Add googlechrome to VM-Packages #779

binjo · 2023-12-11T08:26:32Z

To address issue #469, added:

download/install Chrome by checking if installer's signature is valid
add associations for opening url/html file in Chrome
disable Chrome auto-update related services and registries

To address issue mandiant#469, added: 1. download/install Chrome by checking if installer's signature is valid 2. add associations for opening url/html file in Chrome 3. disable Chrome auto-update related services and registries

1. fix lint issues 2. correct the tool category 3. remove shortcut on desktop

1. fix lint issues

To address issue mandiant#469, added: 1. download/install Chrome by checking if installer's signature is valid 2. add associations for opening url/html file in Chrome 3. disable Chrome auto-update related services and registries

…echrome

Ana06

Thanks for all the work @binjo!

packages/googlechrome.vm/googlechrome.vm.nuspec

Ana06 · 2023-12-12T08:21:25Z

packages/googlechrome.vm/googlechrome.vm.nuspec

+- **If the package is out of date please check [Version History](#versionhistory) for the latest submitted version. If you have a question, please ask it in [Chocolatey Community Package Discussions](https://github.com/chocolatey-community/chocolatey-packages/discussions) or raise an issue on the [Chocolatey Community Packages Repository](https://github.com/chocolatey-community/chocolatey-packages/issues) if you have problems with the package. Disqus comments will generally not be responded to.**
+]]></description>
+    <dependencies>
+      <dependency id="chocolatey-core.extension" />


[question] Why do we need this dependency?

the Get-PackageCacheLocation method is exported from chocolatey-core.extension

what about downloading the installer to the %TEMP%directory instead as we do in other packages?

Join-Path ${Env:TEMP} $installerName

This way we don't need an extra dependency

packages/googlechrome.vm/tools/chocolateyinstall.ps1

Ana06 · 2023-12-12T08:30:38Z

packages/googlechrome.vm/tools/chocolateyinstall.ps1

+try {
+    if ($sigValid) {
+        $toolName = 'Google Chrome'
+        $category = 'Utilities'


Are you using the category? I think we don't need to add Chrome to any category, just install it in the system, as it is a dependency for other tools (cyberchef) not really an analysis tool.

the lint required the $category, otherwise the CI won't be happy 😂

Add the package to the exclusions for this linter rule instead: https://github.com/mandiant/VM-Packages/blob/main/scripts/test/lint.py#L308 😉

it is still here 👀

packages/googlechrome.vm/tools/chocolateyinstall.ps1

Co-authored-by: Ana María Martínez Gómez <[email protected]>

packages/googlechrome.vm/tools/chocolateyinstall.ps1

Ana06 · 2023-12-12T09:11:11Z

packages/googlechrome.vm/tools/chocolateyinstall.ps1

+$installer          = 'googlechromeinstaller.msi'
+$packageArgs        = @{
+    packageName     = $env:ChocolateyPackageName
+    file            = Join-Path $downloadDir $installer


I think we should save this to a variable to access it as $installerFile instead of $packageArgs['file']. A bit nicer and easier to read.

Ana06 · 2023-12-12T09:15:56Z

packages/googlechrome.vm/googlechrome.vm.nuspec

+- **If the package is out of date please check [Version History](#versionhistory) for the latest submitted version. If you have a question, please ask it in [Chocolatey Community Package Discussions](https://github.com/chocolatey-community/chocolatey-packages/discussions) or raise an issue on the [Chocolatey Community Packages Repository](https://github.com/chocolatey-community/chocolatey-packages/issues) if you have problems with the package. Disqus comments will generally not be responded to.**
+]]></description>
+    <dependencies>
+      <dependency id="chocolatey-core.extension" />


what about downloading the installer to the %TEMP%directory instead as we do in other packages?

Join-Path ${Env:TEMP} $installerName

This way we don't need an extra dependency

Ana06 · 2023-12-12T09:16:44Z

packages/googlechrome.vm/tools/chocolateyinstall.ps1

+try {
+    if ($sigValid) {
+        $toolName = 'Google Chrome'
+        $category = 'Utilities'


Add the package to the exclusions for this linter rule instead: https://github.com/mandiant/VM-Packages/blob/main/scripts/test/lint.py#L308 😉

Ana06 · 2023-12-12T11:14:51Z

packages/googlechrome.vm/tools/chocolateyinstall.ps1

+        Set-PTA ChromeHTML http
+        Set-PTA ChromeHTML https
+        Set-FTA ChromeHTML .htm
+        Set-FTA ChromeHTML .html


I think this is not working perfectly. After installing the package, opening an .html file shows:

my testing env seems working, after installing cyberchef.vm, the default opening .html file is Chrome without the prompt as yours.

I have tested again in a tested environment and opening the cyberchef lnk to the html file shows this pop up. @binjo how is your testing environment set up?

