Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 37 additions & 1 deletion artifacts/definitions/Server/Utils/CreateCollector.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -54,6 +54,7 @@ parameters:
- SFTP
- Azure
- SMBShare
- WebDAV

- name: target_args
description: Type Dependent args
Expand Down Expand Up @@ -239,6 +240,18 @@ parameters:
endpoint=TargetArgs.endpoint,
hostkey = TargetArgs.hostkey)

- name: WebDAVCollection
type: hidden
default : |
LET upload_file(filename, name, accessor) = upload_webdav(
file=filename,
accessor=accessor,
name=name,
url=TargetArgs.url,
basic_auth_user=TargetArgs.basic_auth_user,
basic_auth_password=TargetArgs.basic_auth_password,
user_agent=TargetArgs.user_agent)

- name: CommonCollections
type: hidden
default: |
Expand Down Expand Up @@ -437,7 +450,7 @@ export: |
},
"Target": {
"description": "The type of collector to use",
"enum": ["ZIP", "GCS", "S3", "Azure", "SMBShare", "SFTP"]
"enum": ["ZIP", "GCS", "S3", "Azure", "SMBShare", "SFTP", "WebDAV"]
},
"EncryptionScheme": {
"enum": ["None", "X509", "Password", "PGP"],
Expand Down Expand Up @@ -601,6 +614,26 @@ export: |
}
}
},
{ "description": "Target Args for WebDAVCollection",
"if": {
"properties": { "Target": { "const": "WebDAV" } }
},
"then": {
"properties": {
"TargetArgs": {
"type": "object",
"properties": {
"url": {"type": "string"},
"basic_auth_user": {"type": "string"},
"basic_auth_password": {"type": "string"},
"user_agent": {"type": "string"}
},
"additionalProperties": false,
"required": ["url"]
}
}
}
},
{ "description": "Target Args for ZIP",
"if": {
"properties": { "Target": { "const": "ZIP" } }
Expand Down Expand Up @@ -682,6 +715,9 @@ sources:
f = { SELECT SMBCollection + CommonCollections + CloudCollection AS Value
FROM scope()
WHERE target = "SMBShare" },
g = { SELECT WebDAVCollection + CommonCollections + CloudCollection AS Value
FROM scope()
WHERE target = "WebDAV" },
z = { SELECT "" AS Value FROM scope()
WHERE log(message="Unknown collection type " + target) }
)
Expand Down
9 changes: 8 additions & 1 deletion bin/offline.go
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,7 @@ Artifacts:
Windows.Sysinternals.Autoruns:
All: "Y"

# Can be ZIP, GCS, S3, Azure, SMBShare, SFTP
# Can be ZIP, GCS, S3, Azure, SMBShare, SFTP, WebDAV
Target: ZIP

# When the Target is GCS:
Expand Down Expand Up @@ -83,6 +83,13 @@ Target: ZIP
# endpoint: ""
# hostkey: ""

# When the Target is WebDAV
#TargetArgs:
# url: ""
# basic_auth_user: ""
# basic_auth_password: ""
# user_agent: ""

# Can be None, X509
# NOTE: You can unzip the encrypted zip using
# velociraptor --config server.config.yaml unzip --dump_dir output file.zip
Expand Down
5 changes: 2 additions & 3 deletions vql/tools/webdav_upload.go
Original file line number Diff line number Diff line change
Expand Up @@ -111,7 +111,7 @@ func (self *WebDAVUploadFunction) Call(ctx context.Context,

func upload_webdav(ctx context.Context, scope vfilter.Scope,
reader io.Reader,
contentLength int64,
size int64,
name string,
webdavUrl string,
basicAuthUser string,
Expand Down Expand Up @@ -157,7 +157,6 @@ func upload_webdav(ctx context.Context, scope vfilter.Scope,
}

req.Header.Set("User-Agent", userAgent)
req.ContentLength = contentLength
req.SetBasicAuth(basicAuthUser, basicAuthPassword)

resp, err := client.Do(req)
Expand All @@ -175,7 +174,7 @@ func upload_webdav(ctx context.Context, scope vfilter.Scope,

return &uploads.UploadResponse{
Path: name,
Size: uint64(contentLength),
Size: uint64(size),
}, nil
}

Expand Down
Loading