Root login failing

[rianbk]

Hi,

Trying out the library and I'm struggling to get root login working using the following:

from awsapilib import AccountManager
from awsapilib.captcha import Captcha2
import logging

logging.basicConfig(level=logging.DEBUG)

solver = Captcha2('###')
account_manager = AccountManager(email='###', password='###', region='###', solver=solver)

print(account_manager.iam.billing_console_access)

Looks like it just does two capchas and dies. Let me know if i can provide anything else

DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): 2captcha.com:443
DEBUG:urllib3.connectionpool:https://2captcha.com:443 "GET /res.php?key=###&action=getbalance HTTP/1.1" 200 5
DEBUG:authentication.AccountManager:Trying to get url: https://us-east-1.console.aws.amazon.com/console/home with parameters :{'hashArgs': '#a', 'skipRegion': 'true', 'region': 'us-east-1'}
DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): us-east-1.console.aws.amazon.com:443
DEBUG:urllib3.connectionpool:https://us-east-1.console.aws.amazon.com:443 "GET /console/home?hashArgs=%23a&skipRegion=true&region=us-east-1 HTTP/1.1" 302 0
DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): signin.aws.amazon.com:443
DEBUG:urllib3.connectionpool:https://signin.aws.amazon.com:443 "GET /oauth?client_id=arn%3Aaws%3Asignin%3A%3A%3Aconsole%2Fcanvas&code_challenge=###&code_challenge_method=SHA-256&response_type=code&redirect_uri=https%3A%2F%2Fus-east-1.console.aws.amazon.com%2Fconsole%2Fhome%3FhashArgs%3D%2523a%26isauthcode%3Dtrue%26region%3Dus-east-1%26skipRegion%3Dtrue%26state%3DhashArgsFromTB_us-east-1_7ec07b618f990ec3&X-Amz-Security-Token=### HTTP/1.1" 302 0
DEBUG:urllib3.connectionpool:https://signin.aws.amazon.com:443 "GET /signin?redirect_uri=https%3A%2F%2Fus-east-1.console.aws.amazon.com%2Fconsole%2Fhome%3FhashArgs%3D%2523a%26isauthcode%3Dtrue%26region%3Dus-east-1%26skipRegion%3Dtrue%26state%3DhashArgsFromTB_us-east-1_7ec07b618f990ec3&client_id=arn%3Aaws%3Asignin%3A%3A%3Aconsole%2Fcanvas&forceMobileApp=0&code_challenge=###&code_challenge_method=SHA-256 HTTP/1.1" 200 None
DEBUG:urllib3.connectionpool:https://signin.aws.amazon.com:443 "POST /signin HTTP/1.1" 200 None
DEBUG:authentication.AccountManager:Getting the resolve account type captcha.
DEBUG:authentication.Captcha2:Trying to get captcha image from url : https://opfcaptcha-prod.s3.amazonaws.com/b0720cbf241740f1b702de9cdee26b28.jpg?AWSAccessKeyId=###6&Expires=1662197059&Signature=s01iP2U5PA8EyQ%2Bc8p40LGWGdHw%3D
DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): opfcaptcha-prod.s3.amazonaws.com:443
DEBUG:urllib3.connectionpool:https://opfcaptcha-prod.s3.amazonaws.com:443 "GET /b0720cbf241740f1b702de9cdee26b28.jpg?AWSAccessKeyId=###6&Expires=1662197059&Signature=s01iP2U5PA8EyQ%2Bc8p40LGWGdHw%3D HTTP/1.1" 200 5041
DEBUG:authentication.Captcha2:Waiting for the solved captcha from 2captcha service.
DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): 2captcha.com:443
DEBUG:urllib3.connectionpool:https://2captcha.com:443 "POST /in.php HTTP/1.1" 200 14
DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): 2captcha.com:443
DEBUG:urllib3.connectionpool:https://2captcha.com:443 "GET /res.php?key=###&action=get&id=71410009478 HTTP/1.1" 200 16
DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): 2captcha.com:443
DEBUG:urllib3.connectionpool:https://2captcha.com:443 "GET /res.php?key=###&action=get&id=71410009478 HTTP/1.1" 200 9
DEBUG:authentication.Captcha2:Result for captcha was : {'captchaId': '71410009478', 'code': 'd8ffc8'}
DEBUG:urllib3.connectionpool:https://signin.aws.amazon.com:443 "POST /signin HTTP/1.1" 200 None
DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): signin.aws.amazon.com:443
DEBUG:urllib3.connectionpool:https://signin.aws.amazon.com:443 "POST /mfa HTTP/1.1" 200 18
DEBUG:urllib3.connectionpool:https://signin.aws.amazon.com:443 "POST /signin HTTP/1.1" 200 None
DEBUG:authentication.AccountManager:Getting the after login type captcha.
DEBUG:authentication.Captcha2:Trying to get captcha image from url : https://opfcaptcha-prod.s3.amazonaws.com/2f1b953da69a4b95981bb8817254c026.jpg?AWSAccessKeyId=###6&Expires=1662197075&Signature=ilaCQcBkMjPKfyXkImAaSNi0qgQ%3D
DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): opfcaptcha-prod.s3.amazonaws.com:443
DEBUG:urllib3.connectionpool:https://opfcaptcha-prod.s3.amazonaws.com:443 "GET /2f1b953da69a4b95981bb8817254c026.jpg?AWSAccessKeyId=###6&Expires=1662197075&Signature=ilaCQcBkMjPKfyXkImAaSNi0qgQ%3D HTTP/1.1" 200 3746
DEBUG:authentication.Captcha2:Waiting for the solved captcha from 2captcha service.
DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): 2captcha.com:443
DEBUG:urllib3.connectionpool:https://2captcha.com:443 "POST /in.php HTTP/1.1" 200 14
DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): 2captcha.com:443
DEBUG:urllib3.connectionpool:https://2captcha.com:443 "GET /res.php?key=###&action=get&id=71410010770 HTTP/1.1" 200 16
DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): 2captcha.com:443
DEBUG:urllib3.connectionpool:https://2captcha.com:443 "GET /res.php?key=###&action=get&id=71410010770 HTTP/1.1" 200 16
DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): 2captcha.com:443
DEBUG:urllib3.connectionpool:https://2captcha.com:443 "GET /res.php?key=###&action=get&id=71410010770 HTTP/1.1" 200 9
DEBUG:authentication.Captcha2:Result for captcha was : {'captchaId': '71410010770', 'code': 'nxbtxf'}
DEBUG:urllib3.connectionpool:https://signin.aws.amazon.com:443 "POST /signin HTTP/1.1" 200 None
Traceback (most recent call last):
  File "###test.py", line 10, in <module>
    print(account_manager.iam.billing_console_access)
  File "###venv/lib/python3.10/site-packages/awsapilib/console/console.py", line 752, in iam
    session = self._get_billing_session(self.email,
  File "###venv/lib/python3.10/site-packages/awsapilib/console/console.py", line 559, in _get_billing_session
    redirect_url = self._get_root_console_redirect(email, password, session, mfa_serial=mfa_serial)
  File "###venv/lib/python3.10/site-packages/awsapilib/console/console.py", line 552, in _get_root_console_redirect
    raise InvalidAuthentication(f'Unable to authenticate, response received was: {response.text} '
awsapilib.console.consoleexceptions.InvalidAuthentication: Unable to authenticate, response received was: {"state":"FAIL","properties":{"Message":"Your authentication information is incorrect. Please try again.","Title":"Authentication failed"}} with status code: 200