Ana06 · 2023-12-12T11:21:14Z

packages/googlechrome.vm/tools/chocolateyinstall.ps1

+        Disable-Chrome-Updates
+
+        # Delete Desktop shortcut
+        $desktopShortcut = Join-Path ${Env:Public} "Desktop\$toolName.lnk"


I think the correct path is

Suggested change

$desktopShortcut = Join-Path ${Env:Public} "Desktop\$toolName.lnk"

$desktopShortcut = Join-Path ${Env:UserProfile} "Desktop\$toolName.lnk"

$Env:Public is correct one, the installer created .lnk is in the public folder, however I just noticed when open the Chrome for the first time, it will create another .lnk which is in $Env:UserProfile 😂

I think this would be a good opportunity to add a VM-Delete-Desktop-Shortcut function that just checks both directories. Maybe not required for this PR but that function has been on my list for a while

I just tested again, the installer created .lnk file is in the public folder, after install cyberchef.vm and open the .html file, a new Chrome .lnk shortcut file appeared in $Env:UserProfile. This looks infeasible for post install deletion.

we could open chrome in the installer, close it, and then delete the lnk. But it seems the link also appears if I run Stop-Process -Name explorer -Force. Strange 😩

packages/googlechrome.vm/tools/chocolateyuninstall.ps1

Ana06 · 2023-12-12T11:30:18Z

packages/googlechrome.vm/tools/chocolateyinstall.ps1

+try {
+    if ($sigValid) {
+        $toolName = 'Google Chrome'
+        $category = 'Utilities'


it is still here 👀

Ana06 · 2023-12-12T11:34:12Z

packages/googlechrome.vm/tools/chocolateyinstall.ps1

+    # Download the installer
+    $packageArgs['file'] = Get-ChocolateyWebFile @packageArgs
+
+    $sigValid = (Get-AuthenticodeSignature -FilePath $packageArgs['file']).Status -eq 'Valid'


I wonder if it is enough with checking that it has a valid signature of if we need to check that the signer certificate comes from Google Chrome as well? @vm-packages opinions? (We can extract this signature to a helper for other tools in the future, so it is a general question)

This is another function that has been on my list; VM-Assert-Signature. I think we should maybe open a PR for this function and hash it out there

Personally I think I'd be ok with just checking if it is Valid since that will check it against CAs, so self signed binaries wont be shown as valid

@day1player I think we should either introduce VM-Assert-Signature or a helper function to install tools using the signature instead of the hash.

Ana06 · 2024-01-11T10:29:28Z

packages/googlechrome.vm/tools/helpers.ps1

+}
+
+# https://github.com/chocolatey-community/chocolatey-packages/blob/master/extensions/chocolatey-core.extension/extensions/Get-PackageCacheLocation.ps1
+function Get-PackageCacheLocation {


why is this function needed? I think this is equivalent to using Join-Path ${Env:TEMP} $installerName directly as we do in other packages

Ana06 · 2024-01-11T10:33:09Z

packages/googlechrome.vm/tools/chocolateyinstall.ps1

+        Set-PTA ChromeHTML http
+        Set-PTA ChromeHTML https
+        Set-FTA ChromeHTML .htm
+        Set-FTA ChromeHTML .html


I have tested again in a tested environment and opening the cyberchef lnk to the html file shows this pop up. @binjo how is your testing environment set up?

Ana06 · 2024-01-11T10:33:40Z

packages/googlechrome.vm/tools/chocolateyinstall.ps1

+        Disable-Chrome-Updates
+
+        # Delete Desktop shortcut
+        $desktopShortcut = Join-Path ${Env:Public} "Desktop\$toolName.lnk"


we could open chrome in the installer, close it, and then delete the lnk. But it seems the link also appears if I run Stop-Process -Name explorer -Force. Strange 😩

Ana06 · 2024-01-11T10:44:24Z

packages/googlechrome.vm/googlechrome.vm.nuspec

+    <id>googlechrome.vm</id>
+    <version>0.0.0.20231210</version>
+    <authors>Mandiant</authors>
+    <description>Chrome is a fast, simple, and secure web browser, built for the modern web.</description>


[nitpick] I would short this description

Ana06 · 2024-01-11T10:44:54Z

packages/googlechrome.vm/googlechrome.vm.nuspec

+  <metadata>
+    <id>googlechrome.vm</id>
+    <version>0.0.0.20231210</version>
+    <authors>Mandiant</authors>


This field should contain the authors of the tool

Suggested change

<authors>Mandiant</authors>

<authors>Google LLC.</authors>

Ana06 · 2024-01-11T11:01:36Z

packages/googlechrome.vm/tools/chocolateyinstall.ps1

+    $installer          = 'googlechromeinstaller.msi'
+    $packageArgs        = @{
+        packageName     = $env:ChocolateyPackageName
+        file            = Join-Path $downloadDir $installer


According to the documentation Get-ChocolateyWebFile needs fileFullPath. Maybe it works because it is the second argument. 🤔

Ana06 · 2024-01-11T11:02:19Z

packages/googlechrome.vm/tools/chocolateyinstall.ps1

+    . $toolsPath\helpers.ps1
+
+    $downloadDir = Get-PackageCacheLocation
+    $installer          = 'googlechromeinstaller.msi'


[nitpick] I would remove this variable as it is only used once

Ana06 · 2024-01-11T11:03:09Z

packages/googlechrome.vm/tools/chocolateyinstall.ps1

+        fileType        = 'MSI'
+        silentArgs      = "/quiet /norestart /l*v `"$($env:TEMP)\$($env:chocolateyPackageName).$($env:chocolateyPackageVersion).MsiInstall.log`""
+        validExitCodes  = @(0)


Suggested change

fileType = 'MSI'

silentArgs = "/quiet /norestart /l*v `"$($env:TEMP)\$($env:chocolateyPackageName).$($env:chocolateyPackageVersion).MsiInstall.log`""

validExitCodes = @(0)

I think we should use different arguments for Install-ChocolateyInstallPackage and Get-ChocolateyWebFile as they don't really overlap and it makes more difficult to read the code.

