search

tclahr / uac

UAC is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris systems artifacts.
https://tclahr.github.io/uac-docs
Apache License 2.0
782 stars 120 forks source link

add http put upload capability #230

Closed rbcrwd closed 5 months ago

rbcrwd commented 5 months ago

An unauthenticated upload mechanism moves security concerns Elsewhere™, but if carefully implemented keeps the team from having to be in the secret-distribution business.

This is a nearly exact copy of the S3 presigned upload, with the distinction that it includes the name of the archive in the upload request (preventing having to specify a different URL per host).

rbcrwd commented 5 months ago

This is an RFC - we require this particular functionality, but can keep it to ourselves if preferred.

tclahr commented 5 months ago

Hi. Thanks for the updates. I would like to ask you to hold any code related to s3 transfers as I am about to commit uac v3 code in a few weeks, and uac v3 will have a generic http file transfer using either curl or wget. I think your collaboration will be better if you wait till the new code is pushed. I will let you know when it is available ok?

rbcrwd commented 5 months ago

Certainly, I have no concerns with that.

tclahr commented 3 months ago

Can you check the develop branch now that the new code has been pushed? Thanks!

rbcrwd commented 3 months ago

Thanks, at first glance although I don't appear to be able to simply reuse one of the existing upload mechanisms, I can at least reuse the new unified _http_transfer function to do what I need. I'll port this patch to that and we can go from there.