digitalsleuth / WIN-FOR

Windows Forensics Environment Builder
https://digitalsleuth.gitbook.io/win-for-documentation/
MIT License
106 stars 18 forks source link

Issue when start to download or install. #2

Closed Heimdall4n6 closed 1 year ago

Heimdall4n6 commented 1 year ago

I have an issue on a new win 11 machine and VM. Requirements already installed but error message .

Send you log file winfor-customizer-output-20230620-051832.log

digitalsleuth commented 1 year ago

This appears to be an issue with the System.Security permissions management. I'll take a look this afternoon, but in the meantime you can try deleting the C:\winfor-temp folder and the contents of the salt directory at C:\ProgramData\Salt Project\Salt\srv\salt and try again.

Cheers!

Heimdall4n6 commented 1 year ago

thank you for your answer. done deltion but same issue.

Le mar. 20 juin 2023 à 17:46, Digital Sleuth @.***(mailto:Le mar. 20 juin 2023 à 17:46, Digital Sleuth < a écrit :

This appears to be an issue with the System.Security permissions management. I'll take a look this afternoon, but in the meantime you can try deleting the C:\winfor-temp folder and the contents of the salt directory at C:\ProgramData\Salt Project\Salt\srv\salt and try again.

Cheers!

— Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you authored the thread.Message ID: @.***>

digitalsleuth commented 1 year ago

@Heimdall4n6 when you ran the download or install commands, did you select a different user other than the one currently logged in?

Heimdall4n6 commented 1 year ago

yes indeed. i didn't understand that you had to enter the user name of the active windows session. I'll try tomorrow and let you know the result. thanks again

Le mar. 20 juin 2023 à 22:34, Digital Sleuth @.***(mailto:Le mar. 20 juin 2023 à 22:34, Digital Sleuth < a écrit :

@.***(https://github.com/Heimdall4n6) when you ran the download or install commands, did you select a different user other than the one currently logged in?

— Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you were mentioned.Message ID: @.***>

digitalsleuth commented 1 year ago

You do not have to enter the current logged in user, I'm just trying to narrow down the cause of the issue. The tool is intended to create the entered user if it does not currently exist, and install tools and configuration for that user. It appears that the issue may possibly be related to that option.

I'm working on it now and will get back to you once I have a resolution :)

digitalsleuth commented 1 year ago

@Heimdall4n6 Could you send me the winfor-saltstack*.log file so I can identify a bit better what the cause of the issue is? I've tried to duplicate the issue but without success.

Heimdall4n6 commented 1 year ago

can tou tell me where i can find this

Le mer. 21 juin 2023 à 03:48, Digital Sleuth @.***(mailto:Le mer. 21 juin 2023 à 03:48, Digital Sleuth < a écrit :

@.**(https://github.com/Heimdall4n6) Could you send me the winfor-saltstack.log file so I can identify a bit better what the cause of the issue is? I've tried to duplicate the issue but without success.

— Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you were mentioned.Message ID: @.***>

digitalsleuth commented 1 year ago

This is located at the root of the C drive.

Heimdall4n6 commented 1 year ago

winfor-customizer-output-20230622-102731.log Hi,

This is the only log file i have found.

digitalsleuth commented 1 year ago

Thanks for checking. I'm still working on duplicating the issue, but no luck yet. Can you provide me with the following information?

Cheers

Heimdall4n6 commented 1 year ago

no problem:

win 11 pro last release. no domain

on one the username have a space and on the over numbers.

I had also thought about the problem of spaces in the user name, which is known to cause problems with command lines, but the 2nd user name doesn't have spaces but has numbers.

thank you again

Le jeu. 22 juin 2023 à 13:56, Digital Sleuth @.***(mailto:Le jeu. 22 juin 2023 à 13:56, Digital Sleuth < a écrit :

Thanks for checking. I'm still working on duplicating the issue, but no luck yet. Can you provide me with the following information?

  • Version of Windows 11 you're using, including the edition (Home, Pro, Enterprise etc)
  • Is this system joined to a domain?
  • If joined to a domain, are you executing as a local admin or domain admin?
  • When entering the username to create, does it contain any spaces or non-alphanumeric characters?

Cheers

— Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you were mentioned.Message ID: @.***>

digitalsleuth commented 1 year ago

I think I have an idea of what might be causing the issue. Can you possibly create a new folder (doesn't matter the name or location), then right-click on the folder and select Properties. From there, click on the Security tab. Once there, can you take a screenshot and attach it here?