Ana06 · 2024-01-11T11:03:49Z

packages/googlechrome.vm/tools/chocolateyinstall.ps1

+        fileType        = 'MSI'
+        silentArgs      = "/quiet /norestart /l*v `"$($env:TEMP)\$($env:chocolateyPackageName).$($env:chocolateyPackageVersion).MsiInstall.log`""
+        validExitCodes  = @(0)


validExitCodes = @(0)is the default, so it can be removed

Ana06 · 2024-01-11T11:10:14Z

packages/googlechrome.vm/tools/chocolateyinstall.ps1

+        Set-FTA ChromeHTML .html
+
+        VM-Write-Log "INFO" "Disable update settings"
+        Disable-Chrome-Updates


@binjo disabling updates was not part of the open issues related to chrome, why do you think is needed?

Does anyone has any concern with possible side-effects? 🤔

Ana06 · 2024-01-11T16:52:46Z

I have extracted the signature validation and creation of chrome #824 to this PR: #824

I have extracted the rest of the discussions in this PR to the following issues:

I think this will make the review/discussion process a bit easier. 😉

Add googlechrome to VM-Packages

4dc7e9e

To address issue mandiant#469, added: 1. download/install Chrome by checking if installer's signature is valid 2. add associations for opening url/html file in Chrome 3. disable Chrome auto-update related services and registries

binjo requested a review from Ana06 December 11, 2023 08:26

binjo added 5 commits December 11, 2023 17:12

Add googlechrome to VM-Packages

7896d77

1. fix lint issues 2. correct the tool category 3. remove shortcut on desktop

Add googlechrome to VM-Packages

cd6ec8e

1. fix lint issues

Add googlechrome to VM-Packages

3b25d8c

1. fix lint issues

Add googlechrome to VM-Packages

2965a16

To address issue mandiant#469, added: 1. download/install Chrome by checking if installer's signature is valid 2. add associations for opening url/html file in Chrome 3. disable Chrome auto-update related services and registries

Merge remote-tracking branch 'origin/add-googlechrome' into add-googl…

8fded2c

…echrome

Ana06 requested changes Dec 12, 2023

View reviewed changes

binjo and others added 4 commits December 12, 2023 17:01

Update Chrome description

ed489dc

Co-authored-by: Ana María Martínez Gómez <[email protected]>

Fail if package signature is invalid

9169d17

Co-authored-by: Ana María Martínez Gómez <[email protected]>

Update packages/googlechrome.vm/tools/chocolateyinstall.ps1

3c928cf

Co-authored-by: Ana María Martínez Gómez <[email protected]>

Try catch them all

12c38a6

Ana06 reviewed Dec 12, 2023

View reviewed changes

Ana06 added 🆕 package New package request/idea/PR 🌀 FLARE-VM A package or feature to be used by FLARE-VM 🌀 COMMANDO-VM A package or future to be used by COMMANDO VM labels Dec 12, 2023

binjo added 2 commits December 12, 2023 22:26

Remove extension depedency

bb98ea0

delete uninstaller of googlechrome.vm

735f5fb

Ana06 requested changes Jan 11, 2024

View reviewed changes

This was referenced Jan 11, 2024

Remove Google Chrome lnk in Desktop #820

Closed

Disable Google Chrome Updates #821

Open

Set Chrome as default for opening .html files #823

Closed

Ana06 closed this Jan 11, 2024

binjo deleted the add-googlechrome branch March 25, 2024 09:10

	$desktopShortcut = Join-Path ${Env:Public} "Desktop\$toolName.lnk"
	$desktopShortcut = Join-Path ${Env:UserProfile} "Desktop\$toolName.lnk"

	fileType = 'MSI'
	silentArgs = "/quiet /norestart /l*v `"$($env:TEMP)\$($env:chocolateyPackageName).$($env:chocolateyPackageVersion).MsiInstall.log`""
	validExitCodes = @(0)

Add googlechrome to VM-Packages #779

Add googlechrome to VM-Packages #779

Conversation

binjo commented Dec 11, 2023

Ana06 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

binjo Dec 12, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Ana06 Jan 11, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Ana06 Jan 11, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Ana06 Jan 11, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Ana06 commented Jan 11, 2024

binjo Dec 12, 2023 •

edited

Loading

Ana06 Jan 11, 2024 •

edited

Loading

Ana06 Jan 11, 2024 •

edited

Loading

Ana06 Jan 11, 2024 •

edited

Loading