Canary tools create token

gen_token

#!/bin/bash

# Generate a Canarytoken file for the local machine.
# Requires API_HOST and API_TOKEN in the environment.
#
# Usage: gen_token [-H hostname] [-u username] [kind] [memo]
#   -H hostname  - override hostname in memo/output filename
#   -u username  - override username in memo
#   kind         - token type (default: aws-id)
#   memo         - reminder label (default: hostname - username - /home/username/.aws/credentials)

set -euo pipefail

# Available token kinds (from API docs example):
#   active-directory-login  - Active Directory Login
#   autoreg-google-docs     - Google Doc
#   autoreg-google-sheets   - Google Sheet
#   aws-id                  - AWS API Key
#   aws-s3                  - AWS S3 Bucket
#   azure-entra-login       - Azure Entra Login
#   azure-id                - Azure Login Certificate and Config
#   cloned-css              - CSS cloned site
#   cloned-web              - Cloned Website
#   credit-card             - Credit Card
#   dns                     - DNS
#   doc-msexcel             - MS Excel Document
#   doc-msword              - MS Word Document
#   fast-redirect           - Fast Redirect
#   gmail                   - Gmail
#   google-docs             - Google Doc
#   google-sheets           - Google Sheet
#   http                    - Web Bug
#   msexcel-macro           - MS Excel Macro Document
#   msword-macro            - MS Word Macro Document
#   mysql-dump              - MySQL Dump File
#   office365mail           - Office 365 Mail Bug
#   pdf-acrobat-reader      - Acrobat PDF
#   pwa                     - Fake App
#   qr-code                 - QR Code
#   sensitive-cmd           - Sensitive Command
#   signed-exe              - Custom Exe/Binary
#   slack-api               - Slack API Key
#   slow-redirect           - Slow Redirect
#   web-image               - Custom Web Image
#   windows-dir             - Windows Folder
#   wireguard               - WireGuard VPN

err() {
  echo "[$(date +'%Y-%m-%dT%H:%M:%S%z')]: $*" >&2
}

main() {
  if [[ -z "${API_HOST:-}" ]]; then
    err "API_HOST is not set"
    exit 1
  fi
  if [[ -z "${API_TOKEN:-}" ]]; then
    err "API_TOKEN is not set"
    exit 1
  fi

  local hostname=""
  local who=""
  local kind="aws-id"

  while [[ $# -gt 0 ]]; do
    case "$1" in
      -H) hostname="$2"; shift 2 ;;
      -u) who="$2"; shift 2 ;;
      -*) err "Unknown flag: $1"; exit 1 ;;
      *)  break ;;
    esac
  done

  hostname="${hostname:-$(hostname)}"
  who="${who:-$(whoami)}"
  kind="${1:-$kind}"
  local memo="${2:-$hostname - $who - /home/$who/.aws/credentials}"

  local output_file
  case "$kind" in
    doc-msword)   output_file="${hostname}-doc.docx" ;;
    doc-msexcel)  output_file="${hostname}-doc.xlsx" ;;
    aws-id)       output_file="${hostname}-credentials" ;;
    azure-id)     output_file="${hostname}-azure-prod.zip" ;;
    slack-api)    output_file="${hostname}-slack-prod" ;;
    wireguard)    output_file="${hostname}-wg0.conf" ;;
    pdf-acrobat-reader) output_file="${hostname}-doc.pdf" ;;
    msexcel-macro)      output_file="${hostname}-doc.xlsm" ;;
    msword-macro)       output_file="${hostname}-doc.docm" ;;
    mysql-dump)   output_file="${hostname}-dump.sql" ;;
    *)            output_file="${hostname}-${kind}" ;;
  esac

  if [[ -f "$output_file" ]]; then
    err "Output file already exists: $output_file"
    exit 1
  fi

  local create_resp
  create_resp=$(curl -s -X POST \
    "https://${API_HOST}/api/v1/canarytoken/create" \
    -d auth_token="${API_TOKEN}" \
    -d kind="${kind}" \
    -d memo="${memo}")

  local result
  result=$(echo "$create_resp" | jq -r '.result')
  if [[ "$result" != "success" ]]; then
    err "Failed to create token: $create_resp"
    exit 1
  fi

  local token_id
  token_id=$(echo "$create_resp" | jq -r '.canarytoken.canarytoken')
  echo "Token created: $token_id"

  curl -s -G -L -o "$output_file" \
    "https://${API_HOST}/api/v1/canarytoken/download?auth_token=${API_TOKEN}&canarytoken=${token_id}"

  if [[ -f "$output_file" ]]; then
    echo "Saved: $output_file"
  else
    err "Token created, but no downloadable file returned"
    exit 1
  fi
}

main "$@"