cisagov / untitledgoosetool

Untitled Goose Tool is a robust and flexible hunt and incident response tool that adds novel authentication and data gathering methods in order to run a full investigation against a customer’s Azure Active Directory (AzureAD), Azure, and M365 environments.
Creative Commons Zero v1.0 Universal
904 stars 77 forks source link

Error authenticating as app: Invalid parameter type (auth.py:897) #51

Closed mosmithtva closed 1 year ago

mosmithtva commented 1 year ago

🐛 Summary

What's wrong? Please be specific.

Configured .auth and .conf Running on Windows 11 with python installed Getting "Error authenticating app" running goosey auth I am able to complete MFA twice.

To reproduce

goosey auth 2023-07-25 13:08:53,715 - auth - INFO - Attempting to automatically auth via device code. You may have to accept MFA prompts. (auth.py:124) 2023-07-25 13:09:20,458 - auth - INFO - Device code authentication - Your MFA code is: XXX (auth.py:218) 2023-07-25 13:09:57,833 - auth - INFO - Device code authentication complete. (auth.py:308) 2023-07-25 13:10:01,864 - auth - INFO - Attempting to automatically auth as an user. You may have to accept MFA prompts. (auth.py:344) 2023-07-25 13:10:26,432 - auth - INFO - M365 user authentication - Your MFA code is: XXX (auth.py:426) 2023-07-25 13:11:47,979 - auth - INFO - First tab: Obtained audit log cookies. (auth.py:571) 2023-07-25 13:11:48,010 - auth - INFO - Third tab: Obtained Exchange cookies. (auth.py:590) 2023-07-25 13:11:48,036 - auth - INFO - Second tab: Exchange Control Panel cookies acquired. (auth.py:618) 2023-07-25 13:11:53,216 - auth - INFO - User authentication complete. (auth.py:633) 2023-07-25 13:11:57,494 - auth - ERROR - Error authenticating as app: Invalid parameter type (auth.py:897) 2023-07-25 13:11:57,723 - auth - ERROR - Error authenticating as app: Invalid parameter type (auth.py:897) 2023-07-25 13:11:57,935 - auth - ERROR - Error authenticating as app: Invalid parameter type (auth.py:897) 2023-07-25 13:11:58,160 - auth - ERROR - Error authenticating as app: Invalid parameter type (auth.py:897)

Steps to reproduce the behavior:

  1. python.exe -m pip install .
  2. python scripts/generate_conf.py
  3. goosey auth

Expected behavior

What did you expect to happen that didn't?

Any helpful log output or screenshots

Paste the results here:

Add any screenshots of the problem here.

victoriawallace-cisa commented 1 year ago

@mosmithtva Hello, we've updated the tool to v1.2.4 to address this issue. Can you try it again and let us know how it goes?

mosmithtva commented 1 year ago

Thanks for the quick turn-around, unfortunately, the issue persists. After git pull:

PS> goosey auth 2023-07-28 08:45:44,177 - auth - INFO - Attempting to automatically auth via device code. You may have to accept MFA prompts. (auth.py:124) 2023-07-28 08:46:12,088 - auth - INFO - Device code authentication - Your MFA code is: XXX (auth.py:218) 2023-07-28 08:46:49,147 - auth - INFO - Device code authentication complete. (auth.py:308) 2023-07-28 08:46:53,226 - auth - INFO - Attempting to automatically auth as an user. You may have to accept MFA prompts. (auth.py:344) 2023-07-28 08:47:16,194 - auth - INFO - M365 user authentication - Your MFA code is: XXX (auth.py:426) 2023-07-28 08:48:37,510 - auth - INFO - First tab: Obtained audit log cookies. (auth.py:571) 2023-07-28 08:48:37,537 - auth - INFO - Third tab: Obtained Exchange cookies. (auth.py:590) 2023-07-28 08:48:37,566 - auth - INFO - Second tab: Exchange Control Panel cookies acquired. (auth.py:618) 2023-07-28 08:48:41,976 - auth - INFO - User authentication complete. (auth.py:633) 2023-07-28 08:48:46,313 - auth - ERROR - Error authenticating as app: Invalid parameter type (auth.py:897) 2023-07-28 08:48:46,554 - auth - ERROR - Error authenticating as app: Invalid parameter type (auth.py:897) 2023-07-28 08:48:46,773 - auth - ERROR - Error authenticating as app: Invalid parameter type (auth.py:897) 2023-07-28 08:48:46,984 - auth - ERROR - Error authenticating as app: Invalid parameter type (auth.py:897)

victoriawallace-cisa commented 1 year ago

@mosmithtva You will need to install the latest version--based on the auth.py lines, it looks like while you might have downloaded the latest version, you didn't install the latest version. Can you install the latest version and try again?

mosmithtva commented 1 year ago

Thank you. That resolved that issue. Getting an error on goosey honk. I'll open a separate issue.

victoriawallace-cisa commented 1 year ago

Thanks! We'll go ahead and close out this issue.