lerc-control 0.0.24
Libraries and utilities for controling and working with Live Endpoint Response Clients.
License: Apache-2.0
Keywords: Incident Response,Live Endpoint Response Client,LERC,Remote Administration Tool

# Live Endpoint Response Client Control

LERC Control provides utilities for interacting and controlling clients (via the LERC Server API) to perform live response and administrative actions. LERC Control can be used as a library or the 'lerc_ui' script is made available for global use when installed with pip3.

### Features

+ Upload files from clients
+ Contain clients with the windows firewall (configurable firewall rules)
+ Download files to the clients
+ Run commands on the clients
+ Perform scripted routines
+ Create scripted routines and save them for future use
    - Collection arguments auto-build from specified collection scripts
+ Perform complex collections routines via custom, extendable modules
    - collect wmi data (startup, services, timezone, netuse, nic)
    - collect autoruns, process handles, process listings, etc.
+ Perform remediation actions (file/registry deletions, service deletion, schedule task deletion, process killing) - also extendable module format
+ Query the LERC Server for client statuses and client command history

## Getting Started

You can install lerc_control with pip3:

    pip3 install lerc-control

Once you have a working LERC Server and have generated your analyst certificates for LERC Control to use, you need to complete your LERC Control configuration. By default, LERC Control checks the following locations for configuration files:

    /<python-lib-where-lerc_control-installed>/etc/lerc.ini
    /etc/lerc_control/lerc.ini
    /opt/lerc/lerc_control/etc/lerc.ini
    ~/<current-user>/.lerc_control/lerc.ini

Configuration items found in later config files take presendence over earlier ones. This allows for differernt users to have different settings, such as user specific validation certificates, and for default values to be overriden.

The following configuration items are required:

    [default]
    server=<url or hostname of LERC server>
    ignore_system_proxy=<True OR False>
    client_cert=<path to client certificate>
    client_key=<path to client certificate key>
    server_ca_cert=<path to the certificate authority cert that signed the LERC server cert>
    client_working_dir=<the default directory LERCs should work out of, something like 'C:\Program Files (x86)\Integral Defense\'>
    client_installer=<path to lercSetup.msi>
    lerc_install_cmd=<default client install command, something like 'msiexec /quiet /qn /l lerc_install.log /i lercSetup.msi company=0 reconnectdelay=15 chunksize=2048 serverurls="https://your-lerc-server/"'>
    production_lerc_version=<this should always reflect the current version string of the LERC you have in production, ex: 1.0.0.0>

### Default Config Items

The following are default values that can be overriden:

    [default]
    # script used to upgrade clients
    upgrade_bat=tools/upgrade.bat
    upgrade_cmd=upgrade.bat {} 15 2048 "https://{}/"
    # containment script used to perform safe containments
    containment_bat=tools/safe_contain.bat
    contain_cmd=safe_contain.bat {}

    [default_collect]
    # Browsing history
    browser_history_exe_path=tools/BrowsingHistoryView.exe    
    browserHistoryView_cmd=BrowsingHistoryView.exe /sort 2 /HistorySource 1 /VisitTimeFilterType 1 /scomma browserhistory.csv
    # see what processes have a handle on a specific file/directory, or '-a' to get handles for all running processs
    handles_file_cmd=handle.exe /accepteula "{}"
    # 7za for compressing files and directories by collect.py
    7za_path=tools/7za.exe
    7za_dir_cmd=7za.exe a -r {}.7z "{}" 

    [scripts]
    collect_browsing_history=scripts/collect_browsing_history.ini
    collect_wmi_data=scripts/collect_wmi_data.ini

## Documentation

Documentation is still a work in progress but you can find it here [http://lerc.readthedocs.io/](http://lerc.readthedocs.io/)