SecurityRiskAdvisors / VECTR

VECTR is a tool that facilitates tracking of your red and blue team testing activities to measure detection and prevention capabilities across different attack scenarios
1.39k stars 164 forks source link

Win10 binding ports/ip #3

Closed Fortesqueu closed 6 years ago

Fortesqueu commented 6 years ago

Hello to everyone,

I'm experiencing some issues related to binding the ports/ip and finding the webserver. I'm using Docker from a Win10 machine.

After performing the command: docker-compose -f docker-compose.yml -f dev.yml -p dev up -d

capture

Then, with "docker ps" I can see:

capture2

I've tried to go into: http://your_docker_host:8080/sra-purpletools-webui/app, as shown in the images below (I've tried with Chrome and IE) but I am not able to connect into the web server. I've tried localhost IP (0.0.0.0) and Ethernet adapter vEthernet (DockerNAT: 192.168.16.1), but no one is able to let me reach the webserver.

capture3 capture4

I've also tried IP's from docker container (10.0.75.0), but same result.

Could you give me some advice or clue of what I'm doing wrong?

Appreciated

carlvonderheid commented 6 years ago

Fortesqueu,

Can you try to hit 127.0.0.1:8080/sra-purpletools-webui/app from the node that you’re running docker on and see if that works?

Thanks, Carl

From: Fortesqueu [mailto:notifications@github.com] Sent: Wednesday, March 14, 2018 2:09 PM To: SecurityRiskAdvisors/VECTR VECTR@noreply.github.com Cc: Subscribed subscribed@noreply.github.com Subject: [EXT] - [SecurityRiskAdvisors/VECTR] Win10 binding ports/ip (#3)

Hello to everyone,

I'm experiencing some issues related to binding the ports/ip and finding the webserver. I'm using Docker from a Win10 machine.

After performing the command: docker-compose -f docker-compose.yml -f dev.yml -p dev up -d [capture]https://user-images.githubusercontent.com/19146280/37421283-311a01b6-27b9-11e8-970d-5b4647522ab2.PNG

Then, with "docker ps" I can see: [capture2]https://user-images.githubusercontent.com/19146280/37421337-56ab1636-27b9-11e8-8ca5-ebb43bbac290.PNG

I've tried to go into: http://your_docker_host:8080/sra-purpletools-webui/app, as shown in the images below (I've tried with Chrome and IE) but I am not able to connect into the web server. I've tried localhost IP (0.0.0.0) and Ethernet adapter vEthernet (DockerNAT: 192.168.16.1), but no one is able to let me reach the webserver. [capture3]https://user-images.githubusercontent.com/19146280/37421577-ecdf203e-27b9-11e8-9b47-31c05e4eac9e.PNG [capture4]https://user-images.githubusercontent.com/19146280/37421580-efaa5540-27b9-11e8-9062-2f89f90d7c4f.PNG

I've also tried IP's from docker container (10.0.75.0), but same result.

Could you give me some advice or clue of what I'm doing wrong?

Appreciated

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHubhttps://github.com/SecurityRiskAdvisors/VECTR/issues/3, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AhKVfAAR1z-aSYt6xSXqbHG2ZC3D2PSuks5teVzDgaJpZM4Sq7Jd.

Fortesqueu commented 6 years ago

http://127.0.0.1:8080/sra-purpletools-webui/app ends in the same result

carlvonderheid commented 6 years ago

Apologies…http://127.0.0.1:8081/sra-purpletools-webui/app

The 8081 is the port on your host. The tomcat server inside of your vectr_tomcat container is listening on 8080. Docker is forwarding traffic from your 127.0.0.1:8081 to vectr_tomcat:8080.

