Skip to content

Commit 9cb8437

Browse files
carlosmmatoscarlosmmatos
authored
fix(pwsh): allow getaccess token to run w/o priv or existing installer (#393)
Fixes #390 This PR allows the powershell scripts to use the -GetAccessToken feature without failing due to the checks we had in place for the sensor being installed/uninstalled and having admin privs.
1 parent 019d85d commit 9cb8437

File tree

2 files changed

+123
-99
lines changed

2 files changed

+123
-99
lines changed

‎powershell/install/falcon_windows_install.ps1

Lines changed: 36 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -193,10 +193,10 @@ begin {
193193
function Invoke-FalconAuth([hashtable] $WebRequestParams, [string] $BaseUrl, [hashtable] $Body, [string] $FalconCloud) {
194194
$Headers = @{'Accept' = 'application/json'; 'Content-Type' = 'application/x-www-form-urlencoded'; 'charset' = 'utf-8' }
195195
$Headers.Add('User-Agent', 'crowdstrike-falcon-scripts/1.7.1')
196-
if ($FalconAccessToken){
196+
if ($FalconAccessToken) {
197197
$Headers.Add('Authorization', "bearer $($FalconAccessToken)")
198198
}
199-
else{
199+
else {
200200
try {
201201
$response = Invoke-WebRequest @WebRequestParams -Uri "$($BaseUrl)/oauth2/token" -UseBasicParsing -Method 'POST' -Headers $Headers -Body $Body
202202
$content = ConvertFrom-Json -InputObject $response.Content
@@ -207,9 +207,9 @@ begin {
207207
throw $message
208208
}
209209

210-
if ($GetAccessToken -eq $true){
210+
if ($GetAccessToken -eq $true) {
211211
Write-Output $content.access_token | out-host
212-
exit
212+
exit 0
213213
}
214214

215215
$Headers.Add('Authorization', "bearer $($content.access_token)")
@@ -384,31 +384,35 @@ begin {
384384
}
385385
}
386386
process {
387-
if (([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole(
388-
[Security.Principal.WindowsBuiltInRole]::Administrator) -eq $false) {
389-
$message = 'Unable to proceed without administrative privileges'
390-
Write-FalconLog 'CheckAdmin' $message
391-
throw $message
392-
}
393-
elseif (Get-Service | Where-Object { $_.Name -eq 'CSFalconService' }) {
394-
$message = "'CSFalconService' running. Falcon sensor is already installed."
395-
Write-FalconLog 'CheckService' $message
396-
exit 0
387+
# TLS check should be first since it's needed for all HTTPS communication
388+
if ([Net.ServicePointManager]::SecurityProtocol -notmatch 'Tls12') {
389+
try {
390+
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
391+
}
392+
catch {
393+
$message = $_
394+
Write-FalconLog 'TlsCheck' $message
395+
throw $message
396+
}
397397
}
398-
else {
399-
$credsProvided = Test-FalconCredential $FalconClientId $FalconClientSecret
400-
if ([Net.ServicePointManager]::SecurityProtocol -notmatch 'Tls12') {
401-
try {
402-
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
403-
}
404-
catch {
405-
$message = $_
406-
Write-FalconLog 'TlsCheck' $message
407-
throw $message
408-
}
398+
399+
if (!$GetAccessToken) {
400+
if (([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole(
401+
[Security.Principal.WindowsBuiltInRole]::Administrator) -eq $false) {
402+
$message = 'Unable to proceed without administrative privileges'
403+
Write-FalconLog 'CheckAdmin' $message
404+
throw $message
405+
}
406+
if (Get-Service | Where-Object { $_.Name -eq 'CSFalconService' }) {
407+
$message = "'CSFalconService' running. Falcon sensor is already installed."
408+
Write-FalconLog 'CheckService' $message
409+
exit 0
409410
}
410411
}
411412

413+
# Check if credentials were provided
414+
$AuthProvided = (Test-FalconCredential $FalconClientId $FalconClientSecret) -or $FalconAccessToken
415+
412416
# Hashtable for common Invoke-WebRequest parameters
413417
$WebRequestParams = @{}
414418

@@ -439,7 +443,7 @@ process {
439443
}
440444

441445
# Configure OAuth2 authentication
442-
if ($credsProvided -or $FalconAccessToken) {
446+
if ($AuthProvided) {
443447
$BaseUrl = Get-FalconCloud $FalconCloud
444448

445449
$Body = @{}
@@ -589,18 +593,21 @@ process {
589593
$message = "Exit code 1244: Falcon was unable to communicate with the CrowdStrike cloud. Please check your installation token and try again."
590594
Write-FalconLog 'InstallerProcess' $message
591595
throw $message
592-
} else {
596+
}
597+
else {
593598
if ($process.StandardError) {
594599
$errOut = $process.StandardError.ReadToEnd()
595-
} else {
600+
}
601+
else {
596602
$errOut = "No error output was provided by the process."
597603
}
598604
$message = "Falcon installer exited with code $($process.ExitCode). Error: $errOut"
599605
Write-FalconLog 'InstallerProcess' $message
600606
throw $message
601607
}
602608
}
603-
} catch {
609+
}
610+
catch {
604611
Write-FalconLog 'InstallerProcess' "Caught exception: $_"
605612
throw $_
606613
}

