search

redcanaryco / surveyor

A cross-platform baselining, threat hunting, and attack surface analysis tool for security teams.
MIT License
169 stars 59 forks source link

[BUG] CbC Throws Error When Running Query #83

Closed rc-csmith closed 1 year ago

rc-csmith commented 1 year ago

Describe the bug Running surveyor for cbc errors out without providing any results.

What side of Surveyor is impacted?

What product is impacted?

To Reproduce What did you do? Ran the following command line: python surveyor.py --query "process_name:firefox.exe" --days 7 cbc

And generated the errors

Caught AttributeError (see log for details): 'Process' object has no attribute 'process_cmdline'

and

Traceback (most recent call last):
  File "/Users/REDACTED/surveyor/venv/lib/python3.9/site-packages/requests/models.py", line 910, in json
    return complexjson.loads(self.text, **kwargs)
  File "/usr/local/Cellar/python@3.9/3.9.12/Frameworks/Python.framework/Versions/3.9/lib/python3.9/json/__init__.py", line 346, in loads
    return _default_decoder.decode(s)
  File "/usr/local/Cellar/python@3.9/3.9.12/Frameworks/Python.framework/Versions/3.9/lib/python3.9/json/decoder.py", line 337, in decode
    obj, end = self.raw_decode(s, idx=_w(s, 0).end())
  File "/usr/local/Cellar/python@3.9/3.9.12/Frameworks/Python.framework/Versions/3.9/lib/python3.9/json/decoder.py", line 355, in raw_decode
    raise JSONDecodeError("Expecting value", s, err.value) from None
json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Users/REDACTED/surveyor/venv/lib/python3.9/site-packages/cbc_sdk/connection.py", line 457, in get_object
    return result.json()
  File "/Users/REDACTED/surveyor/venv/lib/python3.9/site-packages/requests/models.py", line 917, in json
    raise RequestsJSONDecodeError(e.msg, e.doc, e.pos)
requests.exceptions.JSONDecodeError: [Errno Expecting value] <!DOCTYPE html><html><head><title>Carbon Black Cloud</title><link rel="shortcut icon" href="/assets/favicon.ico"><link rel="icon" href="/assets/favicon.svg" type="image/svg+xml"><link rel="icon" type="image/png" href="/assets/favicon-16x16.png" sizes="16x16"><link rel="icon" type="image/png" href="/assets/favicon-32x32.png" sizes="32x32"><link rel="stylesheet" rel="prefetch" href="/assets/fonts/styles.css?v=7"><link rel="stylesheet" rel="prefetch" href="/assets/fonts/opensans/styles.css?v=27"><link rel="stylesheet" rel="prefetch" href="/assets/react-console.css"><meta name="viewport" content="width=device-width,user-scalable=no,initial-scale=1,minimum-scale=1,maximum-scale=1"><meta name="robots" content="noindex,nofollow"><meta http-equiv="Content-Security-Policy" content="script-src 'self' https://matomo.esp.vmware.com"><meta charset="utf-8"></head><body><div id="app"></div><script type="text/javascript" rel="prefetch" src="/store_bundle.475eb221afa243072aa2.js"></script><script type="text/javascript" rel="prefetch" src="/elements_bundle.737fa667b711dd6d3d2e.js"></script><script type="text/javascript" rel="prefetch" src="/moment_bundle.995e58bb9d6730d0fd2f.js"></script><script type="text/javascript" rel="prefetch" src="/reactdom_bundle.c28f94f00fc28cde13ac.js"></script><script type="text/javascript" rel="prefetch" src="/vendor_bundle.1ac104122cb205e760ae.js"></script><script type="text/javascript" rel="prefetch" src="/main_bundle.c25079d8caf7652cbc49.js"></script></body></html><!-- 781ee57dcc77e191c4e4c64bbe5c79857412f8fc --><!-- 2022-10-25T11:57:04-04:00 -->: 0

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Users/[REDACTED]/surveyor/surveyor.py", line 289, in survey
    product.process_search(Tag('query'), base_query, opt.query)
  File "/Users/REDACTED/surveyor/products/vmware_cb_enterprise_edr.py", line 86, in process_search
    result = Result(proc.device_name, proc.process_username[0], proc.process_name, proc.process_cmdline[0],
  File "/Users/REDACTED/surveyor/venv/lib/python3.9/site-packages/cbc_sdk/base.py", line 442, in __getattr__
    self._refresh()
  File "/Users/REDACTED/surveyor/venv/lib/python3.9/site-packages/cbc_sdk/base.py", line 524, in _refresh
    self._info = self._parse(self._retrieve_cb_info())
  File "/Users/REDACTED/surveyor/venv/lib/python3.9/site-packages/cbc_sdk/base.py", line 539, in _retrieve_cb_info
    return self._cb.get_object(request_uri)
  File "/Users/REDACTED/surveyor/venv/lib/python3.9/site-packages/cbc_sdk/connection.py", line 459, in get_object
    raise ServerError(result.status_code, "Cannot parse response as JSON: {0:s}".format(result.content))
TypeError: unsupported format string passed to bytes.__format__

Expected behavior Not to error out

Screenshots N/A

Additional context N/A