Heimdall4n6 commented 1 year ago

î’m not at work now can i do this tomorrow ?

Le jeu. 22 juin 2023 à 15:33, Digital Sleuth @.***(mailto:Le jeu. 22 juin 2023 à 15:33, Digital Sleuth < a écrit :

I think I have an idea of what might be causing the issue. Can you possibly create a new folder (doesn't matter the name or location), then right-click on the folder and select Properties. From there, click on the Security tab. Once there, can you take a screenshot and attach it here?

— Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you were mentioned.Message ID: @.***>

digitalsleuth commented 1 year ago

Of course. Cheers!

Heimdall4n6 commented 1 year ago

this is the screenshot of settings from security tab of a new folder Capture d'écran 2023-06-23 165346

digitalsleuth commented 1 year ago

Okay, looks like I was right in my thought process. In few separate locations in my code (here and here for example), I've made the assumption that the FileSystemAccessRule should apply to the "Users" group, enforcing the English word as a static value. Since you're working on a French system, the "Users" group is actually "Utilisateurs", and these sections are failing.

I'm going to try to re-work this in a better manner so as to adapt to other languages for this method and these functions. Thanks for bringing this to my attention!

Heimdall4n6 commented 1 year ago

no problem thank you again i ´m waiting for news from you … take your time. thank you again.

Le ven. 23 juin 2023 à 17:18, Digital Sleuth @.***(mailto:Le ven. 23 juin 2023 à 17:18, Digital Sleuth < a écrit :

Okay, looks like I was right in my thought process. In few separate locations in my code (here and here for example), I've made the assumption that the FileSystemAccessRule should apply to the "Users" group, enforcing the English word as a static value. Since you're working on a French system, the "Users" group is actually "Utilisateurs", and these sections are failing.

I'm going to try to re-work this in a better manner so as to adapt to other languages for this method and these functions. Thanks for bringing this to my attention!

— Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you were mentioned.Message ID: @.***>

digitalsleuth commented 1 year ago

Hi @Heimdall4n6 , I've generated a test Release Candidate for you to try out to see if this resolves your issue. If so, I'll make final adjustments and push a proper release. You can download the new, self-contained installer here.

digitalsleuth commented 1 year ago

Hi @Heimdall4n6 , have you had a chance to download and try the release candidate to see if this fixes your issue?

Heimdall4n6 commented 1 year ago

Hi,

i was able to test the rc version but unfortunately i still have the same problem.

i will try to test on an english windows version.

Le dim. 2 juil. 2023 à 02:41, Digital Sleuth @.***(mailto:Le dim. 2 juil. 2023 à 02:41, Digital Sleuth < a écrit :

Hi @.***(https://github.com/Heimdall4n6) , have you had a chance to download and try the release candidate to see if this fixes your issue?

— Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you were mentioned.Message ID: @.***>

digitalsleuth commented 1 year ago

Hi @Heimdall4n6 , I've managed to recreate the error and am working on a solution for this now. It does have to do with the language of the system, but I think it's slightly more subtle and specific than that. I'll keep you posted on the progress.

Heimdall4n6 commented 1 year ago

Hello,

thank you very much for your feedback. I'm glad you were able to reproduce the error and that it may be useful to you. i'm waiting for the corrected version so i can test it. thank you.

Le mar. 4 juil. 2023 à 04:48, Digital Sleuth @.***(mailto:Le mar. 4 juil. 2023 à 04:48, Digital Sleuth < a écrit :

Hi @.***(https://github.com/Heimdall4n6) , I've managed to recreate the error and am working on a solution for this now. It does have to do with the language of the system, but I think it's slightly more subtle and specific than that. I'll keep you posted on the progress.

— Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you were mentioned.Message ID: @.***>

digitalsleuth commented 1 year ago

Hi @Heimdall4n6 , I've managed to fix the issue, but I haven't packaged the fix yet. I'm refactoring some of the code to be a bit more name-compliant. I'll upload the fixed version in a few hours once I get back to my computer.

digitalsleuth commented 1 year ago

Hi @Heimdall4n6 , I haven't forgotten about you. I've fixed and packaged the application, but haven't uploaded it yet, since I realized that the same issues regarding language also exist in the current Salt States, and wouldn't necessarily apply the same way on your system. I didn't want to have you try the application only for it to fail, so I'm finishing testing on the new Salt States, then will upload both the new States and new application.

I appreciate your patience, and will again let you know when it's all ready!

