FalconPY Mac Put Files

[Decoy7884]

Hello!
I am trying to put files onto a Mac. I know they can not go onto root (/), so I want to put them into /tmp. What would be the best method to do this? I tried to do a CD before hand but its not recognized with RTR_GetPut_FilesV2

        file_map = {
            "588a4914368011f080244e17dd06a7b6_0daf8697083c4d5980bd82cab1b9b344": "NessusAgent.pkg",
            "3fb0f3a4368011f0b2e80e35f265f954_0daf8697083c4d5980bd82cab1b9b344": "Install_Nessus_Agent.pkg",
        }

        for file_id, filename in file_map.items():
            response = falcon.command("RTR_GetPut_FilesV2", ids=file_id)
            print(f"{filename}: {response}")

[jshcodes]

Hi @Decoy7884 -

Have you uploaded these files to the CrowdStrike cloud first? (An example of this operation can found in this sample.)

I think you may be looking for the RTR_CreatePut_Files and RTR_ExecuteAdminCommand operations (using the put base command) instead of GetPut_FilesV2.

[Decoy7884]

Im trying to figure out the RTR_ExecuteAdminCommand. I am creating a batch/session but its not finding it to execute. Ideas?

#mac check tenable install function
def mac_check_tenable_install(target_host, falcon, os_class, hostname):
#asm.print_function_start(script_name, inspect.currentframe().f_code.co_name)
global tenable_already_installed, tenable_not_installed, tenable_not_linked
try:

    print("~~"*20)
    # Step 1: Initiate batch session on the target hosts
    print("Step 1: Initiate batch session on the target hosts")
    session_id = create_rtr_session(falcon, target_host)
    print(f"Session initiated with session_id: {session_id}")
    print("~~"*20)
    
    # Step 2: Run the script on the batch of hosts
    print("Step 2: Run the script on the host")
    check_install = "runscript -Raw=```/Library/NessusAgent/run/sbin/nessuscli  agent status```"
    command_response, cloud_request_id = run_command_on_host(session_id, check_install, target_host, falcon)
    print(f"Cloud request ID: {cloud_request_id}")
    print("~~"*20)        
    
    #Step 3: Check the status of the command        
    print("Step 3: Check the status of the command")
    wait_time = 8
    print (f"Waiting {wait_time} seconds before checking the status of the command")
    time.sleep(wait_time)
    cloud_response = get_cloud_response(falcon, cloud_request_id)
    #pprint(cloud_response)
    cloud_response_stout = cloud_response['body']['resources'][0]['stdout']
    print(f"Cloud response stdout:")
    print(cloud_response_stout)
    cloud_response_stderr = cloud_response['body']['resources'][0]['stderr']
    print(f"Cloud response stderr:")
    print(cloud_response_stderr)
    
    #Step 4: Parse Stdout for the results, see if Tenable is installed and linked
    print("~~"*20)
    print("Step 4: Parse for the results, see if Tenable is installed and linked")
    
    #TODO: Insert the correct failure message, make sure this is correct
    nessus_check = re.search("zsh:1: no such file or directory: /Library/NessusAgent/run/sbin/nessuscli", cloud_response_stderr)
    if not nessus_check:
        print("Tenable is installed")
        tenable_already_installed += 1
        tenable_linked = bool(re.search(r"Linked to.*:443", cloud_response_stout, re.DOTALL))
        tenable_link_status = bool(re.search(r"Link status: Connected", cloud_response_stout))
        print (f"Tenable linked: {tenable_linked}")
        print (f"Tenable link status: {tenable_link_status}")
        if tenable_linked and tenable_link_status:
            print(f"{Fore.GREEN}Tenable is linked{Style.RESET_ALL}")
            DB_Connection = create_db_connection()
            with DB_Connection.cursor() as cursor:
                sql = f"INSERT INTO asm_tenable_uad_relink_install (hostname, method, date) VALUEs ('{hostname}', 'already linked', '{data_ingestion_date}')"
                #cursor.execute(sql)
                #DB_Connection.commit()
            DB_Connection.close()
        else:
            print(f"{Fore.YELLOW}Tenable is not linked{Style.RESET_ALL}")
            tenable_not_linked += 1
            hosts_to_relink.append((hostname,os_class))
            proper_relink_command = "runscript -Raw=```/Library/NessusAgent/run/sbin/nessuscli agent link --key=9791eefea37324a8d02513ef0a951482424f5aaf89740db79733cc53f304a637 --cloud --groups='Crowdstrike RTR'```"

            DB_Connection = create_db_connection()
            with DB_Connection.cursor() as cursor:
                sql = f"INSERT INTO asm_tenable_uad_relink_install (hostname, method, date) VALUEs ('{hostname}', 'simple relink', '{data_ingestion_date}')"
                #cursor.execute(sql)
                #DB_Connection.commit()
            DB_Connection.close()
            run_command_on_host(session_id, proper_relink_command, target_host, falcon)
            print(f"{Fore.YELLOW}Tenable is not linked{Style.RESET_ALL}")
            
    else:
        print (f"{Fore.RED}!!!!!!!{Style.RESET_ALL}")
        print("Tenable is not installed")
        install_timeout = (8*60)
        tenable_not_installed += 1

        
        DB_Connection = create_db_connection()
        
        with DB_Connection.cursor() as cursor:
            sql = f"INSERT INTO asm_tenable_uad_relink_install (hostname, method, date) VALUEs ('{hostname}', 'simple install', '{data_ingestion_date}')"
            #cursor.execute(sql)
            #DB_Connection.commit()
        DB_Connection.close()
        #TODO: add the steps to install

        print(f"{Fore.YELLOW}Installing Tenable{Style.RESET_ALL}")
        #TODO: add the steps to install
    
        BODY = {
        "base_command": "put",
        "batch_id": f"{session_id}",
        "command_string": "put NessusAgent.pkg"

        }

        response = falcon.command("BatchAdminCmd",
                                timeout=install_timeout,
                                timeout_duration="5m",
                                body=BODY
                                )
        print(response)

        start_time = time.time()
        elapsed_time = 0
        
        while elapsed_time < install_timeout:
            elapsed_time = time.time() - start_time
            print(f"Elapsed Time: {elapsed_time:.2f} seconds", end="\r")
            time.sleep(15)
        cloud_response = get_cloud_response(falcon, cloud_request_id)
        #pprint(cloud_response)
        time.sleep(15)
                          
            
        print (f"{Fore.RED}!!!!!!!{Style.RESET_ALL}")

This is the response from the falcon.comand ("BatchAdminCmd")

on 0: {'status_code': 400, 'headers': {'Server': 'nginx', 'Date': 'Tue, 27 May 2025 17:20:02 GMT', 'Content-Type': 'application/json', 'Content-Length': '211', 'Connection': 'keep-alive', 'Content-Encoding': 'gzip', 'Strict-Transport-Security': 'max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains', 'X-Cs-Region': 'eu-1', 'X-Cs-Traceid': '10c51046-0339-43f9-8d3c-589132af660a', 'X-Ratelimit-Limit': '6000', 'X-Ratelimit-Remaining': '5901'}, 'body': {'meta': {'query_time': 0.000775654, 'powered_by': 'empower-api', 'trace_id': '10c51046-0339-43f9-8d3c-589132af660a'}, 'combined': {'resources': {}}, 'errors': [{'code': 400, 'message': 'no hosts in this batch session'}]}}

[Decoy7884]

The relink part works as expected. I just need to install on Macs that don't already have it.