search

SecurityRiskAdvisors / VECTR

VECTR is a tool that facilitates tracking of your red and blue team testing activities to measure detection and prevention capabilities across different attack scenarios
1.35k stars 159 forks source link

Index.yaml file upload error #190

Closed dermosaurus closed 1 year ago

dermosaurus commented 1 year ago

Good morning team,

When I try uploading the newest index.yaml file located here https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/Indexes/index.yaml, I get an "Error during upload" message. The file upload goes to 100%, then fails with this message. I've tried copying the raw data into a separate yaml file and using the one from the cloned repo with the same result.

A similar issue was raised not long ago here https://github.com/SecurityRiskAdvisors/VECTR/issues/167, but the issue was closed due to a lack of replication.

Any ideas?

SRAPSpencer commented 1 year ago

Occasionally Atomic Red Team makes changes that breaks compatibility with our uploader. This is difficult to track as ART doesn't have versioned releases and is just perpetually being updated. Going back about a a month in the Git history that seems to upload just fine. I'll make a note and try and get this resolved in an upcoming release.

https://github.com/redcanaryco/atomic-red-team/blob/8a226086a647df18be65136193e432f5035e6988/atomics/Indexes/index.yaml

I'll make a note and try and get this resolved in an upcoming release.

dermosaurus commented 1 year ago

Argh that sounds tough for you guys!

I tried the workaround and it generates the same error. Could it be related to the fact our team is running v8.4.2?

SRAPSpencer commented 1 year ago

I don't believe so, the only thing different in 8.4.3 is an unrelated bug fix. I think I saw a screenshot you pulled from the other thread. A compatibility error looks like this.

image

I believe the whole upload bar turned red on yours, which may suggest a network error. It's likely something in your browser, network or on the workstation you're uploading from is killing the transfer.

thebleucheese commented 1 year ago

I think we’ve seen this a few times. Can you check the browser console for js errors or red entries in the browser network tab? Sometimes the browser itself blocks the upload due to SSL cert issues or other configuration issues. You could also try a different browser to see if it changes anything. That may pinpoint a browser issue that may be resolvable with setting changes.

dermosaurus commented 1 year ago

@thebleucheese you're on the money! Tried different browsers which duplicated the error. The network inspect for all instances show a 403 for the files/upload/any uri. Looks like something our end.

Thanks for your incredibly speedy responses guys!

thebleucheese commented 1 year ago

A note on this: A 403 could be something network-related, but it might also be the user permissions. The file uploads need write access to quite a few things in the template database. You could try uploading with a more privileged user in VECTR like the admin account.

SRAPSpencer commented 1 year ago

Brief follow up @dermosaurus the latest ART should work that was just user error on my end.