Guidance on running and managing ghosts client

[melmelchew]

Hi there! Firstly, I greatly appreciate your time in helping me get started on this framework. I am looking forward to being able to play around with this project once the last step is accomplished, that is, setting the client up XD

From reading other discussion and issue threads, I have set up the server on a linux ubuntu (22.04.1 LTS) virtual machine, and tried to set up a client on a windows 10 virtual machine. Both VMs are on the same macOS Catalina computer in VirtualBox.

Currently, I have been able to successfully (I hope so!) set up the API, Grafana and Postgres on the ubuntu VM by making use of docker-compose on the docker-compose.yml file in Ghosts.Api. This is all using version 6.1 of the code.

Here is the output when running docker ps --all

and I am able to access the API and view the following: (this is running on the docker IP of 172.18.0.2)

Upon first creation and before any connection to any client, machines and groups were both 0.

I am also able to access Grafana and these dashboards were already present upon docker-compose without any configuration (Grafana is running on docker IP of 172.18.0.3)

Postgres seems to be set up fine as I can view the contents stored in the database (Running on docker IP of 172.18.0.4)
I hope this is enough information to give a good understanding of my current circumstances.

Now here is the part where I'm facing issues setting up my client.
### Client on same linux ubuntu VM
Initially, I tried setting up a client on the same ubuntu VM which worked by running the command dotnet ghosts.client.linux.dll in the ghosts client for linux and adding in my server IP address (192.168.100.4),

but it didn't seem right because I could only poll and nothing else, even when changing the timeline.json code with other sample templates.

I am also wondering if it is normal for the grafana to still display the above data even after terminating the client in the ubuntu terminal with ˆC. The polling values do not increase when I have terminated the client and only continue when i restart running the client with the dotnet ghosts.client.linux.dll command. If it is meant to be as such, is it possible to 'clear' the data on the dashboard and restart everything to 0? Is the client meant to be manually terminated after every activation or is it meant to end by itself once it has finished running the timelines.json file?

Moreover, despite the /api/home server page initially displaying the value 0 for both machines and groups, it is now stuck at the values in the earlier picture, even though I have already terminated the client. (i checked the task manager and there were no processes running that were related to ghosts as well). I am not sure if this should be the case.

### Client on windows 10 VM, on the same computer
After trying to set up client on ubuntu (kind of following https://github.com/cmu-sei/GHOSTS/issues/85 here), I came across this user manual (https://cloud.cylab.be/s/awDdGtpcz72LRg7?dir=undefined&path=%2FUserManual&openfile=2039275) where they set up the client on windows instead. But just like Faurkaurage, I am not able to hit http://172.18.0.2:5000/api/home via the browser on my client windows 10 vm as a normal GET request despite disabling all firewall settings on both client and server. However I can ping from both client and server to each other (after enabling them to be able to talk to each other by using my own configured NAT network following this video https://www.youtube.com/watch?v=vReAkOq-59I )
Edit: After testing out with some port forwarding and finding out that docker has its own firewall, I am able to hit the api page as a normal GET request by entering http://192.168.100.4/52388/api/home , where 192.168.100.4 is the IP address of my server, and not the docker IP address. By adding this to the applications.json folder in the client, I am able to see the Grafana update.

When I try to run ghosts.exe on the client, it seems to run ok, until the whole windows PowerShell closes automatically by itself after everything has finished running. Then my document page in my folder application occasionally pops up and sometimes firefox opens to a random website where I'm told a marionette is has opened it. This only ends if i end the GHOSTS NPC Orchestrator in the tasks manager. However, nothing is being reported in Grafana, so i'm not too sure if the current behaviour is as planned, or that I have been somehow hacked while my firewall was turned off. Here is a snap shot of the app.log:

And here is the clientupdates log:

While all of this is happening, on the server API side, the number of machines and groups are still the same at 1 and 2 respectively, but nothing is changing on Grafana. Not sure if the issue with linux is still persistent, but this situation probably indicates that the client(windows) is still not properly connecting to the server.

I've spent the past 4 days trying to figure out this issue and have read multiple issue and discussion threads, but I have yet to find a means to resolve it and get the client and server working properly :( Would greatly greatly appreciate any help or guidance in setting up this project!

Edit: As of this edit, I am finally able to get the server and client side working! It was mainly the lack of understanding towards port forwarding :p Apologies for the unnecessarily long post. I guess the current lingering questions I have now are:

1. Is it possible to completely remove or reset the data of a specific client? If yes, how would it be done? Is it modifying Grafana in some way? Or amending the client code? Or creating a whole new server on a new VM?
2. Is the expected behaviour of the ghosts.exe application meant to actually open up and run other programs and applications on my client vm? If so, do I need to ensure that I already have those programs and applications on my vm before running ghosts.exe?
3. Which commands or code in timeline.json will constitute as an instance to activity and health? I have tried using a few of the sample timeline code, but so far the ones I've used seem to only give me polling responses. (Maybe I am just unlucky in picking only the polling ones)

Apologies if they sound rather stupid, I am extremely grateful if you have spent time reading through this ramble. But now I am very excited to finally start experimenting with this project!

Thank you :)

[sei-dupdyke]

Hi, thanks for checking out the project.

Is it possible to completely remove or reset the data of a specific client? If yes, how would it be done? Is it modifying Grafana in some way? Or amending the client code? Or creating a whole new server on a new VM?

If you want to completely reset the client, delete the logs and instance folders.

If you want to reset the data at the API level, what I typically do is docker-compose down and then delete the postgres volume, which by default is db_data. Now, when you do a docker-compose up -d the database is all reset and good to go.

Is the expected behaviour of the ghosts.exe application meant to actually open up and run other programs and applications on my client vm? If so, do I need to ensure that I already have those programs and applications on my vm before running ghosts.exe?

