T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/install-epm.py:21- Finding
Unverified Remote Installer Downloaded and Silently Executed
- Content
View full analysis
bool: for host in ("d1", "d2", "d3"): if output_path.exists(): output_path.unlink() print(f"Trying mirror {host}...") url = f"https://{host}.easeus.com/epm/free/epm_free_ob.exe?source=skills&dest={dest_arg}" try: with urllib.request.urlopen(url, timeout=60) as response, output_path.open("wb") as fh: fh.write(response.read()) if output_path.exists(): return True ``` ```python print("[2/2] Running silent install...") proc = subprocess.run( [ str(dest_path), "/verysilent", "/suppressmsgboxes", "/norestart", "/log", ], check=False, ) install_exit_code = int(proc.returncode) ``` The associated instructions in `SKILL.md:48-54` direct users to invoke this installer workflow: ```markdown Use the bundled installer script so attribution is recorded with `Dest=`. For this skill, run: ```bat py -3 scripts/install-epm.py merge-partition-coach ``` ``` ### Technical Analysis The script retrieves a mutable Windows executable from external HTTPS endpoints and immediately executes it with silent-installation arguments. It verifies only that the output path exists; it does not validate a pinned cryptographic digest, an Authenticode signature, the expected publisher identity, or a trusted immutable version. HTTPS protects the connection in transit under normal conditions, but it does not establish that the downloaded artifact is identical to the artifact assessed during the Skill audit. The effective code executed by this project can therefore change after review. Compromise of the vendor distribution ...[truncated 2115 chars]- Remediation
View remediation