[costastf]

Is this consistent? Does this happen in every attempt? Please be aware that no matter how great the 2captcha service is, it is still actual people solving your captcha and the error rate is not negligible. I have had times with 3 concecutive failures. If this is actually consistent I will try to block some time next week to have a look at it. Please provide feedback so I know.

[rianbk]

Hi, yes. I have never successfully got it to work.

[costastf]

Hi @rianbk , I have spent the last hour trying out the code and I cannot recreate the issue. Could you please try out the code without the captcha2 solver (it will use an interactive one, if you are on iterm you will get the picture and you can solve yourself, if not you will get a link that you can follow and solve) and let me now if that still fails for you?

[costastf]

Hi @rianbk , have you tried without the 2captha solver?

[rianbk]

Hey @costastf, sorry for the late reply. I've been traveling. I've done some more testing.

I created a new account to test against, and everything works fine. Going back to my older account, i'm now getting the error "Unable to resolve the account"

[costastf]

Hi @rianbk , a stack trace would help troubleshooting, if you want to look into this any further. It seems that something is off with your account and it might be interesting to see if we can figure out what.

[rianbk]

Hey @costastf, happy to help just let me know exactly what you need.

Traceback (most recent call last):
  File "/Users/***/code/play/test.py", line 11, in <module>
    print(account_manager.iam.billing_console_access)
  File "/Users/***/code/play/venv/lib/python3.10/site-packages/awsapilib/console/console.py", line 752, in iam
    session = self._get_billing_session(self.email,
  File "/Users/***/code/play/venv/lib/python3.10/site-packages/awsapilib/console/console.py", line 559, in _get_billing_session
    redirect_url = self._get_root_console_redirect(email, password, session, mfa_serial=mfa_serial)
  File "/Users/***/code/play/venv/lib/python3.10/site-packages/awsapilib/console/console.py", line 517, in _get_root_console_redirect
    raise UnableToResolveAccount(f'Unable to resolve the account, response received: {response.text} '
awsapilib.console.consoleexceptions.UnableToResolveAccount: Unable to resolve the account, response received: {"state":"FAIL","properties":{"CES":"***","Captcha":"true","CaptchaURL":"***","email":"***@***.com","captchaObfuscationToken":"{\"b64KeyCipherData\":\"***"}"}} with status code: 200

Let me know if i obfuscated something you need, just not sure whats sensitive or not. Let me know if you need more

[costastf]

It seems that you are not getting a captchaStatusToken as expected. I would like to try out the worklflow until the password usage. Do you use keybase or something like that that you could share with me securely the email of the account so I can try it out?

[rianbk]

@costastf I've messaged you on keybase

[bracki]

We are facing the same problem. Within the last 6 weeks we had 400+ auth errors. All of them looking like this:

awsapilib.console.consoleexceptions.InvalidAuthentication: Unable to authenticate, response received was: {"state":"FAIL","properties":{"CES":"...","Captcha":"true","CaptchaURL":"https://opfcaptcha-prod.s3.amazonaws.com/3485cf5909a6427592cbe7150c87f5b8.jpg...","email":"...","captchaObfuscationToken":"{\"b64KeyCipherData\":\"...\",\"b64CipherData\":\"...\"}"}} with status code: 200

[costastf]

Hi @bracki , what about the weeks before? Do you have any successes during the last 6 weeks? Is this consistently failing or does it have a high error rate and if so what is that? If this is constantly falling, did you try without the 2 captcha solver to use the interactive one and does that work?

[costastf]

Sadly, if I can't reproduce the issue the only way I can solve this is by having the credentials of the account that fails which is sadly not possible in your case.

[bracki]

It has a very high error rate. Occasionally it works, but most of the time it does not. Haven't tried the interactive one, as this is a part of a cron job.

[costastf]

So this more likely than not is a timing issue. I will have a look this Friday

[bracki]

I double checked all our failures. It's like @rianbk describes. Two attempts and then it fails. The captchaUrl from the failure message is different than the ones that where processed previously.

[costastf]

Hey @bracki and @rianbk , could you please give https://github.com/schubergphilis/awsapilib/tree/signin-delay a try and let me know if that changes anything for you guys? If yes, then we will need to tweak the delays a bit and see.

[bracki]

@costastf Thanks a lot! I tried it but unfortunately it doesn't change anything. I'll see if it changes with more data.

[costastf]

I will look into it again on Friday and add a few more time outs. Keep me updated with your data.

[costastf]

Hey guys, I am resurrecting this. Apparently aws requires a new field (well, not so new) of metadata1 which is a fingerprinting field for the authentication to work. What I figure is that this was not rolled out everywhere back when you raised the issue and that is why I could not reproduce. Now it is reproducible by me too as raised by #49 also. I will be reporting on the progress on that one if you don't mind, so I will be closing this one for now. Please follow along because I have mostly fixed it (code is really not good still so definitely not suggested but we are getting there.