cisagov / untitledgoosetool

Untitled Goose Tool is a robust and flexible hunt and incident response tool that adds novel authentication and data gathering methods in order to run a full investigation against a customer’s Azure Active Directory (AzureAD), Azure, and M365 environments.
Creative Commons Zero v1.0 Universal
904 stars 77 forks source link

Traceback - runpy.py, line 196 #54

Closed mosmithtva closed 1 year ago

mosmithtva commented 1 year ago

🐛 Summary

What's wrong? Please be specific. Getting an error with goosey honk

To reproduce

Steps to reproduce the behavior:

Expected behavior

What did you expect to happen that didn't? run to completion successfully.

Any helpful log output or screenshots

Paste the results here:

2023-08-01 14:25:50,294 - utils - INFO - Finished dumping subscribedSkus information. (utils.py:380)
2023-08-01 14:25:50,419 - utils - INFO - Finished dumping authenticationContextClassReferences information. (utils.py:380)
2023-08-01 14:25:50,428 - utils - INFO - Finished dumping servicePrincipalRiskDetections information. (utils.py:380)
2023-08-01 14:25:50,495 - utils - INFO - Finished dumping riskyServicePrincipals information. (utils.py:380)
2023-08-01 14:25:50,507 - azure_ad_datadumper - INFO - Dumping identityProtection/riskyServicePrincipals history information... (azure_ad_datadumper.py:389)
2023-08-01 14:25:50,512 - utils - INFO - Finished dumping roleDefinitions information. (utils.py:380)
2023-08-01 14:25:50,583 - utils - INFO - Finished dumping adminConsentRequestPolicy information. (utils.py:380)
2023-08-01 14:25:50,590 - utils - INFO - Finished dumping identitySecurityDefaultsEnforcementPolicy information. (utils.py:380)
2023-08-01 14:25:50,597 - utils - INFO - Finished dumping namedLocations information. (utils.py:380)
Traceback (most recent call last):
  File "C:\Users\XXX\AppData\Local\Programs\Python\Python310\lib\runpy.py", line 196, in _run_module_as_main
    return _run_code(code, main_globals, None,
  File "C:\Users\XXX\AppData\Local\Programs\Python\Python310\lib\runpy.py", line 86, in _run_code
    exec(code, run_globals)
  File "C:\Users\XXX\AppData\Local\Programs\Python\Python310\Scripts\goosey.exe\__main__.py", line 7, in <module>
  File "C:\Users\XXX\AppData\Local\Programs\Python\Python310\lib\site-packages\goosey\main.py", line 89, in main
    honkmain(args)
  File "C:\Users\XXX\AppData\Local\Programs\Python\Python310\lib\site-packages\goosey\honk.py", line 299, in main
    asyncio.run(run(args, config, auth, init_sections, auth_un_pw=auth_un_pw))
  File "C:\Users\XXX\AppData\Local\Programs\Python\Python310\lib\asyncio\runners.py", line 44, in run
    return loop.run_until_complete(main)
  File "C:\Users\XXX\AppData\Local\Programs\Python\Python310\lib\asyncio\base_events.py", line 649, in run_until_complete
    return future.result()
  File "C:\Users\XXX\AppData\Local\Programs\Python\Python310\lib\site-packages\goosey\honk.py", line 162, in run
    await asyncio.gather(*tasks)
  File "C:\Users\XXX\AppData\Local\Programs\Python\Python310\lib\site-packages\goosey\azure_ad_datadumper.py", line 549, in dump_risky_objects
    await asyncio.gather(
  File "C:\Users\XXX\AppData\Local\Programs\Python\Python310\lib\site-packages\goosey\azure_ad_datadumper.py", line 454, in helper_multiple_object
    with open(outfile, 'w', encoding='utf-8') as f:
FileNotFoundError: [Errno 2] No such file or directory: 'output\\azuread\\identityProtection/riskyServicePrincipals_history.json'

Add any screenshots of the problem here.

victoriawallace-cisa commented 1 year ago

@mosmithtva Are you willing to test something for us?

        if '/' in parent:
            parent = parent.replace("/", "")

Could you add the above two lines under line 450 in azure_ad_datadumper.py? Please make sure the indentation matches the two lines above line 450.

Afterwards, please do a pip install . and run goosey honk --debug and let me know if that fixes the issue?

mosmithtva commented 1 year ago

Change made and seems successful. It does eventually timeout. @.***

victoriawallace-cisa commented 1 year ago

Thanks! We'll incorporate the fix into the next version update.

The timeout is due to the bearer token for the application authentication being good for one hour.

victoriawallace-cisa commented 1 year ago

Incorporated fix into #55