‎powershell/install/falcon_windows_uninstall.ps1

Lines changed: 87 additions & 70 deletions
Original file line numberDiff line numberDiff line change
@@ -111,8 +111,8 @@ param(
111111
)
112112
begin {
113113

114-
if ($FalconAccessToken){
115-
if ($FalconCloud -eq "autodiscover"){
114+
if ($FalconAccessToken) {
115+
if ($FalconCloud -eq "autodiscover") {
116116
$Message = 'Unable to auto discover Falcon region using access token, please provide FalconCloud'
117117
throw $Message
118118
}
@@ -178,10 +178,10 @@ begin {
178178
function Invoke-FalconAuth([hashtable] $WebRequestParams, [string] $BaseUrl, [hashtable] $Body, [string] $FalconCloud) {
179179
$Headers = @{'Accept' = 'application/json'; 'Content-Type' = 'application/x-www-form-urlencoded'; 'charset' = 'utf-8' }
180180
$Headers.Add('User-Agent', 'crowdstrike-falcon-scripts/1.7.1')
181-
if ($FalconAccessToken){
181+
if ($FalconAccessToken) {
182182
$Headers.Add('Authorization', "bearer $($FalconAccessToken)")
183183
}
184-
else{
184+
else {
185185
try {
186186
$response = Invoke-WebRequest @WebRequestParams -Uri "$($BaseUrl)/oauth2/token" -UseBasicParsing -Method 'POST' -Headers $Headers -Body $Body
187187
$content = ConvertFrom-Json -InputObject $response.Content
@@ -192,7 +192,7 @@ begin {
192192
throw $Message
193193
}
194194

195-
if ($GetAccessToken -eq $true){
195+
if ($GetAccessToken -eq $true) {
196196
Write-Output $content.access_token | out-host
197197
exit
198198
}
@@ -366,17 +366,86 @@ begin {
366366
}
367367
}
368368
process {
369-
if (([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole(
370-
[Security.Principal.WindowsBuiltInRole]::Administrator) -eq $false) {
371-
$Message = 'Unable to proceed without administrative privileges'
372-
throw $Message
369+
if (!$GetAccessToken) {
370+
if (([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole(
371+
[Security.Principal.WindowsBuiltInRole]::Administrator) -eq $false) {
372+
$Message = 'Unable to proceed without administrative privileges'
373+
throw $Message
374+
}
375+
376+
$AgentService = Get-Service -Name CSAgent -ErrorAction SilentlyContinue
377+
if (!$AgentService) {
378+
$Message = "'CSFalconService' service not found, already uninstalled"
379+
Write-FalconLog 'CheckService' $Message
380+
break
381+
}
373382
}
383+
# Check if credentials were provided
384+
$AuthProvided = (Test-FalconCredential $FalconClientId $FalconClientSecret) -or $FalconAccessToken
374385

375-
$AgentService = Get-Service -Name CSAgent -ErrorAction SilentlyContinue
376-
if (!$AgentService) {
377-
$Message = "'CSFalconService' service not found, already uninstalled"
378-
Write-FalconLog 'CheckService' $Message
379-
break
386+
if ($AuthProvided) {
387+
# TLS check should be first since it's needed for all HTTPS communication
388+
if ([Net.ServicePointManager]::SecurityProtocol -notmatch 'Tls12') {
389+
try {
390+
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
391+
}
392+
catch {
393+
$message = $_
394+
Write-FalconLog 'TlsCheck' $message
395+
throw $message
396+
}
397+
}
398+
399+
# Hashtable for common Invoke-WebRequest parameters
400+
$WebRequestParams = @{}
401+
402+
# Configure proxy based on arguments
403+
$proxy = ""
404+
if ($ProxyHost) {
405+
Write-Output "Proxy settings detected in arguments, using proxy settings to communicate with the CrowdStrike api"
406+
407+
if ($ProxyHost) {
408+
$proxy_host = $ProxyHost.Replace("http://", "").Replace("https://", "")
409+
Write-FalconLog -Source "Proxy" -Message "Proxy host ${proxy_host} found in arguments" -stdout $true
410+
}
411+
412+
if ($ProxyPort) {
413+
Write-FalconLog -Source "Proxy" -Message "Proxy port ${ProxyPort} found in arguments" -stdout $true
414+
$proxy = "http://${proxy_host}:${ProxyPort}"
415+
}
416+
else {
417+
$proxy = "http://${proxy_host}"
418+
}
419+
420+
$proxy = $proxy.Replace("'", "").Replace("`"", "")
421+
Write-FalconLog -Source "Proxy" -Message "Using proxy ${proxy} to communicate with the CrowdStrike Apis" -stdout $true
422+
}
423+
424+
if ($proxy) {
425+
$WebRequestParams.Add('Proxy', $proxy)
426+
}
427+
428+
$BaseUrl = Get-FalconCloud $FalconCloud
429+
430+
$Body = @{}
431+
$Body['client_id'] = $FalconClientId
432+
$Body['client_secret'] = $FalconClientSecret
433+
434+
if ($MemberCid) {
435+
$Body['member_cid'] = $MemberCid
436+
}
437+
438+
$BaseUrl, $Headers = Invoke-FalconAuth -WebRequestParams $WebRequestParams -BaseUrl $BaseUrl -Body $Body -FalconCloud $FalconCloud
439+
$Headers['Content-Type'] = 'application/json'
440+
$WebRequestParams.Add('Headers', $Headers)
441+
}
442+
elseif ($RemoveHost) {
443+
$Message = 'Unable to remove host without credentials, please provide FalconClientId and FalconClientSecret or FalconAccessToken'
444+
throw $Message
445+
}
446+
elseif ($GetAccessToken) {
447+
$Message = 'Unable to get access token without credentials, please provide FalconClientId and FalconClientSecret'
448+
throw $Message
380449
}
381450

