google / grr

GRR Rapid Response: remote live forensics for incident response

Home Page:https://grr-doc.readthedocs.io/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

"ExecutePythonHack" flow runs more than one time

skanjINCIDE opened this issue · comments

Environment

  • How did you install GRR? From release DEB
  • What GRR version are you running?: 3.4.2
  • What operating system does the GRR server run on? Ubuntu 18.04
  • What operating system does the affected GRR client run on, if applicable? Windows 10

Describe the issue
I'm running a script using ExecutePythonHack flow. This script do some actions and returns a string in the magic_return_str variable. Everything works fine and the flow state goes to "TERMINATED" and I get my results back.

image
image

Checking the machine the result is the expected one. But then, few seconds after the scripts ends, it seems that the actions of the script repeats again. Is like the flow is asked three times by GRR server.

A more visual example, my script creates a file with the timestamp of creation in the name. I get three files with three different timestamps, one following the other. Checking the script I can see that the error is not in the Python side.

image

Does anyone know why GRR send three times the same order and how to change that?

Thank you very much,

Regards