secureworks / dcept

A tool for deploying and detecting use of Active Directory honeytokens
https://www.secureworks.com/blog/dcept
GNU General Public License v3.0
498 stars 102 forks source link

./docker_build.sh fails #1

Closed bakingshoot closed 8 years ago

bakingshoot commented 8 years ago

Hi.

Attempting a new install under Debian, ./docker_build.sh fails here:


john-1.8.0-jumbo-1/src/pst_fmt_plug.c john-1.8.0-jumbo-1/src/missing_getopt.c

gzip: stdin: unexpected end of file john-1.8.0-jumbo-1/src/rules.c john-1.8.0-jumbo-1/src/options.c tar: Unexpected EOF in archive tar: Unexpected EOF in archive tar: Error is not recoverable: exiting now The command '/bin/sh -c mkdir /tmp/john && tar -xvf /tmp/john.tar.gz -C /tmp/john --strip-components=1' returned a non-zero code: 2 `

jamesscwx commented 8 years ago

It appears as if wget got something else when it tried to download the John the Ripper tarball.

Below you'll notice the server response I receive from openwall.com contains the proper length and content- type, but yours is Length: unspecified [text/html].

HTTP request sent, awaiting response... 200 OK Length: 30786455 (29M) [application/x-tar] Saving to: '/tmp/john.tar.gz'

Are you on a corporate network that might be proxying or blocking the download? What happens when you run wget on the host?

wget http://www.openwall.com/john/j/john-1.8.0-jumbo-1.tar.gz

jamesscwx commented 8 years ago

It's definitely a network issue on your end. As a workaround you could try downloading John the Ripper using an alternative method and then manually add it to the Docker container.

1.) Either by proxy or on a different unfiltered network, successfully download john-1.8.0-jumbo-1.tar.gz 2.) Save john-1.8.0-jumbo-1.tar.gz to the server directory alongside the Dockerfile. 3.) Replace the “RUN wget" command at line 21 in the Dockerfile with the following:

    ADD ./john-1.8.0-jumbo-1.tar.gz /tmp/john.tar.gz

Now docker build will use the local tarball instead of downloading it.

bakingshoot commented 8 years ago

It's was a network issue on our end. Stupid thing was sniffing everything looking for malware.