Heimdall4n6 commented 1 year ago

Hello,

no problem with deadlines i understand completely. thank you very much for the work done to solve the problem. i'm looking forward to testing your program which will help me prepare pc's or windows vm's for forensic analysis.

good luck to you and thanks again

Le jeu. 6 juil. 2023 à 20:37, Digital Sleuth @.***(mailto:Le jeu. 6 juil. 2023 à 20:37, Digital Sleuth < a écrit :

Hi @.***(https://github.com/Heimdall4n6) , I haven't forgotten about you. I've fixed and packaged the application, but haven't uploaded it yet, since I realized that the same issues regarding language also exist in the current Salt States, and wouldn't necessarily apply the same way on your system. I didn't want to have you try the application only for it to fail, so I'm finishing testing on the new Salt States, then will upload both the new States and new application.

I appreciate your patience, and will again let you know when it's all ready!

— Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you were mentioned.Message ID: @.***>

digitalsleuth commented 1 year ago

Hi @Heimdall4n6 , I've just uploaded the newest release, and have tested this and the associated Salt States over several days in a Windows 11 French (France) environment. Everything seems to be working well with both the application and the states.

Please let me know if this resolves the issue. Cheers!

digitalsleuth commented 1 year ago

Hi @Heimdall4n6 , have you had a chance to try this to see if your issues are resolved?

Heimdall4n6 commented 1 year ago

Hi, I'm currently on vacation but I'm going to ask some colleagues to try it out and let me know the results if you agree.

Le ven. 14 juil. 2023 à 15:46, Digital Sleuth @.***(mailto:Le ven. 14 juil. 2023 à 15:46, Digital Sleuth < a écrit :

Hi @.***(https://github.com/Heimdall4n6) , have you had a chance to try this to see if your issues are resolved?

— Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you were mentioned.Message ID: @.***>

digitalsleuth commented 1 year ago

Hi @Heimdall4n6 , I know you might still be on vacation, but on the chance that you're not, I just wanted to follow-up on this to see if you or your colleagues have had a chance to try this out.

Cheers!

Heimdall4n6 commented 1 year ago

hello,

new test today with las release and new fresh vm here is the issue:

from log:

2023-08-08 13:50:03.996 - Win-FOR Customizer v8.0.0

2023-08-08 13:50:04.002 - X-Ways is not selected and will not be downloaded installed

2023-08-08 13:50:04.002 - No theme has been selected.

2023-08-08 13:50:04.002 - WL is not selected.

2023-08-08 13:50:04.002 - Selected user is test007

2023-08-08 13:50:04.002 - Standalones path box was empty - default will be used - C: \standalone

2023-08-08 13:50:04.238 - C: \winfor-temp\ is being created for temporary storage of required files

2023-08-08 13:50:04.240 - Directory C: \winfor-temp\ already exists

2023-08-08 13:50:04.245 - Git 2.40.0 is not installed

2023-08-08 13:50:04.246 - Found previous download of Git - comparing hash

2023-08-08 13:50:04.589 - File Hash:

Ff8954afb29814821ee3759a761bdac49186085916f354f87063c7fe7a2

2023-08-08 13:50:04.589 - Given Hash:

ff8954afb2981482193759a761bdac49186085916f3546f8706e3c7fe7a2

2023-08-08 13:50:04.589 - Hash value for C: \winfor-temp\Git-2.40.0-64-bit.ex is correct, continuing..

2023-08-08 13:50:04.590 - Installing Git 2.40.0

2023-08-08 13:50:05.642 - Installation of Git v2.40.0 is complete

2023-08-08 13:50:05.642 - SaltStack 3005.1-2 is already installed

2023-08-08 13:50:05.642 - Current release of WIN-FOR is v2023.21.4

2023-08-08 13:50:05.643 - C: \winfor-temp\v2023.21.4.zip and C: \winfor-temp \v2023.21.4.zip. sha256 already exist and not zero-byte files.

2023-08-08 13:50:05.643 - Comparing hashes..

2023-08-08 13:50:06.381 - File Hash:

4a338606b4a5be5772d964b787fb0b704da69e1cd86ea14bba35377e2339f4

2023-08-08 13:50:06.381 - Given Hash:

f24c8db53d7827fa2e7b439725d63ed8d658a10c08041673993cfd6608458

2023-08-08 13:50:06.381 - Hashes do not match, aborting

thank you

Le ven. 28 juil. 2023 à 01:21, Digital Sleuth @.***(mailto:Le ven. 28 juil. 2023 à 01:21, Digital Sleuth < a écrit :

Hi @.***(https://github.com/Heimdall4n6) , I know you might still be on vacation, but on the chance that you're not, I just wanted to follow-up on this to see if you or your colleagues have had a chance to try this out.

