file carve download with password-protected .zip file

[mmguero]

In the malcolm configuration for carving files (search preserved files in that document) you see the following:

• Expose web interface for downloading preserved files?
  • Answering Y enables access to the Zeek-extracted files path through the means of a simple HTTPS directory server at https:///extracted-files/. Beware that Zeek-extracted files may contain malware.
• Enter AES-256-CBC encryption password for downloaded preserved files (or leave blank for unencrypted)
  • If a password is specified here, Zeek-extracted files downloaded as described under the previous question will be AES-256-CBC-encrypted in an openssl enc-compatible format (e.g., openssl enc -aes-256-cbc -d -in example.exe.encrypted -out example.exe).

It's a typical industry practice to provide files like this in a .zip file (maybe with a default password like infected or something). We should provide that as an option. So there'd be three options:

• unencrypted
• encrypted with openssl and the provided password
• encrypted with zip and the provided password (defaulting to infected?)

the main place to implement this is in zeek_carved_http_server.py and anywhere the EXTRACTED_FILE_HTTP_SERVER_ENCRYPT variable is set (probably change this from true/false to an option like none, zip, or openssl maybe)

[mmguero]

The new documentation describes the change:
The EXTRACTED_FILE_HTTP_SERVER_… environment variables in zeek.env and zeek-secret.env configure access to the Zeek-extracted files path through the means of a simple HTTPS directory server accessible at https://localhost/extracted-files/ if connecting locally. Beware that Zeek-extracted files may contain malware. As such, these files may be optionally ZIP archived (with or without a password) or encrypted (to be decrypted using openssl, e.g., openssl enc -aes-256-cbc -d -in example.exe.encrypted -out example.exe) upon download. In other words:

• to disable the extracted files server:
  • EXTRACTED_FILE_HTTP_SERVER_ENABLE=false
• to enable the extracted file server:
  • EXTRACTED_FILE_HTTP_SERVER_ZIP=true
  • downloaded files are zipped, without a password:
    • EXTRACTED_FILE_HTTP_SERVER_ZIP=true
    • EXTRACTED_FILE_HTTP_SERVER_KEY=
  • downloaded files are zipped, with a password:
    • EXTRACTED_FILE_HTTP_SERVER_ZIP=true
    • EXTRACTED_FILE_HTTP_SERVER_KEY=xxxxxxxxxxxxx
  • downloaded files are OpenSSL AES-256-CBC-compatibly encrypted:
    • EXTRACTED_FILE_HTTP_SERVER_ZIP=false
    • EXTRACTED_FILE_HTTP_SERVER_KEY=xxxxxxxxxxxxx
  • downloaded files are downloaded as-is, without archival or compression:
    • EXTRACTED_FILE_HTTP_SERVER_ZIP=false
    • EXTRACTED_FILE_HTTP_SERVER_KEY=

[mmguero]

Before I finalize this, I'm watching uktrade/stream-zip#94 which will allow us to stream both the unencrypted and encrypted ZIP files.

[mmguero]

this appears to be working!