Yes and yes. For example, if you have a timeline handler for Firefox, that has to be installed already in the normal locations. Same for Office.

Which commands or code in timeline.json will constitute as an instance to activity and health? I have tried using a few of the sample timeline code, but so far the ones I've used seem to only give me polling responses. (Maybe I am just unlucky in picking only the polling ones)

Actions like browsing a web URL, or creating a Word doc (or then exporting that to PDF) will all be logged. Take a look on the client in ./logs/clientactivity.log to see them before they get beamed up to the API server.

[melmelchew]

Thank you so much for your response! 😄 I was also wondering if its really only possible to run the client on a windows machine, since I have seen other threads mentioning running on linux by running dotnet ghosts.client.linux.dll in the ghosts-client folder provided in the zip link. I have noticed only a large number of polling results being made with no opening of the firefox browser, and upon checking the app.log data I realised that the geckodriver.exe file in that zip file is a PE32+ executable (console) x86-64, for MS Windows. So i tried changing the geckodriver file with the linux64 version here and even made the directory to prevent the "profile not found" error. However the following error occured in the console and this error just kept popping up


Not sure if I have 'fixed' the issue wrongly, but I hope I am making use of the right geckodriver here!

In regards to the timeline handler, I was also wondering if we are able to specify and let ghost execute other brands of apps? For example, if I am not able to install microsoft office in my computer (currently not allowed to use subscribed software haha), is ghosts still able to simulate user activity by accessing another apps (for eg, using OpenOffice) instead? Must it be exactly microsoft excel for example, or can another excel software be installed?

Lastly (sorry for the many questions 🙏 ), I wanted to know if there are specific DelayAfter timings that should be set on the timeline.json? Currently I am encountering this line in my app.log file, and its main visible issue is that the activities are not being posted to the server and not reflected on grafana (but there is still polling), so i'm not sure if the DelayAfter timings is causing this.

Really appreciate your time in reading my queries and answering them! I'm really learning a lot from your project 😊

[sei-dupdyke]

Oh, sorry, I incorrectly assumed that you were using the windows client. The linux client is a few small versions behind, but it should work the same as I explained above. Now you did note that versions of geckodriver need to match that of FF, and I believe you'd see that particular error spelled out (both as you have it, and in the ghosts logs).

I've not seen the profile error that you included, but perhaps setting the location of the FF binary in the application.json configuration file here: https://github.com/cmu-sei/GHOSTS/blob/master/src/ghosts.client.linux/config/application.json#L26

Outside of that, if it still doesn't work:

1. what version of FF are you using?
2. what version of geckodriver are you using?

I don't have ghosts working with OpenOffice, sorry. It's on the list, but I haven't had time.

The file lock logs are fixed in the current windows version, I just need to build that into the linux executable when I get some time. Sorry, maybe this week!

[melmelchew]

Hello! Thanks for the update on the linux client, I am able to get it running once I added the location of the FF binary and shifting the geckodriver to the tmp file at the home directory.

No worries if ghosts can't work on OpenOffice for now, I can make use of the trial versions :) thank you for letting me know!

In regards to the file lock log issue, the error in the picture is taken on a windows 10 64 bit client. I saw that you updated the zip file contents yesterday for 6.1.0 Win10 x64 client and have downloaded it to set up a new client, but I am still experiencing the lock issues :(

I have set the DelayAfter for firefox browser to be 3000 and the cycle sleep for the client results to be 3000, resulting in the image above. Even with the default sample timeline time duration of 300000 there is the lock issue. I was wondering if lock issue is as expected since the client update.log file is still being written to following the code here.

Moving forth I will most likely use a windows client rather than a linux since it is more stable, the only lingering issue I'm facing is the file lock logs, are there any steps I could take to troubleshoot it on my end?

Thank you so much for getting back to me despite your busy schedule 🙏

[sei-dupdyke]

What you're seeing in the logs is expected when the file is locked for writing. Processes just sleep for X and try again later. There shouldn't be any issues with functionality related to locks and waiting.

Windows isn't necessarily more stable. We just did a lot of work on the that particular client this summer for use in some upcoming exercises. Sometimes I start with Windows, sometimes I start with Linux, it just depends, and then those changes get made for both (code that would be effectively utilized exactly the same goes into the domain project that is shared.

HTH

[melmelchew]

Yep there are no issues in terms of functionality on the client's side, user actions are still being simulated and recorded appropriately. The only small issue would be that it never sends the data to the server since the file is always locked, no matter how long I leave the client running for and even when it has completed all of its commands (for example when I set the loop to be false for a command handler type, it just spawns a few cmd.exe as stated in the app.log file, then nothing else is being updated in the app.log file after awhile other than the locked post requests which i assume means that the timeline has finished execution). Then again, I tend to just run the client again with an empty timeline so as to just post the clientupdates.log contents to the server, so the locking issue is not a big problem, I'm already quite happy I can play around with this software 😄

Ahh I see! It's great that both client versions are equally updated, so that we can pick the version that we are more familiar with to get started much more easily or that better suits our needs. Appreciate you for your efforts to make the framework easier to start up over the years, especially with docker compose for the server! (saw the initial, more complicated way in previous threads and got confusingly scared haha)

I think that would be all for my queries on using ghosts for now. Once again, thank you so much for taking the time to explain and guide me through this! 🙇

[sei-dupdyke]

I'll take another look at the locking thing on linux...

[sei-dupdyke]

I updated the linux project today to incorporate all of the changes I had made on the windows side up through and including 6.1.25.

The download binaries are updated accordingly. I no longer include gecko or chromedrivers, since its hard to know what versions people are using out in the wild.

HTH