382451
$UninstallerPath = $null
@@ -387,7 +456,8 @@ process {
387456

388457
if (Test-Path -Path $UninstallerPathDir) {
389458
$UninstallerPath = Get-ChildItem -Path $UninstallerPathDir -Recurse | Where-Object { $_.Name -match $UninstallerName } | ForEach-Object { $_.FullName } | Sort-Object -Descending | Select-Object -First 1
390-
} else {
459+
}
460+
else {
391461
$UninstallerPath = $null
392462
}
393463
}
@@ -403,16 +473,8 @@ process {
403473
throw $Message
404474
}
405475

406-
# Verify creds are provided if using the API
407-
$credsProvided = Test-FalconCredential $FalconClientId $FalconClientSecret
408-
if (!$credsProvided -and !$FalconAccessToken) {
409-
if ($RemoveHost) {
410-
$Message = 'Unable to remove host without credentials, please provide FalconClientId and FalconClientSecret or FalconAccessToken'
411-
throw $Message
412-
}
413-
}
414-
else {
415-
# Grab AID before uninstalling
476+
# Grab AID before uninstalling. Only relevant if $RemoveHost or if $AuthProvided and !$MaintenanceToken
477+
if ($RemoveHost -or ($AuthProvided -and !$MaintenanceToken)) {
416478
Write-FalconLog 'GetAID' 'Getting AID before uninstalling'
417479
$aid = Get-AID
418480
if (!$aid) {
@@ -424,51 +486,6 @@ process {
424486
Write-FalconLog 'GetAID' $Message
425487
}
426488

427-
# Hashtable for common Invoke-WebRequest parameters
428-
$WebRequestParams = @{}
429-
430-
# Configure proxy based on arguments
431-
$proxy = ""
432-
if ($ProxyHost) {
433-
Write-Output "Proxy settings detected in arguments, using proxy settings to communicate with the CrowdStrike api"
434-
435-
if ($ProxyHost) {
436-
$proxy_host = $ProxyHost.Replace("http://", "").Replace("https://", "")
437-
Write-FalconLog -Source "Proxy" -Message "Proxy host ${proxy_host} found in arguments" -stdout $true
438-
}
439-
440-
if ($ProxyPort) {
441-
Write-FalconLog -Source "Proxy" -Message "Proxy port ${ProxyPort} found in arguments" -stdout $true
442-
$proxy = "http://${proxy_host}:${ProxyPort}"
443-
}
444-
else {
445-
$proxy = "http://${proxy_host}"
446-
}
447-
448-
$proxy = $proxy.Replace("'", "").Replace("`"", "")
449-
Write-FalconLog -Source "Proxy" -Message "Using proxy ${proxy} to communicate with the CrowdStrike Apis" -stdout $true
450-
}
451-
452-
if ($proxy) {
453-
$WebRequestParams.Add('Proxy', $proxy)
454-
}
455-
456-
if ($credsProvided -or $FalconAccessToken) {
457-
$BaseUrl = Get-FalconCloud $FalconCloud
458-
459-
$Body = @{}
460-
$Body['client_id'] = $FalconClientId
461-
$Body['client_secret'] = $FalconClientSecret
462-
463-
if ($MemberCid) {
464-
$Body['member_cid'] = $MemberCid
465-
}
466-
467-
$BaseUrl, $Headers = Invoke-FalconAuth -WebRequestParams $WebRequestParams -BaseUrl $BaseUrl -Body $Body -FalconCloud $FalconCloud
468-
$Headers['Content-Type'] = 'application/json'
469-
$WebRequestParams.Add('Headers', $Headers)
470-
}
471-
472489
if ($RemoveHost) {
473490
# Remove host from CrowdStrike Falcon
474491
Write-FalconLog 'RemoveHost' 'Removing host from Falcon console'

0 commit comments

Comments
 (0)