search

cisagov / untitledgoosetool

Untitled Goose Tool is a robust and flexible hunt and incident response tool that adds novel authentication and data gathering methods in order to run a full investigation against a customer’s Azure Active Directory (AzureAD), Azure, and M365 environments.
Creative Commons Zero v1.0 Universal
913 stars 80 forks source link

Issue during dumping data #7

Closed realmee6 closed 1 year ago

realmee6 commented 1 year ago

Hi,

There seems to be an issue when trying to run goosey. It returns output for some functions and keys but at a point it breaks. Below is the error.

2023-03-26 15:48:59,285 - utils - ERROR - Error on nextLink retrieval: 'RuntimeError' object has no attribute 'status' (utils.py:343) Traceback (most recent call last): File "C:\Users\me\AppData\Local\Programs\Python\Python39\lib\site-packages\goosey\utils.py", line 260, in get_nextlink header = {'Authorization': '%s %s' % (auth['token_type'], auth['access_token'])} KeyError: 'token_type'

During handling of the above exception, another exception occurred:

Traceback (most recent call last): File "C:\Users\me\AppData\Local\Programs\Python\Python39\lib\site-packages\goosey\azure_ad_datadumper.py", line 234, in dump_azuread_audit await get_nextlink(nexturl, outfile, self.ahsession, self.logger, self.auth) File "C:\Users\me\AppData\Local\Programs\Python\Python39\lib\site-packages\goosey\utils.py", line 288, in get_nextlink if e.status: AttributeError: 'KeyError' object has no attribute 'status'

Traceback (most recent call last): File "C:\Users\me\AppData\Local\Programs\Python\Python39\Scripts\goosey-script.py", line 33, in sys.exit(load_entry_point('goosey==1.0.0', 'console_scripts', 'goosey')()) File "C:\Users\me\AppData\Local\Programs\Python\Python39\lib\site-packages\goosey\main.py", line 88, in main honkmain(args) File "C:\Users\me\AppData\Local\Programs\Python\Python39\lib\site-packages\goosey\honk.py", line 217, in main asyncio.run(run(args, config, auth)) File "C:\Users\me\AppData\Local\Programs\Python\Python39\lib\asyncio\runners.py", line 44, in run return loop.run_until_complete(main) File "C:\Users\me\AppData\Local\Programs\Python\Python39\lib\asyncio\base_events.py", line 647, in run_until_complete return future.result() File "C:\Users\me\AppData\Local\Programs\Python\Python39\lib\site-packages\goosey\honk.py", line 139, in run await asyncio.gather(*tasks) File "C:\Users\me\AppData\Local\Programs\Python\Python39\lib\site-packages\goosey\azure_ad_datadumper.py", line 253, in dump_azuread_audit if e.status: AttributeError: 'AttributeError' object has no attribute 'status'

victoriawallace-cisa commented 1 year ago

Hello, thank you for reporting this issue. In your .conf file, what pulls did you set to True?

realmee6 commented 1 year ago

Hi,

Only AzureAD checks are set to true. Government functions are set to False, M365 and MSGtrace are disabled.

victoriawallace-cisa commented 1 year ago

I think you're encountering the issue because your authentication timed out. Can you try re-authing with goosey auth, set the completed AzureAD checks to false, re-run goosey honk and let us know how it goes? We might have to incorporate better error handling for auth timeout if that's the case.

realmee6 commented 1 year ago

Hi,

I am doing the following: goosey auth --interactive as there is third-party MFA involved. The timeouts I do not know from what they are coming but it's always failing at the same item/process step.

victoriawallace-cisa commented 1 year ago

Would you mind running goosey auth --interactive --debug and posting the output here?

victoriawallace-cisa commented 1 year ago

We were able to replicate the issue. This error will be addressed in a future update.

victoriawallace-cisa commented 1 year ago

@realmee6 Can you grab the latest version of the tool and test it out again?

victoriawallace-cisa commented 1 year ago

@realmee6 We have not heard back from you, if you are still having this issue, please create a new issue.