Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ZIP files generated in Windows (e.g. 7-zip) are not processed properly #110

Open
pisaura opened this issue Aug 10, 2023 · 1 comment
Open

Comments

@pisaura
Copy link

pisaura commented Aug 10, 2023

Describe the bug
When providing a ZIP file compressed with 7-zip (under Windows) many parsers don't work (no error provided). Example: events parser.

In Kuiper.log:
"2023-08-10 09:03:26.977887","[DEBUG]","parser_management.py.specify_files_to_be_parser[Lin.75]","parser","Start parsing: case[deschd_case] - machine[deschd_case_test_7zip_gui] - Parsers[Events]",""
"2023-08-10 09:03:26.996533","[INFO]","parser_management.py.run_parsers[Lin.765]","parser","Done processing the task case[deschd_case] - machine[deschd_case_test_7zip_gui] - Parsers[Events]",""

Windows Events are included in the ZIP file for sure. Sources are collected by KAPE (target !SANS_Triage).
When only zipping Windows events (as target in KAPE) or out of the provided structure from !SANS_Triage the events are processed. Again the ZIP file is created with 7-zip in Windows.
When zipping the files in Linux the parsers seem to work fine (also with the whole collection of !SANS_Triage).

There is no error within the files list of the machine - just "No data available in table".

To Reproduce
Steps to reproduce the behavior:

  1. Collect target !SANS_Triage with KAPE (v1.3.0.2).
  2. Create ZIP file with 7-zip (or even Windows Explorer) with or without compression.
  3. Upload ZIP to Kuiper.
  4. Start Events parser.

Expected behavior
ZIP files created in Windows (e.g. with 7-zip or Windows Explorer) should be processed properly.

Desktop (please complete the following information):

  • OS: [e.g. iOS]
  • Browser [e.g. chrome, safari]
  • Version [e.g. 22]

Additional context
Why are the ZIP files created in Windows not processed correctly while ZIPs created in Linux are?
How can I create ZIP files in Windows to work properly with kuiper?
(Because the ZIP files created with KAPE cannot be extracted (see issues #12, #33 and #109) I want to automate the zipping process in Windows before uploading the files to Kuiper.)

@salehmuhaysin
Copy link
Collaborator

hello
python ZipFile has some limitation on the compression methods for zip,
i added support to decompress using 7z if ZipFile failed,
after update i tried with windows Sent to -> Compressed (zipped) folder, 7-Zip -> Add to "folder.zip", and 7-Zip -> Add to archive -> compression level 9 all worked, please check with the new update 2.3.5

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants