsonStr = Invoke-WebRequest -Uri https://fsrm.experiant.ca/api/v1/get -ErrorAction Stop

nexxai commented 6 years ago

If I understand correctly, ErrorAction doesn’t stop the whole script, only the cmdlet in question which would result in the same problem: the variable has nothing in it. Unless I’m misunderstanding how ErrorAction works. On Fri, Dec 1, 2017 at 4:52 PM David Andé notifications@github.com wrote:

maybe be adding simply -ErrorAction Stop at the end of cmdlet:

$jsonStr = Invoke-WebRequest -Uri https://fsrm.experiant.ca/api/v1/get -ErrorAction Stop

— You are receiving this because you commented.

Reply to this email directly, view it on GitHub https://github.com/nexxai/CryptoBlocker/issues/38#issuecomment-348645046, or mute the thread https://github.com/notifications/unsubscribe-auth/AEHdlCm8iFZtd5XzW5eZCfXEDnxf0B-yks5s8JFEgaJpZM4QyI2l .

-- Photography: https://fortunavista.com YouTube: https://www.youtube.com/channel/UCgkOp3mQ8P6vUXjHhcnp1KQ

davidande commented 6 years ago

So in this case, to stop the script we have to use Try and Catch. This way if an error occurs, the cmdlet is stopped and It exit the script If no error occurs, Catch is ignored

Try { $jsonStr = Invoke-WebRequest -Uri https://fsrm.experiant.ca/api/v1/get -ErrorAction Stop } Catch { Exit }

source: https://www.vexasoft.com/blogs/powershell/7255220-powershell-tutorial-try-catch-finally-and-error-handling-in-powershell

davidande commented 6 years ago

ok so i tried using Catch

Try
{
# Verifying if new crypto extensions available #
Invoke-WebRequest https://fsrm.experiant.ca/api/v1/combined -OutFile $wkdir\extensions.txt
}
Catch
{
Write-Host Remote extension list Offline - Quit
exit
}

and it seems to work also doing the same for the parsing function before deleting and creating FSRM things

Try
{
$jsonStr = Invoke-WebRequest -Uri https://fsrm.experiant.ca/api/v1/get
$monitoredExtensions = @(ConvertFrom-Json20($jsonStr) | % { $_.filters })
$monitoredExtensions >> "$wkdir\extsbase.txt"
}
Catch
{
Write-Host Error parsing extension list - Quit
exit
}

This way it prevents the script to continue deleting and creating FSRM things without a good parsed extension list.

Checked only on 2012r2 for the moment

https://github.com/davidande/FSRM-ANTICRYPTO/blob/master/FSRM_NoCrypto_2016.ps1

aggie96 commented 6 years ago

This was a great idea. You can add 2012 to the works with the Try/Catch functionality list. In my test, https://fsrm.experiant.ca/api/v1/get succeeded and updated the File Screens and https://fsrm.experiant.ca/api/v1/gt failed and did nothing to the FIle Screens.

davidande commented 6 years ago

works also on 2008 R2