Open-AudIT

What's on your network?
It is currently Fri Jan 19, 2018 6:02 pm

All times are UTC + 10 hours




Post new topic Reply to topic  [ 6 posts ] 
Author Message
 Post subject: Windows audit v2.0.3
PostPosted: Thu Jul 27, 2017 5:13 pm 
Offline
Newbie

Joined: Wed Jul 26, 2017 4:27 pm
Posts: 21
Hi,

when i start a discovery from the web page, i never receive the audit windows informations (pc or server).

log discovery :

5096 27/07/2017 09:03 wmi_helper wmi_audit WMI audit complete
5097 27/07/2017 09:03 m_device find_system Could not find a match for the device with IP 10.106.50.1
5098 27/07/2017 09:03 include_input_discoveries discoveries Start of WINDOWS insert for 10.106.50.1
5099 27/07/2017 09:03 include_input_discoveries discoveries End of WINDOWS insert for 10.106.50.1 (System ID 24)
5100 27/07/2017 09:03 include_input_discoveries discoveries Update the previous log entries with our new system_id 0.019665 /* input::discoveries */ UPDATE discovery_log SET system_id = 24 WHERE pid = 1584 and ip = '10.106.50.1'

5101 27/07/2017 09:03 include_input_discoveries discoveries Processing found network interfaces for 10.106.50.1 (System ID 24)
5102 27/07/2017 09:03 m_devices_componenets process_component Processing component (ip) start for 10.106.50.1 (ps06hw01) process audit

5103 27/07/2017 09:03 m_devices_componenets process_component Processing component (ip) end for 10.106.50.1 (ps06hw01) process audit

5104 27/07/2017 09:03 include_input_discoveries discoveries Windows credential update for 10.106.50.1(System ID 24)
5105 27/07/2017 09:03 include_input_discoveries discoveries Processing Nmap ports for 10.106.50.1 (System ID 24)
5106 27/07/2017 09:03 m_devices_componenets process_component Processing component (nmap) start for 10.106.50.1 (ps06hw01) process audit

5107 27/07/2017 09:03 m_devices_componenets process_component Processing component (nmap) end for 10.106.50.1 (ps06hw01) process audit

5108 27/07/2017 09:03 include_input_discoveries discoveries Starting windows audit for 10.106.50.1 (System ID 24)

but when i run the audit_windows.vbs, i've no problem, only with the discovery.

Any idea ?


Top
 Profile  
Reply with quote  
 Post subject: Re: Windows audit v2.0.3
PostPosted: Fri Jul 28, 2017 2:54 am 
Offline
Moderator

Joined: Fri Jul 20, 2007 8:27 am
Posts: 1225
Is the last log line in your post the last log line for the audit of 10.106.50.1? Maybe check the php error log if so. There should be further log messages unless something is crashing.


Top
 Profile  
Reply with quote  
 Post subject: Re: Windows audit v2.0.3
PostPosted: Fri Jul 28, 2017 4:32 pm 
Offline
Newbie

Joined: Wed Jul 26, 2017 4:27 pm
Posts: 21
Where i can found the php error log ?


Top
 Profile  
Reply with quote  
 Post subject: Re: Windows audit v2.0.3
PostPosted: Fri Jul 28, 2017 11:43 pm 
Offline
Newbie

Joined: Wed Jul 26, 2017 4:27 pm
Posts: 21
in apache logs errors,

i'v few error when i discover a windows computer with audit_windows.vbs

logs :

c:\xamplite\open-audit\other\scripts\audit_windows_17_07_28_15_27_58.vbs(7525, 3) Microsoft VBscript runtime error: Type mismatch: 'Ubound'

I've no idea why i've this error :s


Top
 Profile  
Reply with quote  
 Post subject: Re: Windows audit v2.0.3
PostPosted: Sat Jul 29, 2017 12:44 am 
Offline
Moderator

Joined: Fri Jul 20, 2007 8:27 am
Posts: 1225
Woops. Not enough error checking and I think I'm responsible for this breakage. Anyway quick fix to try.

In audit_windows.vbs find the decodeKey function declaration:
Code:
Function decodeKey(iValues)
  Dim arrDPID, foundKeys
  arrDPID = Array()
  foundKeys = Array()

  Select Case (UBound(iValues))


And change the above section of it to this:
Code:
Function decodeKey(iValues)
  Dim arrDPID, foundKeys
  arrDPID = Array()
  foundKeys = Array()

  decodeKey = ""
  if not isarray(iValues) then
   exit function
  end if
 
  Select Case (UBound(iValues))


This is the quickest fix (hopefully) but Mark should probably go through and make sure all calls to decodeKey aren't passing a null. Some check and some don't.


Top
 Profile  
Reply with quote  
 Post subject: Re: Windows audit v2.0.3
PostPosted: Mon Jul 31, 2017 4:34 pm 
Offline
Newbie

Joined: Wed Jul 26, 2017 4:27 pm
Posts: 21
Thanks for the fix, i have no error now all is good :)


Top
 Profile  
Reply with quote  
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 6 posts ] 

All times are UTC + 10 hours


Who is online

Users browsing this forum: No registered users and 9 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
cron
Powered by phpBB® Forum Software © phpBB Group