cisagov / untitledgoosetool

Untitled Goose Tool is a robust and flexible hunt and incident response tool that adds novel authentication and data gathering methods in order to run a full investigation against a customer’s Azure Active Directory (AzureAD), Azure, and M365 environments.
Creative Commons Zero v1.0 Universal
904 stars 77 forks source link

No such file or directory: 'ugt_auth' #20

Closed chadht closed 1 year ago

chadht commented 1 year ago

🐛 Summary

What's wrong? Please be specific.

Error for ugt_auth not found. Does this file need to be created manually?

To reproduce

Added required info to .conf file

ran: goosey auth

Steps to reproduce the behavior:

  1. Do this: setup .conf file
  2. Then this run goosey auth

Expected behavior

What did you expect to happen that didn't?

Expected to get a different auth message after running goosey auth a second time.

Any helpful log output or screenshots

Paste the results here:

goosey auth 2023-04-05 12:37:10,876 - auth - INFO - Could not read current authfile: Expecting value: line 1 column 1 (char 0) This is normal if this is your first time running auth. (auth.py:509)


Python 3.9.2, Windows 10

Add any screenshots of the problem here. goosey-gui

victoriawallace-cisa commented 1 year ago

@chadht Can you download and install the newest version of goose and try again? Let us know how it goes.

chadht commented 1 year ago

@victoriawallace-cisa thanks for your help. I downloaded and installed the new version but still get an error about missing file '.ugt_auth'. Could this be an MFA issue? We use it in our environment. Should the dashes be included when entering the client id?

goose sc

victoriawallace-cisa commented 1 year ago

@chadht Did you also fill out the .conf file with your tenantid? Yes, dashes should be included when entering the client id. Push notification MFA method is currently the only MFA method supported using this tool.

chadht commented 1 year ago

@victoriawallace-cisa yes, the tenantid is in the .conf file.

conf cmd error path gui error

victoriawallace-cisa commented 1 year ago

It looks like its an error with the gooey python module and Windows. Here's how to fix it:

  1. Download the Gooey source code from here: https://github.com/chriskiehl/Gooey/archive/refs/tags/1.0.8.1.zip
  2. Extract the .zip.
  3. Open the following file in a text editor: gooey/gooey/gui/cli.py
  4. Replace the file with the following code:
    
    import sys

from itertools import chain

from copy import deepcopy

from gooey.util.functional import compact

def buildCliString(target, cmd, positional, optional, suppress_gooey_flag=False): positionals = deepcopy(positional) if positionals: positionals.insert(0, "--")

cmd_string = ' '.join(compact(chain(optional, positionals)))

if cmd != '::gooey/default':
    cmd_string = u'{} {}'.format(cmd, cmd_string)

ignore_flag = '' if suppress_gooey_flag else '--ignore-gooey'
if sys.platform == 'win32':
    return u'{}-script.py {} {}'.format(target, ignore_flag, cmd_string)
else:
    return u'{} {} {}'.format(target, ignore_flag, cmd_string)

5. In the Gooey folder, run a `python -m pip install .` (Make sure you are in the folder for the Gooey module).
6. Re-install the untitledgoosetool as well `python -m pip install .` or `python3 -m pip install .`
7. Run `goosey-gui`

Please let us know if that fixes the issue.
chadht commented 1 year ago

After clicking start in the gui, it just runs and never stops. I get an error when I run goosey auth from command line.

goosey

For step 6 in the instructions, was I supposed to re-install untitledgoosetool in the newly created Gooey-1.0.81 folder or the original location when I first tried installing the tool?

victoriawallace-cisa commented 1 year ago

After clicking start in the gui, it just runs and never stops. I get an error when I run goosey auth from command line.

For step 6 in the instructions, was I supposed to re-install untitledgoosetool in the newly created Gooey-1.0.81 folder or the original location when I first tried installing the tool?

The original location of where you installed the tool. In the above error message, it looks like its a different error. You'll need to fill out all the fields in the [conf] part of your .conf file.

Make sure to run the commands (like goosey gui) in the Untitled Goose Tool folder as well.

In one of the previous posts, you did not have the us_government or exo_us_government fields completed. You'll need to set those to True or False before running any of the goosey commands.

chadht commented 1 year ago

@victoriawallace-cisa it's working now. Thanks for your help.