Question regarding RetrievIR configs file #3
Comments
|
Can you provide the full command-line you are attempting to launch it with/what you are trying to achieve with more details so I can try to replicate? Are you trying to add new commands? If you simply want to exclude things, I would just delete them - or you could add a tag to each objective that you DO want and just invoke with that tag. |
|
Okay I think the tag makes sense. What file would I need to add the tag to ? Also, another quick question. I am getting this error when I try to run the script on a remote host Error: Command Ran via EDR: |
|
RetrievIR is powered by the JSON configuration files - each of those files contains 1 or more 'directives' that specify files to collect, commands to execute or registry values to collect. Each 'directive' can contain one or more 'tags' that allow for this type of filtering of directive at run-time - see https://github.com/joeavanzato/RetrievIR/blob/main/configs/antivirus.json for example and look at the 'tags' key in each directive - these can be edited to add or remove different 'tags' to directives. RE that error - this is because the directory 'configs' is currently hard-coded into RetrievIR/configs/windows.json Line 623 in f6d3f45 |
|
@snolroy I just pushed an update to RetrievIR.ps1 and the configuration file 'windows.json' - please replace both of these and attempt to execute again and the problem should be resolved. I would also recommend modifying your command to the following: |
|
Thank you very much. I will try and report findings. |
|
Hi @joeavanzato With the change you made the RetrievIR script now works. Now I am having a similar issue running the parser remotely. I am getting an error and it stops running but the logs do not even show any signs of errors.. Error thrown in my terminal: Details from the logs Below is the snippet of code I think is responsible for that error: Also, see below my utilities dir structure which might explain the reason behind the errors: |
|
It appears the stable hosting links for Zimmerman's tools have all been updated - I will update the parsing configuration to point towards the new URLs. |
|
I think my issue isn't with the URLs since I already have the utilities in the utilities folder.. |
|
Or Why is it even trying to pull the file if it is already in the utilities folder ? |
|
Ah - I see the problem you are describing now. So it is attempting to download PECmd and EvtxECmd even though they already exist, correct? I will investigate as it is not immediately obvious to me why that is occurring. |
|
Yes you got it and somehow it is expecting a .ZIP file while in my directory the files are already unzipped with the binary included. |
|
FYI, what you see in my utilities directory structure is the folder and the binaries are in the folder shows in that screenshot |
|
See my directory structure again below: |
|
Thanks for this - I am investigating - I think this is partially due to how cmd.exe interprets certain things vs powershell.exe as I am seeing different behavior when launching the script through your method vs being directly within powershell terrminal - I will work on resolving these and appreciate the feedback. |
|
@snolroy So I'm not actually sure why your above command for ParseIR is not working - I am launching similar as below:
This is functioning as expected for me and 'finding' all of the binaries inside utilities directory, whether they are at top-level or within folders recursively. Did you potentially modify the parsing configuration file? It is very odd that it would only cause an issue on those two files since it is identical logic. I would recommend trying completely locally outside of your EDR to see if it works as expected first. |
|
Yes I did try outside of the EDR and it worked.. |
|
Then I think this is not a ParseIR/RetrievIR issue but something specific to the EDR. Which EDR? |
|
That was Crowdstrike |
|
Ok - I can try to test against a CrowdStrike deployment and see if I can resolve that way. |
|
Hi @joeavanzato Disregard my previous message. I ran it again a couple of times and found the culprit. I actually went through all the utility subfolders and found that only 1 of them was empty and when I ran the query again, it failed when it was trying to pull that specific utility: |
|
@snolroy This is happening due to outdated URLs in parsing_config.json because Eriz Zimmerman changed the hosting location of the tools - please check the new version, this should work as expected. https://github.com/joeavanzato/RetrievIR/blob/main/parsing_config.json |
|
Hi @joeavanzato Last command before the error in the log line was: Error I got in the terminal was: Any idea what could be causing this now ? |
|
Were there previous uses of SqlECmd.exe in the logs that appear successful? Is there any amount of parsed evidence from Chrome or Edge present in the parsed_evidence directory? I've not encountered this issue personally - I will have to investigate further. |
|
Yes there were successful parsing attempts: Below is all the parsed evidence I got back: |
|
Greetings @joeavanzato "ChromeMetadata":{ However, after I got passed the error above, I am now getting another error associated with the ParseBrowserData.ps1 script... Below are the last lines printed in the logs prior to the error being thrown: Below is the actual error being thrown in the terminal Any idea why the above is being thrown now? I tried troubleshooting and attempted modifying the ParseBrowserData.ps 1 script to see if it'll work but that change ended up generating another error so I gave up and decided to post the original error here to see if you can help troubleshoot/find out why I am getting this. |
|
I have a feeling this may be caused by an issue loading the relevant Sqlite DLL on line 196 - please edit the ParseBrowserData.ps1 file line 196 to remove the "| Out-Null" at the end of the line as below: Original: New: Then try re-running and see if there are any other errors that appear. Make sure that there is an actual DLL location printed out as well. |
|
@snolroy On further thought, I'm wondering if this is an issue with the type of SQLite DLL being downloaded - please review the file downloaded at Line 212 in a6a9c14 This DLL does rely on both system version (32 vs 64) as well as the appropriate .NET installation being downloaded. |
|
@joeavanzato When I look at the file, how do I determine if it's 32 vs 64 bit ? |
|
The default file in the configuration is designed to run on:
If your processing computer does not meet those requirements, you may need to replace that with another one available at https://system.data.sqlite.org/index.html/doc/trunk/www/downloads.wiki |
|
@joeavanzato I made adjustments to the ParseBrowserData.ps1 script on line 196 you provided and ran it again and it now printed the location of the DLL before throwing the SAME error as above... Last log line before the error was: Last terminal output before the error was the following: |
|
I also checked if the target system was 64 bit and confirmed that it is: |
|
Just to clarify, the system running ParseIR is the one that should be 64 bit with .NET 4.5 installed if using the default SQLite DLL embedded in the parsing_config.json. Can you verify .NET 4.5 is installed? |
|
Yes---The command above was ran on the target system showing its a 64 bit system. Also it is the same system that has the SQLite DLL installed as shown in the above terminal output... is .NET 4.5 installed while installing SQLite or is it already installed on the system. If the latter is there an easy way to verify that ? |
|
After checking the .NET release version using((Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full').Release) it was 528372 which corresponds to .NET Framework 4.8. |
|
@snolroy - this may be caused by the relevant "System.Data.SQLite.dll.config" file missing from the directory - can you please list the contents of C:\TmpRT\RetrievIR-1.1\utilities\standalone\System.Data.SQLite.dll? |
|
@joeavanzato See below: |
|
I would try running this locally - use RetrievIR to gather the evidence from the target and bring it back to another host then parse it locally using ParseIR and see if that makes as difference in operations. |
|
Hi @joeavanzato...I ran it previously locally and it worked.. But then I wanted to try it via EDR as well. Does that mean every time I'd have to just pull the evidence folder from the remote system and then run the parser locally with the evidence folder downloaded ? |
|
@snolroy I think I would recommend doing this in either one of two ways.
I think I will add an option to ZIP the results as well to make this easier. |
|
Hi @joeavanzato Thanks for your feedback... |
Hi @joeavanzato
I have a question. Do you have any instructions on how to edit the configs.json files to exclude some of the items that are collected lets say by commands/objective or categories ?
Somehow when I try using the -category argument on a remote system I get an error saying that
"A command that prompts the user failed because the host program or the command type does not support user interaction. The host was attempting to request confirmation with the following message:" Then I dont even see the message.
The text was updated successfully, but these errors were encountered: