WithSecureLabs / snake

snake - a malware storage zoo

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Install script only enable localhost access

TacticalCheerio opened this issue · comments

After installing and running, the API endpoints work, but the Web-UI does not. It loads, but if you try to upload a file it hangs and on refresh shows no file was uploaded.

I tried running the tests through Snake Charmer and it fails when starting celery.
Starting mongodb... Done! Starting redis... Done! Starting Celery...Could not start celery

I've verified that celery is installed, so I'm not sure why it can't start

I've tried reinstalling which did not work

I'm running this on Ubuntu:
Distributor ID: Ubuntu Description: Ubuntu 18.04.1 LTS Release: 18.04 Codename: bionic

The log files I checked didn't seem to helpful, is there anything else I can try to get this working?

Right so before we start digging through logs, have you by chance upgraded to Python 3.7? Currently celery does not support this version of python. This lack of support is currently preventing me from publishing Snake 1.1!

If this is not the case, please could you attempt to upload a file to Snake and provide the snake.log. Depending on the install type it will be in '~/.snake/log/snake' (Basic) or '/var/log/snake' (Prod)

I currently have both Python 2.7.15rc1 installed and Python 3.6.6 installed.

Here is the result and log of uploading from the API and Web-UI respectively:

API Upload:
curl 'http://localhost:5000/upload/file' -F 'file=@/home/xxxx/test.txt' -F 'name=test-upload' -F 'description=the is a test' -XPOST

{
"data": {
"sample": {
"children": {},
"description": "the is a test",
"file_type": "file",
"magic": "ASCII text",
"mime": "text/plain",
"name": "test-upload",
"parents": {},
"sha256_digest": "d2a84f4b8b650937ec8f73cd8be2c74add5a911ba64df27458ed8229da804a26",
"size": 12,
"submission_type": "upload:file",
"timestamp": "2018-10-11T14:03:47.915878"
}
},
"status": "success"

Log:
[I 181011 10:03:47 web:2106] 200 POST /upload/file (127.0.0.1) 99.01ms

Web-UI Upload:
Hangs on upload
image

No update in the log, refreshing the page shows no items in the files tab. Making an API request to list files also shows nothing is there.

snake.log

Hmm that log file is very odd there should be much more than that. I have just spun up a clean install of Ubuntu 18.04 and done a production install and get the following output in my snake log.

image

What confuses me further is that when you talk to the API directly you are getting a success response, so I assume curl http://localhost:5000/store is not returning the file that you just uploaded?

image

If this is working then it could be a problem with the web browser and thus output of its console and network tabs will help to debug.

To me, based on the emptiness of your snake.log it looks like Snake-Skin is failing to talk to the API.

When I upload through API I am able to also view through the API:

curl http://localhost:5000/store

{
"data": {
"samples": [
{
"children": {},
"description": "",
"file_type": "file",
"magic": "ASCII text",
"mime": "text/plain",
"name": "test.txt",
"parents": {},
"sha256_digest": "d2a84f4b8b650937ec8f73cd8be2c74add5a911ba64df27458ed8229da804a26",
"size": 12,
"submission_type": "upload:file",
"tags": "",
"timestamp": "2018-10-12T01:40:01.958800"
}
]
},
"status": "success"

I forgot to mention that I was trying to access the web interface through the network, instead of on the localhost. When I try accessing it from localhost, it will work:

image

It's when I try accessing through say http://10.23.40.56:8000/#/upload that I am getting the issues.

Edit:
I changed snake.conf to serve snake on 0.0.0.0, which allows access to the API, but the web interface still doesn't work. Would I need to edit the http/https proxy setting?

Ah right of course, I have totally forgotten to document accessing over the network, stupid me. So there are a couple of ways, each have their own pros and cons.

Solution 1:

  • Change snake to serve on 0.0.0.0 (as you have done)
  • Update the API url in snake-skin ( snake-skin/src/config/config.js) and rebuild snake-skin

Solution 2:

  • Serve snake through an nginx reverse proxy
  • Update the API url in snake-skin ( snake-skin/src/config/config.js) and rebuild snake-skin

All this issues stem from the fact the the API URL has to be hardcoded into the snake-skin build. What I will do is update the README and improve the install script so that you can pass it the doman/ip that the api will run on.

Thanks it's working now. I set the ip in snake-skin/src/config/config.js to the devices ip, the nginx reverse proxy wasn't working for me.

I'm not sure if there was an easier way, but I had to reset the VM to before running the npm install / npm build commands, run the first few lines of the install.sh script to get the snake-skin files, then alter the config.js file. If I tried to alter the config.js file after the full install.sh run, and then try to rebuild with npm install / npm build / npm rebuild, the web interface would not change to the modified ip.

Yes, this issue has brought to light limitations in the current install script. I will try to update it in the next few days along with the readme. Basically the install script should be able to update/upgrade a current installation but it seems to fail at that. I will leave this issue open until I get round to improving these. Thanks for bringing it to light :)

Far less important now that we have docker support, will remove the user.sh script and update the install.sh script as user.sh has effectively been replaced with docker IMO.

Way later than it should have been but this issue is now addressed with the new Web UI.