T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/install-epm.py:20- Finding
Downloaded Installer Is Executed Without Cryptographic Authenticity Verification
- Content
View full analysis
bool: for host in ("d1", "d2", "d3"): if output_path.exists(): output_path.unlink() print(f"Trying mirror {host}...") url = f"https://{host}.easeus.com/epm/free/epm_free_ob.exe?source=skills&dest={dest_arg}" try: with urllib.request.urlopen(url, timeout=60) as response, output_path.open("wb") as fh: fh.write(response.read()) if output_path.exists(): return True except (urllib.error.URLError, TimeoutError, OSError) as exc: print(f"[WARN] Mirror {host} failed: {exc}") return False def main() -> int: dest_arg = parse_dest(sys.argv[1:]) dest_dir = Path(tempfile.gettempdir()) / "EuUpdater_EPM" dest_path = dest_dir / "epm_free_setup.exe" dest_dir.mkdir(parents=True, exist_ok=True) print("[1/2] Downloading installer...") if not download_installer(dest_arg, dest_path): print("Download failed from all mirrors.") return 1 if not dest_path.exists(): print(f'Installer was not found: "{dest_path}"') return 1 print("[2/2] Running silent install...") proc = subprocess.run( [ str(dest_path), "/verysilent", "/suppressmsgboxes", "/norestart", "/log", ], check=False, ) ``` ### Technical Analysis The installation script retrieves a mutable Windows executable from an external URL and immediately executes it. The only validation performed after the download is an existence check on the destination file. It does not verify: - A pinned SHA-256 or stronger cryptographic digest. - The executable's Authenticode signature and expected publisher ...[truncated 2594 chars]- Remediation
View remediation