Server.Utils.UploadTools

name: Server.Utils.UploadTools
description: |
  Generates a download script for tool binaries and then uploads them
  from a local directory to the server inventory (in separate runs of
  this artifact).

  Velociraptor can use external tools to deploy binaries on the
  endpoint for some artifacts that require it. Usually these binaries
  are automatically downloaded by the server when required. However,
  sometimes a server is deployed on an air-gapped network, or has
  egress filtering implemented such that the server is unable to
  download binaries on demand.

  In these cases it is useful to automatically pre-populate tools into
  the server's tools inventory manually. This artifact simplifies the
  process.

  1. The artifact first produces a curl based script that helps to
     downloadrequired binaries on an internet connect system.

  2. When the downloaded binaries are placed on a directory in the
     server's filesystem, the artifact can then be used to
     automatically upload the binaries as tools to the server.

  NOTE that in Velociraptor each org is completely separated, so you
  will need to re-upload the binaries for each org.

type: SERVER

parameters:
  - name: BasePath
    description: |
      The directory on the server that contains all the binaries that
      are to be synced.

sources:
  - name: DownloaderScript
    query: |
      // linter: symbol_mask_warn:url

      LET AllCurlCommands =
        SELECT format(format="curl -O -L -C - %v", args=url) AS Curl
        FROM inventory()
        WHERE url
          AND NOT admin_override

      LET Script <= join(sep="\r\n", array=AllCurlCommands.Curl)

      SELECT upload(accessor="scope", file="Script", name="Script.bat") AS Script
      FROM scope()

  - name:
    query: |
      LET BasePath <= pathspec(parse=BasePath)

      SELECT name,
             filename,
             BasePath + filename AS UploadedFile,
             inventory_add(file=BasePath + filename, tool=name, serve_locally=TRUE).hash AS UpdatedHash
      FROM inventory()
      WHERE url
        AND NOT admin_override
        AND stat(filename=BasePath + filename).Size > 100

column_types:
  - name: Script
    type: preview_upload