Open-AudIT

What's on your network?
It is currently Wed Jan 17, 2018 9:10 am

All times are UTC + 10 hours




Forum locked This topic is locked, you cannot edit posts or make further replies.  [ 17 posts ]  Go to page 1, 2  Next
Author Message
PostPosted: Thu Oct 25, 2012 11:34 am 
Offline
Newbie

Joined: Thu Oct 25, 2012 10:57 am
Posts: 7
Hi,

When I run the Audit LDAP Directory, it shows error as below:-

Fatal error: Call-time pass-by-reference has been removed in C:\xampp\htdocs\open-audit\ldap_audit_script.php on line 306

What would be causing it? :D

Thank you.


Top
 Profile  
Reply with quote  
PostPosted: Thu Oct 25, 2012 2:08 pm 
Offline
Moderator

Joined: Fri Jul 20, 2007 8:27 am
Posts: 1223
OAv1 is old and has code which uses features that have been removed in PHP 5.4 Use PHP 5.3.X or earlier or fix the code. I'll take a look and see how much work the fix entails.


Top
 Profile  
Reply with quote  
PostPosted: Sat Oct 27, 2012 4:40 am 
Offline
Moderator

Joined: Fri Jul 20, 2007 8:27 am
Posts: 1223
Should be pretty simple. You need to remove the ampersand (&) from the function arguments in calls to PagedLdapSearch and ldap_Search in the ldap_audit_script.php file.

So go from:
Code:
PagedLdapSearch(&$ldap_link,&$base_dn,$filter,&$attributes,$usn_low,$usn_high,$results);

To:
Code:
PagedLdapSearch($ldap_link,$base_dn,$filter,$attributes,$usn_low,$usn_high,$results);

But only in the function calls and not the function definition. So the line around line 313.

And from:
Code:
$search_results=ldap_search($ldap_link,$base_dn,$full_ldap_filter,&$attributes,null,1000);

To:
Code:
$search_results=ldap_search($ldap_link,$base_dn,$full_ldap_filter,$attributes,null,1000);

You'll need to test and see it that works.
EDIT: Added ldap_search changes.


Top
 Profile  
Reply with quote  
PostPosted: Wed Oct 31, 2012 12:37 pm 
Offline
Newbie

Joined: Thu Oct 25, 2012 10:57 am
Posts: 7
Thank you guys, it solve the problem :D . When I run the Admin > Audit LDAP Directory, it doesn't show any error but it shows below message:-

Auditing LDAP Path: DC=******,DC=***,DC=**
Auditing user accounts in: DC=******,DC=***,DC=**
Updating Users table ...
Auditing computer accounts in:DC=******,DC=***,DC=**
Updating Computers table ...

Is it mean that the script is running? :?: :?:

Regards.


Top
 Profile  
Reply with quote  
PostPosted: Thu Nov 01, 2012 1:26 am 
Offline
Moderator

Joined: Fri Jul 20, 2007 8:27 am
Posts: 1223
Yes. Reporting available under the Queries menu. "All LDAP Systems" and "All LDAP Users"


Top
 Profile  
Reply with quote  
PostPosted: Thu Nov 01, 2012 1:17 pm 
Offline
Newbie

Joined: Thu Oct 25, 2012 10:57 am
Posts: 7
Hi Guys.....

Checking the Queries > All LDAP Systems & All LDAP users... no result...

Anywhere that still need to do further tuning...?

Anyway... the Auditing process works great... It captured all info in my domain... Many..many thanks to all the guys that develope this software... May God Bless You....:D :D

:?: another question on the MS Office Keys. Why it doesn't captured the Office 2010 key?

Regards...


Top
 Profile  
Reply with quote  
PostPosted: Fri Nov 02, 2012 1:57 am 
Offline
Moderator

Joined: Fri Jul 20, 2007 8:27 am
Posts: 1223
Fadlishah wrote:
Why it doesn't captured the Office 2010 key?
OA version 1 is ancient and the public version even more so. If you want to stick with OA v1 make sure to get the latest from SVN. I think that version audits Office 2010 keys.

Even the SVN version is missing some things to deal with newer MySQL versions. That's the problem you're now having with getting the ldap audit data into the database. You need to add the following code to the ldap_audit_script.php file just before the "AuditLdapPaths();" line around line 68. I had forgotten about this change in my own version.

Code:
# <HACK>
# The following turns off strict checking so incorrect
# datatypes can be inserted into fields!
$sql = "SET @@session.sql_mode=''";
$result = mysql_query($sql);
# </HACK>


Top
 Profile  
Reply with quote  
PostPosted: Mon Nov 05, 2012 4:52 pm 
Offline
Newbie

Joined: Thu Oct 25, 2012 10:57 am
Posts: 7
Hi, Good day!!!

I have done by adding the following code to the ldap_audit_script.php file just before the "AuditLdapPaths();" line around line 68. When I run the Admin > Audit LDAP Directory again and check back the Queries > All LDAP Users or All LDAP Systems, it still shows nothing.

Anyway I already updated the OA v1 with the latest svn and it can captured the Office 2010 key. Unfortunately, the key that captured is not the same as stated on the Installation Case of the Office 2010.

