cisagov / untitledgoosetool

Untitled Goose Tool is a robust and flexible hunt and incident response tool that adds novel authentication and data gathering methods in order to run a full investigation against a customer’s Azure Active Directory (AzureAD), Azure, and M365 environments.
Creative Commons Zero v1.0 Universal
904 stars 77 forks source link

goosey auth is not working. #42

Closed allizkid closed 1 year ago

allizkid commented 1 year ago

hello, I have correctly filled .auth file with credentials, yet when running goosey auth command it asked to input credentials. i inputed the credentials correctly on terminal and produced the following error.

2023-06-07 10:16:00,317 - auth - DEBUG - No .auth file detected, proceeding with prompting user for username, password, application id, and application client secret inputs. (auth.py:949) 2023-06-07 10:16:15,159 - utils - WARNING - Missing section in config file: config. Proceeding. (utils.py:227) 2023-06-07 10:16:15,159 - utils - WARNING - Missing section in config file: config. Proceeding. (utils.py:227) Traceback (most recent call last): File "C:\Users\AppData\Local\Programs\Python\Python310\lib\runpy.py", line 196, in _run_module_as_main return _run_code(code, main_globals, None, File "C:\Users\AppData\Local\Programs\Python\Python310\lib\runpy.py", line 86, in _run_code exec(code, run_globals) File "C:\Users\AppData\Local\Programs\Python\Python310\Scripts\goosey-gui.exe__main__.py", line 7, in File "C:\Users\AppData\Local\Programs\Python\Python310\lib\site-packages\gooey\python_bindings\gooey_decorator.py", line 134, in return lambda *args, *kwargs: func(args, **kwargs) File "C:\Users\AppData\Local\Programs\Python\Python310\lib\site-packages\goosey\guimain.py", line 65, in main gooseymain() File "C:\Users\AppData\Local\Programs\Python\Python310\lib\site-packages\goosey\main.py", line 80, in main auth.parse_args(args) File "C:\Users\AppData\Local\Programs\Python\Python310\lib\site-packages\goosey\auth.py", line 960, in parse_args self.parse_config(self.config)
File "C:\Users\AppData\Local\Programs\Python\Python310\lib\site-packages\goosey\auth.py", line 659, in parse_config self.us_government = config_get(config, 'config', 'us_government', self.logger).lower() AttributeError: 'NoneType' object has no attribute 'lower'

victoriawallace-cisa commented 1 year ago

Hello, it looks like you're having a few problems.

For the first issue of it not reading the .auth file, the tool is not able to detect where your .auth file is. If it is in a different location than the untitledgoosetool folder, you will need to move it into that folder. For example, if it is in your Desktop\untitledgoosetool\scripts folder, you will need to manually move the .auth into your Desktop\untitledgoosetool folder.

For the second issue, you will also need to fill out the .conf file. Please fill out the [config] portion of the .conf as all fields in that section are required.

allizkid commented 1 year ago

Hello, Thank you for the response

the .auth file is in untitledgoosetool folder. I have also filled all the required configurations as per the read me guide including us_government to False.

auth and conf in the right location

victoriawallace-cisa commented 1 year ago

If you are using the terminal, please make sure to run goose in the same folder as where you installed it. If not, please cd to the folder and run goose from there.

allizkid commented 1 year ago

I'd run the tool where I installed it

On Wed, Jun 7, 2023, 5:42 PM victoriawallace-cisa @.***> wrote:

If you are using the terminal, please make sure to run goose in the same folder as where you installed it. If not, please cd to the folder and run goose from there.

— Reply to this email directly, view it on GitHub https://github.com/cisagov/untitledgoosetool/issues/42#issuecomment-1580971447, or unsubscribe https://github.com/notifications/unsubscribe-auth/AOQJXNSIOXIJICI4TMBDR6DXKCHODANCNFSM6AAAAAAY5V2WX4 . You are receiving this because you authored the thread.Message ID: @.***>

victoriawallace-cisa commented 1 year ago

Can you rerun the program with goosey auth --debug and post the results here? I was able to replicate your exact issue when I ran goosey-gui outside of the untitledgoosetool folder.

allizkid commented 1 year ago

Here is the result from untitledgoosetool folder

auth form goose folder

victoriawallace-cisa commented 1 year ago

Can you try running it with an administrator PowerShell?

allizkid commented 1 year ago

I have run it with an administrator powershell, yet still the issue exists

victoriawallace-cisa commented 1 year ago

@allizkid I'm not able to replicate the issue unless I'm in a different directory. The issue is that the tool is not able to detect/read the two files: .auth and .conf.

To help troubleshoot, can you provide the following information:

  1. How you installed the tool along with any system information (Python version installed, OS version)
  2. Contents of your config file (you can hide the actual values, but please indicate the values that are filled in)

Also, try to install the tool on your Desktop folder instead?

allizkid commented 1 year ago

I tried to install the tool on desktop and the below attached new error appeared.

auth running on desktop

allizkid commented 1 year ago

@victoriawallace-cisa I configured the left conf settings and it authenticated fine. Thank you for the assistance.

victoriawallace-cisa commented 1 year ago

Thanks!