JPCERTCC / LogonTracer

Investigate malicious Windows logon by visualizing and analyzing Windows event log
Other
2.73k stars 443 forks source link

i can't run "python3 logontracer.py " , #72

Closed baifuwa closed 4 years ago

baifuwa commented 4 years ago

Traceback (most recent call last): File "logontracer.py", line 1101, in main() File "logontracer.py", line 1072, in main print("[+] Neo4j Kernel version: {0}".format(".".join(map(str, db.kernel_version)))) File "/usr/local/lib/python3.6/site-packages/py2neo/database.py", line 214, in kernel_version version_string = info["KernelVersion"].partition("version:")[-1].partition(",")[0].strip() KeyError: 'KernelVersion'

shu-tom commented 4 years ago

What is your neo4j and py2neo version?

R44wk commented 4 years ago

Hi. I have the same issue, my neo4j is 4.0.0 version and py2neo 4.3.0

shu-tom commented 4 years ago

Fixed it. py2neo cannot get the kernel version because it does not support neo4j 4.0.

DexterTheTechie commented 4 years ago

Hello,

can you please check the below error ? I tested .xml and .evtx format, i got the error on both uploads.

[+] Script start. 2020/02/11 15:52:43 Traceback (most recent call last): File "/usr/local/lib/python3.6/site-packages/py2neo/database.py", line 828, in run entities=entities)) File "/usr/local/lib/python3.6/site-packages/py2neo/internal/connectors.py", line 292, in run return self._run_1(statement, parameters, graph, keys, entities) File "/usr/local/lib/python3.6/site-packages/py2neo/internal/connectors.py", line 241, in _run_1 cx = self.pool.acquire() File "/usr/local/lib/python3.6/site-packages/neobolt/direct.py", line 715, in acquire return self.acquire_direct(self.address) File "/usr/local/lib/python3.6/site-packages/neobolt/direct.py", line 608, in acquire_direct connection = self.connector(address, error_handler=self.connection_error_handler) File "/usr/local/lib/python3.6/site-packages/py2neo/internal/connectors.py", line 227, in connector encrypted=cx_data["secure"], **kwargs) File "/usr/local/lib/python3.6/site-packages/neobolt/direct.py", line 972, in connect raise last_error File "/usr/local/lib/python3.6/site-packages/neobolt/direct.py", line 964, in connect connection = _handshake(s, address, der_encoded_server_certificate, **config) File "/usr/local/lib/python3.6/site-packages/neobolt/direct.py", line 932, in _handshake connection.hello() File "/usr/local/lib/python3.6/site-packages/neobolt/direct.py", line 249, in hello self.sync() File "/usr/local/lib/python3.6/site-packages/neobolt/direct.py", line 527, in sync detail_delta, summary_delta = self.fetch() File "/usr/local/lib/python3.6/site-packages/neobolt/direct.py", line 419, in fetch return self._fetch() File "/usr/local/lib/python3.6/site-packages/neobolt/direct.py", line 461, in _fetch response.on_failure(summary_metadata or {}) File "/usr/local/lib/python3.6/site-packages/neobolt/direct.py", line 774, in on_failure raise AuthError(message) neobolt.exceptions.AuthError: The client is unauthorized due to authentication failure. During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/data/LogonTracer/logontracer.py", line 1203, in main() File "/data/LogonTracer/logontracer.py", line 1167, in main print("[+] Neo4j Kernel version: {0}".format(".".join(map(str, db.kernel_start_time)))) File "/usr/local/lib/python3.6/site-packages/py2neo/database.py", line 206, in kernel_start_time info = self.query_jmx("org.neo4j", name="Kernel") File "/usr/local/lib/python3.6/site-packages/py2neo/database.py", line 166, in query_jmx for nom, _, attributes in self.default_graph.run("CALL dbms.queryJmx('')"): File "/usr/local/lib/python3.6/site-packages/py2neo/database.py", line 533, in run return self.begin(autocommit=True).run(cypher, parameters, **kwparameters) File "/usr/local/lib/python3.6/site-packages/py2neo/database.py", line 830, in run raise GraphError.hydrate({"code": error.code, "message": error.message}) File "/usr/local/lib/python3.6/site-packages/py2neo/database.py", line 676, in hydrate _, classification, category, title = code.split(".") AttributeError: 'NoneType' object has no attribute 'split'