search

google / grr

GRR Rapid Response: remote live forensics for incident response
https://grr-doc.readthedocs.io/
Apache License 2.0
4.75k stars 761 forks source link

Installation of the Zeek/Linux using the docker pull Repo : Error encountered as i tried to install FleetSpeak Service on Windows Client(dbg_GRR_3.4.6.7_amd64.msi/GRR_3.4.6.7_amd64.msi #1032

Open Yashil06 opened 1 year ago

Yashil06 commented 1 year ago

Environment

docker run \ --name grr-server \ -e EXTERNAL_HOSTNAME= \ -e ADMIN_PASSWORD= \ -p 0.0.0.0:8000:8000 -p 0.0.0.0:8080:8080 \ -v grr-data:/data \ ghcr.io/google/grr:v3.4.6.7

3.4.6.7_amd64.amsi

┌──(root㉿kali)-[/var/log] └─# uname -a
Linux kali 6.1.0-kali7-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.20-2kali1 (2023-04-18) x86_64 GNU/Linux

Windows specifications :

edition : Windows 10 Home Version : 22H2 OS.Build : 19045.2846

Describe the issue Describe the issue that occurs and list steps to reproduce this behavior. Make sure to read GRR server doesn't seem to run and I don't see my clients. If the errors occur after an upgrade, make sure to read CHANGELOG for possible reasons.

Error logs "" Here is the following encountered Error Message as i try to install the "GRR_3.4.6.7_amd64.msi application". ""

Error Prompt : 

Copy-and-paste logs from the command you executed, GRR server log files, or flow logs.

Using the log file :

Loading configuration from C:\WINDOWS\system32\GRR\3.4.6.7\GRR.exe.yaml Loading configuration from C:\WINDOWS\system32\GRR\3.4.6.7\build.yaml Starting installation procedure for GRR client. Trying to stop service FleetspeakService. Tried to stop 'FleetspeakService', but the service is not installed. Trying to start service FleetspeakService. Tried to start 'FleetspeakService', but the service is not installed.

Additional context Add any other context about the problem here.

-The WebUI works perfectly, just for when I've tried to install the fleetspeak service, missing "fleetspeak service" from services.msc".

Some of the Repo to build Fleetspeak service, from github has a "404 error code."

Thank you, any response will be very much appreciated.

Furthermore i will like to add these two files for your convenience , in case this has to do with any conflict within them. GRR.exe.yaml.txt [GRR_fleetspeak_service_config.txt](https://github.com/google/grr/files/11457585/GRR_fleetspeak_service_config.txt)

Yashil06 commented 1 year ago

Just want to add a few debugging lines :

c:\Windows\System32\GRR\3.4.6.7>

c:\Windows\System32\GRR\3.4.6.7>GRR.exe --config grr.exe.yaml --verbose I0512 01:08:42.277603 20712 client_logging.py:113] Writing log file to C:\WINDOWS\System32\logfiles\GRR.log INFO:2023-05-12 01:08:42,277 client_logging:113] Writing log file to C:\WINDOWS\System32\logfiles\GRR.log INFO:2023-05-12 01:08:42,418 regconfig:87] Writing back configuration to key HKEY_LOCAL_MACHINE\Software\GRR. DEBUG:2023-05-12 01:08:42,532 config_lib:405] Applying filter env for SystemRoot. INFO:2023-05-12 01:08:42,534 sandbox:40] Initializing sandbox. Name: GRR_3.4.6.7. Read-only paths: ['C:\WINDOWS\System32\GRR\3.4.6.7']. Traceback (most recent call last): File "Lib\site-packages\grr_response_client\client.py", line 36, in File "absl\app.py", line 308, in run File "absl\app.py", line 254, in _run_main File "grr_response_client\client_main.py", line 90, in main File "grr_response_client\fleetspeak_client.py", line 64, in init File "fleetspeak\client_connector\connector.py", line 108, in init File "fleetspeak\client_connector\connector.py", line 63, in _EnvOpen ValueError: FLEETSPEAK_COMMS_CHANNEL_INFD is not set [5964] Failed to execute script 'client' due to unhandled exception!