[AWS Monitoring & Evasion article] Script for overwriting platform calls from session.py from botocore

overwrite_pentest_finding.py

import inspect
import sys
try:
    from botocore import session
except ModuleNotFoundError:
    print("Unable to import session from botocore.")
    print("Are you sure that botocore is installed in this environment?")
    sys.exit(1)

# Calls which detect "PenTest machine"
STR1_TO_FIND = 'platform.system()'
STR2_TO_FIND = 'platform.release()'
# Replacements - you can edit these for any other thing you want
STR1_REPLACEMENT = '"Linux"'
STR2_REPLACEMENT = '"4.16.0"'


if __name__ == '__main__':
    # Get filepath to the session file of botocore library
    try:
        path_to_session = inspect.getfile(session)
    except Exception as err:
        print("Something went wrong when trying to find path to botocore/session.")
        print(err)
        sys.exit(2)

    # Get session content
    with open(path_to_session, 'r') as f:
        content = f.read()

    if_continue = True
    # Verify existence of platform calls and replace them
    if STR1_TO_FIND not in content:
        print(f"{STR1_TO_FIND} not found in {path_to_session}")
        if_continue = False
    else:
        content = content.replace(STR1_TO_FIND, STR1_REPLACEMENT)
        print(f"Successfuly replaced {STR1_TO_FIND} with {STR1_REPLACEMENT}")

    if STR2_TO_FIND not in content:
        print(f"{STR2_TO_FIND} not found in {path_to_session}")
        if not if_continue:
            print("None of two platform calls were found, exiting...")
            sys.exit(3)
    else:
        content = content.replace(STR2_TO_FIND, STR2_REPLACEMENT)
        print(f"Successfuly replaced {STR2_TO_FIND} with {STR2_REPLACEMENT}")

    # Overwrite session file
    with open(path_to_session, 'w') as f:
        f.write(content)