Cheers!

— Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you were mentioned.Message ID: @.***>

digitalsleuth commented 1 year ago

@Heimdall4n6 Can you try again and see if you get the same result? Sometimes the hashes can be incorrect if the download didn't quite complete or was cut off.

digitalsleuth commented 1 year ago

I wasn't at a computer for my last response but I just confirmed that the hashes were, in fact, different for some reason. I just released a new version (no changes, just the version number) and the hashes match now. IF you try again, you shouldn't have any issues.

Heimdall4n6 commented 1 year ago

i will try tomorrow.

thank you again

Le mar. 8 août 2023 à 18:33, Digital Sleuth @.***(mailto:Le mar. 8 août 2023 à 18:33, Digital Sleuth < a écrit :

I wasn't at a computer for my last response but I just confirmed that the hashes were, in fact, different for some reason. I just released a new version (no changes, just the version number) and the hashes match now. IF you try again, you shouldn't have any issues.

— Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you were mentioned.Message ID: @.***>

Heimdall4n6 commented 1 year ago

This appears to be an issue with the System.Security permissions management. I'll take a look this afternoon, but in the meantime you can try deleting the C:\winfor-temp folder and the contents of the salt directory at C:\ProgramData\Salt Project\Salt\srv\salt and try again.

Cheers!

Heimdall4n6 commented 1 year ago

Hi,

I did a new install. The instance is completed with errors. I did not have time to control but i think some programs are missing. Isend you all logs.

Thank you winfor-customizer-output-20230809-013126.log winfor-customizer-output-20230809-120449.log winfor-saltstack-v2023.21.5.log

digitalsleuth commented 1 year ago

Hi @Heimdall4n6 , sorry for the delay, but I've been away on vacation. Can you confirm for me that the path C:\ProgramData\Salt Project\Salt\conf exists on your system, and if the file minion exists in that directory?

Heimdall4n6 commented 1 year ago

sorry for delay,

Yes the path exist and also the minion file inside

Le mar. 15 août 2023 à 19:13, Digital Sleuth @.***(mailto:Le mar. 15 août 2023 à 19:13, Digital Sleuth < a écrit :

Hi @.***(https://github.com/Heimdall4n6) , sorry for the delay, but I've been away on vacation. Can you confirm for me that the path C:\ProgramData\Salt Project\Salt\conf exists on your system, and if the file minion exists in that directory?

— Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you were mentioned.Message ID: @.***>

digitalsleuth commented 1 year ago

Hi @Heimdall4n6 , I'm unable to duplicate the error you encountered. Would you perhaps be able to uninstall SaltStack from your current Windows installation, then attempt the WIN-FOR installation or download process again?

digitalsleuth commented 1 year ago

Hi @Heimdall4n6 , please let me know if you've managed to try the suggestion above. If not, you can also try using the latest release (v8.2.0) to see if this assists in resolving the issue.

Heimdall4n6 commented 1 year ago

hi,

sorry I've been busy, I'll try the new version as soon as possible and get back to you.

Le mer. 6 sept. 2023 à 04:36, Digital Sleuth @.***(mailto:Le mer. 6 sept. 2023 à 04:36, Digital Sleuth < a écrit :

Hi @.***(https://github.com/Heimdall4n6) , please let me know if you've managed to try the suggestion above. If not, you can also try using the latest release (v8.2.0) to see if this assists in resolving the issue.

— Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you were mentioned.Message ID: @.***>

digitalsleuth commented 1 year ago

Hi @Heimdall4n6 , since it's been a while, I'm going to close this issue. However, if you continue to have this same issue, please let me know. If anything else comes up, please open a new Issue.

Cheers!

Heimdall4n6 commented 12 months ago

Hello, I'm sorry but lately I've been too busy to run new tests. I seem to have sent you the logs of my last test during which everything seemed to be installed but there were 2 errors. When I've run some more tests, I'll let you know if there were any problems. bravo for your work.

Le jeu. 5 oct. 2023 à 00:38, Digital Sleuth @.***(mailto:Le jeu. 5 oct. 2023 à 00:38, Digital Sleuth < a écrit :

Hi @.***(https://github.com/Heimdall4n6) , since it's been a while, I'm going to close this issue. However, if you continue to have this same issue, please let me know. If anything else comes up, please open a new Issue.

Cheers!

— Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you were mentioned.Message ID: @.***>