[vbox] Install FLARE-VM in vbox-build-flare-vm.py

Execute the installation command in the guest VM. This requires to have
previously disabled UAC in the `BUILD-READY` snapshot. The documentation
includes instructions of how to do this.

Author: Ana06

virtualbox/README.md

@@ -130,5 +130,9 @@ Done! 🙃
 
 ## Build FLARE-VM
 
-[`vbox-build-flare-vm.py`](vbox-build-flare-vm.py) prepares a VirtualBox VM for building FLARE-VM.
-
+[`vbox-build-flare-vm.py`](vbox-build-flare-vm.py) restores a `BUILD-READY` snapshot, copies files required for the installation (like the IDA Pro installer and the FLARE-VM configuration file) and starts the FLARE-VM installation.
+The `BUILD-READY` snapshot is expected to be an empty Windows installation that satisfies the FLARE-VM installation requirements and has UAC disabled
+To disable UAC execute in a cmd console with admin rights and restart the VM for the change to take effect:
+```
+%windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
+```

virtualbox/vbox-adapter-check.py

@@ -20,6 +20,7 @@
 import textwrap
 
 import gi
+
 from vboxcommon import ensure_hostonlyif_exists, get_vm_state, run_vboxmanage
 
 gi.require_version("Notify", "0.7")

virtualbox/vbox-build-vm.py

@@ -13,28 +13,47 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+"""
+Restore a `BUILD-READY` snapshot, copy files required for the installation (like the IDA Pro installer and
+the FLARE-VM configuration file) and start the FLARE-VM installation.
+"""
 
 import os
 
-import pyperclip
 from vboxcommon import ensure_vm_running, get_vm_uuid, restore_snapshot, run_vboxmanage
 
 VM_NAME = "FLARE-VM.testing"
+# The base snapshot is expected to be an empty Windows installation that satisfies the FLARE-VM installation requirements and has UAC disabled
+# To disable UAC execute in a cmd console with admin rights and restart the VM for the change to take effect:
+# %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
 BASE_SNAPSHOT = "BUILD-READY"
 GUEST_USERNAME = "flare"
 GUEST_PASSWORD = "password"
+script_directory = os.path.dirname(os.path.realpath(__file__))
 REQUIRED_FILES_DIR = os.path.expanduser("~/REQUIRED FILES")
-REQUIRED_FILES_DEST = "C:\\Users\\flare\\Desktop"
+REQUIRED_FILES_DEST = f"C:\\Users\\{GUEST_USERNAME}\\Desktop"
 INSTALLATION_COMMAND = r"""
 $desktop=[Environment]::GetFolderPath("Desktop")
 cd $desktop
 Set-ExecutionPolicy Unrestricted -Force
 $url="https://raw.githubusercontent.com/mandiant/flare-vm/main/install.ps1"
-(New-Object net.webclient).DownloadFile($url,"$desktop/install.ps1")
+$file = "$desktop/install.ps1"
+(New-Object net.webclient).DownloadFile($url,$file)
 Unblock-File .\install.ps1
-.\install.ps1 -password password -noWait -noGui -noChecks
+
+start powershell "$file -password password -noWait -noGui -noChecks"
 """
 
+
+def control_guest(vm_uuid, args):
+    """Run a 'VBoxManage guestcontrol' command providing the username and password.
+    Args:
+        vm_uuid: VM UUID
+        args: list of arguments starting with the guestcontrol sub-command
+    """
+    run_vboxmanage(["guestcontrol", vm_uuid, f"--username={GUEST_USERNAME}", f"--password={GUEST_PASSWORD}"] + args)
+
+
 vm_uuid = get_vm_uuid(VM_NAME)
 if not vm_uuid:
     print(f'❌ ERROR: "{VM_NAME}" not found')
@@ -45,23 +64,11 @@
 restore_snapshot(vm_uuid, BASE_SNAPSHOT)
 ensure_vm_running(vm_uuid)
 
-run_vboxmanage(
-    [
-        "guestcontrol",
-        vm_uuid,
-        f"--username={GUEST_USERNAME}",
-        f"--password={GUEST_PASSWORD}",
-        "copyto",
-        "--recursive",
-        f"--target-directory={REQUIRED_FILES_DEST}",
-        REQUIRED_FILES_DIR,
-    ]
-)
+control_guest(vm_uuid, ["copyto", "--recursive", f"--target-directory={REQUIRED_FILES_DEST}", REQUIRED_FILES_DIR])
+print(f"VM {vm_uuid} 📁 Copied required files in: {REQUIRED_FILES_DIR}")
 
-print(f"VM {vm_uuid} 📁 Required files copied")
 
+control_guest(vm_uuid, ["run", "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", INSTALLATION_COMMAND])
 
-print("\n🎀 READY TO BUILD FLARE-VM")
-input("Press any key to copy installation command...")
-pyperclip.copy(INSTALLATION_COMMAND)
-print("✅ COPIED! Paste the copied installation command in a PowerShell console with admin rights to install FLARE-VM")
+print(f"\nVM {vm_uuid} ✅ FLARE-VM is being installed... it will take some time,")
+print("  Go for an 🍦 and enjoy FLARE-VM when you are back!")

virtualbox/vbox-export-snapshots.py

@@ -24,6 +24,7 @@
 from datetime import datetime
 
 import jsonschema
+
 from vboxcommon import (
     ensure_hostonlyif_exists,
     ensure_vm_running,

virtualbox/vboxcommon.py

@@ -18,9 +18,12 @@
 
 
 def format_arg(arg):
-    """Add quotes to the string arg if it contains spaces."""
-    if " " in arg:
-        return f"'{arg}'"
+    """Add quotes to the string arg if it contains special characters like spaces."""
+    if any(c in arg for c in (" ", "\\", "/")):
+        if "'" not in arg:
+            return f"'{arg}'"
+        if '"' not in arg:
+            return f'"{arg}"'
     return arg