OrcLib: BITSAgent: add option to delete smb share after upload

Use upload attribute 'delete_smb_share="true"' This will close the connection and a linux smb server will be able to free the associated context.
DFIR-ORC · Jun 11, 2024 · 7771bdc · 7771bdc
1 parent 18475b9
commit 7771bdc
Show file tree

Hide file tree

Showing 5 changed files with 48 additions and 1 deletion.
diff --git a/src/OrcLib/BITSAgent.cpp b/src/OrcLib/BITSAgent.cpp
@@ -13,6 +13,7 @@
 #include <Bits.h>
 #include <Winhttp.h>
 #include <boost/scope_exit.hpp>
+#include <boost/algorithm/string.hpp>
 
 #include "BITSAgent.h"
 #include "ParameterCheck.h"
@@ -309,6 +310,29 @@ BITSAgent::UploadFile(
                 }
             }
 
+            if (m_config.bitsMode == OutputSpec::BITSMode::SMB && m_config.bitsDeleteSmbShare.has_value()
+                && *m_config.bitsDeleteSmbShare == true)
+            {
+                Log::Debug(L"Configure NotifyCmd to delete share: {}{}", m_config.ServerName, m_config.RootPath);
+
+                constexpr std::wstring_view forbidden(L";&|()<>*?\"");
+                if (boost::algorithm::contains(m_config.ServerName, forbidden)
+                    || boost::algorithm::contains(m_config.RootPath, forbidden))
+                {
+                    Log::Warn("Invalid characters in server name or network path");
+                }
+                else
+                {
+                    if (!cmdLine.str().empty())
+                    {
+                        cmdLine << L" & ";
+                    }
+
+                    cmdLine << L"net use /del \"\\\\" << m_config.ServerName << m_config.RootPath << L"\"";
+
+                }
+            }
+
             if (FAILED(hr = job2->SetNotifyCmdLine(strCmdSpec.c_str(), cmdLine.str().c_str())))
             {
                 Log::Error(L"Failed to SetNotifyCmdLine to delete uploaded files [{}]", SystemError(hr));

diff --git a/src/OrcLib/Configuration/ConfigFile_Common.cpp b/src/OrcLib/Configuration/ConfigFile_Common.cpp
@@ -106,6 +106,10 @@ HRESULT Orc::Config::Common::upload(ConfigItem& parent, DWORD dwIndex, std::wstr
         return hr;
     if (FAILED(hr = parent.SubItems[dwIndex].AddAttribute(L"uri", CONFIG_UPLOAD_URI, ConfigItem::OPTION)))
         return hr;
+    if (FAILED(
+            hr = parent.SubItems[dwIndex].AddAttribute(
+                L"delete_smb_share", CONFIG_UPLOAD_BITS_SMB_DELETE_SHARE, ConfigItem::OPTION)))
+        return hr;
     return S_OK;
 }
 

diff --git a/src/OrcLib/Configuration/ConfigItem.h b/src/OrcLib/Configuration/ConfigItem.h
@@ -202,6 +202,7 @@ constexpr auto CONFIG_UPLOAD_AUTHSCHEME = 8U;
 constexpr auto CONFIG_UPLOAD_FILTER_EXC = 9U;
 constexpr auto CONFIG_UPLOAD_FILTER_INC = 10U;
 constexpr auto CONFIG_UPLOAD_URI = 11U;
+constexpr auto CONFIG_UPLOAD_BITS_SMB_DELETE_SHARE = 12U;
 
 // DOWNLOAD
 constexpr auto CONFIG_DOWNLOAD_METHOD = 0U;

diff --git a/src/OrcLib/OutputSpec.cpp b/src/OrcLib/OutputSpec.cpp
@@ -565,6 +565,19 @@ HRESULT OutputSpec::Upload::Configure(const ConfigItem& item)
             }
         }
 
+        if (::HasValue(item, CONFIG_UPLOAD_BITS_SMB_DELETE_SHARE))
+        {
+            if (bitsMode != BITSMode::SMB)
+            {
+                Log::Warn(L"Option 'delete_smb_share' is only supported with BITS SMB mode");
+            }
+            else
+            {
+                const auto str = item.SubItems[CONFIG_UPLOAD_BITS_SMB_DELETE_SHARE].c_str();
+                bitsDeleteSmbShare = boost::iequals(str, L"true") || boost::iequals(str, L"yes");
+            }
+        }
+
         if (::HasValue(item, CONFIG_UPLOAD_FILTER_INC))
         {
             boost::split(

diff --git a/src/OrcLib/OutputSpec.h b/src/OrcLib/OutputSpec.h
@@ -54,12 +54,17 @@ class OutputSpec
         std::wstring Password;
         std::wstring JobName;
 
+        std::optional<bool> bitsDeleteSmbShare;
+
         std::vector<std::wstring> FilterInclude;
         std::vector<std::wstring> FilterExclude;
 
         Upload()
             : Method(UploadMethod::NoUpload)
-            , Operation(UploadOperation::NoOp) {};
+            , Operation(UploadOperation::NoOp)
+            , bitsDeleteSmbShare(false)
+        {
+        }
 
         HRESULT Configure(const ConfigItem& item);