-Carl

From: Fortesqueu [mailto:notifications@github.com] Sent: Wednesday, March 14, 2018 2:27 PM To: SecurityRiskAdvisors/VECTR VECTR@noreply.github.com Cc: Carl Vonderheid carl.vonderheid@securityriskadvisors.com; Comment comment@noreply.github.com Subject: [EXT] - Re: [SecurityRiskAdvisors/VECTR] Win10 binding ports/ip (#3)

http://127.0.0.1:8080/sra-purpletools-webui/app ends in the same result

— You are receiving this because you commented. Reply to this email directly, view it on GitHubhttps://github.com/SecurityRiskAdvisors/VECTR/issues/3#issuecomment-373127503, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AhKVfLRXMFOmTTB9l7sbCWpYMDvHUwPfks5teWECgaJpZM4Sq7Jd.

Fortesqueu commented 6 years ago

Returns an error, but it's slightly different. Now it's a 404 err.

capture5
Reality9 commented 6 years ago

What version are you running? Its your WAR file in the docker container. Its not there.

On Wed, Mar 14, 2018 at 11:40 AM, Fortesqueu notifications@github.com wrote:

Returns an error, but it's slightly different. Now it's a 404 err. [image: capture5] https://user-images.githubusercontent.com/19146280/37423953-7d668250-27bf-11e8-9b2d-6bf70b922564.PNG

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/SecurityRiskAdvisors/VECTR/issues/3#issuecomment-373131741, or mute the thread https://github.com/notifications/unsubscribe-auth/AE8ZsqeBl73HiIgTZHr8dE4XYhGFazblks5teWQIgaJpZM4Sq7Jd .

Reality9 commented 6 years ago

you need to access your container, and re-download the zip, and place the WAR files in the appropriate place.

On Wed, Mar 14, 2018 at 11:43 AM, Reality9 reality9@gmail.com wrote:

What version are you running? Its your WAR file in the docker container. Its not there.

On Wed, Mar 14, 2018 at 11:40 AM, Fortesqueu notifications@github.com wrote:

Returns an error, but it's slightly different. Now it's a 404 err. [image: capture5] https://user-images.githubusercontent.com/19146280/37423953-7d668250-27bf-11e8-9b2d-6bf70b922564.PNG

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/SecurityRiskAdvisors/VECTR/issues/3#issuecomment-373131741, or mute the thread https://github.com/notifications/unsubscribe-auth/AE8ZsqeBl73HiIgTZHr8dE4XYhGFazblks5teWQIgaJpZM4Sq7Jd .

carlvonderheid commented 6 years ago

In your “wars” directory, do you see 3 war files? Have they been expanded into directories?

From: Fortesqueu [mailto:notifications@github.com] Sent: Wednesday, March 14, 2018 2:27 PM To: SecurityRiskAdvisors/VECTR VECTR@noreply.github.com Cc: Carl Vonderheid carl.vonderheid@securityriskadvisors.com; Comment comment@noreply.github.com Subject: [EXT] - Re: [SecurityRiskAdvisors/VECTR] Win10 binding ports/ip (#3)

http://127.0.0.1:8080/sra-purpletools-webui/app ends in the same result

— You are receiving this because you commented. Reply to this email directly, view it on GitHubhttps://github.com/SecurityRiskAdvisors/VECTR/issues/3#issuecomment-373127503, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AhKVfLRXMFOmTTB9l7sbCWpYMDvHUwPfks5teWECgaJpZM4Sq7Jd.

Fortesqueu commented 6 years ago

I'm using VECTR Community Edition 4.0.0 (the last download available, cause 4.1.0 is empty of content)

Folder with the unzipped file

capture6

Folder wars:

capture7
thebleucheese commented 6 years ago

I've updated the readme to correct some of the documentation like the application default port and a link to the latest release zip (4.1.1) https://github.com/SecurityRiskAdvisors/VECTR/releases/tag/ce-4.1.1 The previous release link was incorrect (4.1.0).