Cheers!!

Fadli


Top
 Profile  
Reply with quote  
PostPosted: Tue Nov 06, 2012 2:08 am 
Offline
Moderator

Joined: Fri Jul 20, 2007 8:27 am
Posts: 1223
Sorry once again. I have forgotton all the things I've done to my audit.vbs over the years. Here is my current audit script. You can diff against your current one to see what I've changed. It does correctly decode Office 2010 keys.

Attachment:
audit.txt [233.11 KiB]
Downloaded 279 times


Top
 Profile  
Reply with quote  
PostPosted: Wed Nov 07, 2012 2:23 pm 
Offline
Newbie

Joined: Thu Oct 25, 2012 10:57 am
Posts: 7
Thank you JP, it works. Double check with the original serial key. Its the same, thanks a million. The only thing is that, it doesn't indicate the Mirosoft Office 2010 name under the Software list. It just empty. Anything to add to the script?


Top
 Profile  
Reply with quote  
PostPosted: Thu Nov 08, 2012 2:48 am 
Offline
Moderator

Joined: Fri Jul 20, 2007 8:27 am
Posts: 1223
Not sure I understand the problem. What report are you running that's missing the Office 2010 name? Is it just Office or all software? Or is the name missing from the Office Keys report?


Top
 Profile  
Reply with quote  
PostPosted: Thu Nov 08, 2012 3:17 am 
Offline
Moderator

Joined: Fri Jul 20, 2007 8:27 am
Posts: 1223
You could run the following on a host with Office 2010 to see if your Office isn't in the list of Office versions OA knows about.

Put the following in a file named officereg.vbs, run "cscript officereg.vbs" and report back the output:
Code:
strComputer = "."

Const HKEY_LOCAL_MACHINE = &H80000002
Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\default:StdRegProv")
strKeyPath = "SOFTWARE\Microsoft\Office\14.0\Registration"
oReg.EnumKey HKEY_LOCAL_MACHINE, strKeyPath, arrSubKeys
For Each subkey In arrSubKeys
  path = strKeyPath & "\" & subkey
  strOffXPRU = "HKLM\" & path & "\DigitalProductId"
  subKey2 = "DigitalProductId"
  oReg.GetBinaryValue HKEY_LOCAL_MACHINE,path,subKey2,key
  if IsNull(key) then
  else
   wscript.echo "Office14: " & subkey
   
   strOffXPRU = "HKLM\" & path & "\ConvertToEdition"
   subKey2 = "ConvertToEdition"
   oReg.GetStringValue HKEY_LOCAL_MACHINE,path,subKey2,key
   wscript.echo "ConvertToEdition: " & key
   
  end if
Next


Top
 Profile  
Reply with quote  
PostPosted: Thu Nov 08, 2012 4:09 pm 
Offline
Newbie

Joined: Thu Oct 25, 2012 10:57 am
Posts: 7
Hi JP,

Thank you 4 your respond, fyi, I run the script provided on my machine and below is the result:

C:\xampp\htdocs\openaudit\scripts>cscript officereg.vbs
Microsoft (R) Windows Script Host Version 5.8
Copyright (C) Microsoft Corporation. All rights reserved.

Office14: {FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFF1CE}
ConvertToEdition: Microsoft Office Professional 2010

Its stated the Office 2010 name. How to add the script into the audit.vbs in order to get the Office 2010 name stated under the Software
column when you open Queries > All Ms Office Keys which currently empty.

Thank you.... :D :D :D


Top
 Profile  
Reply with quote  
PostPosted: Fri Nov 09, 2012 2:45 am 
Offline
Moderator

Joined: Fri Jul 20, 2007 8:27 am
Posts: 1223
That "FFFFF" stuff is unexpected. Could you open Regedit and export the "HKLM\SOFTWARE\Microsoft\Office\14.0\Registration" branch to a file and PM it to me. You can remove the DigitalProductID key if you don't want me to see your CD key. If you remove the DigitalProductID you can probably just post the reg file here. But don't do that unless you remove the DigitalProductID from the output.


Top
 Profile  
Reply with quote  
PostPosted: Wed Nov 21, 2012 2:49 am 
Offline
Moderator

Joined: Fri Jul 20, 2007 8:27 am
Posts: 1223
Edit your audit.vbs file.
Find the following line (line 4711 in my file)
Code:
if vers = "003B" then vers_name = "Microsoft Office Project Professional 2010" end if

Insert the following on the next line after the line above
Code:
if vers = "003D" then vers_name = "Microsoft Office Professional 2010" end if

You should now have something like
Code:
if vers = "003B" then vers_name = "Microsoft Office Project Professional 2010" end if
if vers = "003D" then vers_name = "Microsoft Office Professional 2010" end if
if vers = "0044" then vers_name = "Microsoft Office InfoPath 2010" end if


Top
 Profile  
Reply with quote  
Display posts from previous:  Sort by  
Forum locked This topic is locked, you cannot edit posts or make further replies.  [ 17 posts ]  Go to page 1, 2  Next

All times are UTC + 10 hours


Who is online

Users browsing this forum: No registered users and 2 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
cron
Powered by phpBB® Forum Software © phpBB Group