search

JPCERTCC / LogonTracer

Investigate malicious Windows logon by visualizing and analyzing Windows event log
Other
2.7k stars 441 forks source link

Error when connecting to encrypted Elasticsearch #100

Closed isadp closed 3 years ago

isadp commented 3 years ago

I am trying to import data from Elasticsearch. When running the CLI from the Docker container the command ends with this error:

python3 /usr/local/src/LogonTracer/logontracer.py --es --es-server https://10.10.10.1:9200 --es-user test --es-pass test --es-cafile /usr/local/src/LogonTracer/ca.pem

import pandas.util.testing as tm [+] Script start. 2021/01/21 09:15:28 [+] Neo4j Kernel version: 4.2.2 [+] Start searching the ES. Traceback (most recent call last): File "/usr/local/src/LogonTracer/logontracer.py", line 1861, in <module> main() File "/usr/local/src/LogonTracer/logontracer.py", line 1855, in main parse_es() File "/usr/local/src/LogonTracer/logontracer.py", line 1343, in parse_es context = create_default_context(cafile=FPATH + ES_CAFILE) File "/usr/local/lib/python3.7/ssl.py", line 584, in create_default_context context.load_verify_locations(cafile, capath, cadata) FileNotFoundError: [Errno 2] No such file or directory

isadp commented 3 years ago

Solved: add a Slash to create_default_context(cafile=FPATH + ES_CAFILE) or run the command with --es-cafile /ca.pem

DayNja commented 7 months ago

Good day Sir, I don't understand when you say add a slash to "create_default_context(cafile=FPATH + ES_CAFILE)" where should the slash go?

or with the the cafile parameter I have tried to run the command with --es-cafile /ca.pem this is the current command im running which is very similar to yours

python3 logontracer.py --es --es-server https://192.168.1.2:9200 --es-cafile /home/ubuntu/elasticsearch-ca.pem --es-user elastic --es-pass Aabc98765! -z +4 -f 2023-06-15T08:00:00 -t 2023-06-16T08:00:30

I get the same error

Traceback (most recent call last): File "logontracer.py", line 2880, in main() File "logontracer.py", line 2874, in main parse_es(case) File "logontracer.py", line 2321, in parse_es context = create_default_context(cafile=FPATH + ES_CAFILE) File "/usr/lib/python3.8/ssl.py", line 745, in create_default_context context.load_verify_locations(cafile, capath, cadata) FileNotFoundError: [Errno 2] No such file or directory