Also, are you using Windows 10 pro with HyperV and Docker? If you're not and are instead using the Docker Toolbox workaround with Windows 10 Home and Virtualbox, the setup can be tricky. https://forums.docker.com/t/docker-compose-volume-mounts-dont-work-with-docker-toolbox-running-on-windows/26211/4

You may need to add virtualbox shared volumes to the Virtualbox base Docker VM. For VECTR, the docker-compose.yml file default shared volumes are linux paths /var/data/sandbox1, /opt/vectr/wars and /opt/vectr/backup. They should convert to windows paths ok, but I believe virtualbox will need shared folders for docker containers to see that data. The Tomcat server in the VECTR container is looking for those shared volumes to deploy the WAR files. If it can't find them, it won't be able to deploy anything.

Alternatively, you could copy the WARs directly into the container. However, if you do this and don't have shared folders setup, any data you enter won't be saved when the container goes down - since there's no shared volume it won't save your database to the container host hard drive. This stuff is all only applicable to a Win 10 Home/Virtualbox Docker setup... with HyperV it should just work and on linux with docker it will also generally just work.

core-dump-19700101 commented 6 years ago

May consider just change the release link from readme to https://github.com/SecurityRiskAdvisors/VECTR/releases/latest instead. It's not a direct link to the ZIP archive, but it might help reduce human errors (my bad).

Fortesqueu commented 6 years ago

Appreciated :)

Fortesqueu commented 6 years ago

I've been trying to make this work. I've followed @thebleucheese recomendations and I've figured that my configurations are "Windows 10 pro with HyperV and Docker". I've tried to run Apache Tomcat Image (the regular one), and I can reach the apache tomcat welcome page (localhost:8080), but the "vectr_tomcat" image is not working. I suppose that I don't have the WAR files in the right location, so I've removed the comments from the Dockerfile, allowing this commands: COPY wars/sra-oauth2-rest.war /usr/local/tomcat/webapps/sra-oauth2-rest.war COPY wars/sra-purpletools-rest.war /usr/local/tomcat/webapps/sra-purpletools-rest.war COPY wars/sra-purpletools-webui.war /usr/local/tomcat/webapps/sra-purpletools-webui.war

But doesn't work anyway. I assume those linux locations are related to where "vectr_tomcat" is searching the WAR files, so that's why I've uncommented them.

At this point, I'm very lost because I can access the regular tomcat welcome page and not the VECTR one, thing that pisses me off.

I really appreciate the support your are giving to me guys, and I understand the complexity of debugging errors without seeing them.

carlvonderheid commented 6 years ago

Can you log into the continer: "docker exec -it vectr_tomcat_sandbox1 /bin/bash"

Then cd to the webapps directory: "cd webapps"

then paste the results of: "ls -la"

Fortesqueu commented 6 years ago

@carlvonderheid There are no files in the directory, I guess I should paste the WAR files there but I'm searching some good solution of how to share volumes as @thebleucheese suggested.

carlvonderheid commented 6 years ago

In the docker-compose.yml, did you change the tomcat volumes? They are currently set to /opt/vectr/wars in the community edition: volumes:

You'll probably have to point these to your Windows paths.

There is another volume being mounted in the dev.yml. This is where your mongodb data is going to get written to on your host: volumes:

Fortesqueu commented 6 years ago

Well, I've downloaded the ZIP in the Docker machine saving the WAR files in the webapps folder. I know that I'll losss my data if the container goes down, as @thebleucheese indicated previously, but at least it's working fow now and I can try the product.

I'll dig further on how to have a stable shared folder between Docker and Win10.

Thank you to all involved in this issue. Your help is very appreciated.

thebleucheese commented 6 years ago

Hey @Fortesqueu sorry you had to deal with some headaches getting the containers working properly. We're investigating mounting issues on windows 10 now and we're running into a lot of the same problems you did.

We created a shared drive and we've tried named volumes as well, but haven't found a very clean solution yet. We'd like to make sure that we document a fix for this and include it in our readme so that other users don't encounter the same issues.

Did you end up finding a stable solution for sharing Win10 directories between your host and a docker container that worked well?

Fortesqueu commented 6 years ago

Nope, I'd like to find some good solution, I've tried to mount a shared drive in C:/ with the settings manager in dockers app, but it still not works. I'm testing the capabilities in the non-stable version I've managed to run.

If I make some progress I'll notice here.