Question

Uninstall Rapid7 Agent from Linux

  • 19 April 2024
  • 4 replies
  • 225 views
M
Badge

Looking for a bash script to uninstall Rapid7 agent on Linux/Ubuntu … please :)

4 replies

jack.smith
Userlevel 5
Badge +1

Hey there @Max Newman 

 

You will need to add the agent_installer-x86_64.sh script as a payload. Rapid7 installer has an uninstaller switch. Worked well for us. 

 

# Evaluation Code

#!/bin/sh

#evaluate the device to see if the Rapid7 service is running
#process running exit with a 0
#process not running exit with a 1

rapid7=$(ps -e | grep ir_agent)

if [ "$rapid7" ]
then 
  exit 1
else 
  exit 0
fi

# Remediation Code

#!/bin/sh

#run installation
cp agent_installer-x86_64.sh /tmp/agent_installer-x86_64.sh
chmod u+x /tmp/agent_installer-x86_64.sh
sudo /tmp/agent_installer-x86_64.sh uninstall

 

M
Badge

Thanks heaps @jack.smith this has proven really helpful :)

F
Badge

Hello
And to install on linux does anyone have it?

jack.smith
Userlevel 5
Badge +1

Hello
And to install on linux does anyone have it?

Similar process, upload the agent_installer-x86_64.sh file as a payload

 

Evaluation Code

#!/bin/sh

#evaluate the device to see if the Rapid7 service is running
#process running exit with a 0
#process not running exit with a 1

rapid7=$(ps -e | grep ir_agent)

if [ "$rapid7" ]
then 
  exit 0
else 
  exit 1
fi

Remediation

#!/bin/sh

#run installation
cp agent_installer-x86_64.sh /tmp/agent_installer-x86_64.sh
chmod u+x /tmp/agent_installer-x86_64.sh
sudo /tmp/agent_installer-x86_64.sh install_start --token us:fd2d4a4f-ca65-494d-9548-66d36b080cc7

rapid7=$( ps -e | grep ir_agent)

if [ "$rapid7" ]
then
  echo "installed succesfully"
  exit 0
else
  echo "failed to install"
  exit 1
fi

 

Reply


Terms & ConditionsCookie settings