Troubleshooting

Troubleshooting

Common issues and fixes. Most problems are a missing tool or a PATH that has not been reloaded.

---

A module says a command is not found

Example:

[!] Required command not found: bloodhound-python
[i] Hint: pipx install bloodhound

Ghostline checks each tool at runtime and prints an install hint instead of crashing. Fixes:

1. Reload your shell after install: source ~/.bashrc (or open a new terminal).
2. Confirm the binary resolves: command -v bloodhound-python.
3. If installed under ~/.local/bin but not found, ensure that directory is on PATH:

   export PATH="$PATH:$HOME/.local/bin"

4. Re-run sudo ./install.sh (it is safe to re-run, it updates rather than duplicates).

---

install.sh aborts on apt update

Usually a broken third-party repository. The installer already disables known-bad WineHQ/zara entries, but a different broken repo can still stop apt. Inspect and disable it:

sudo apt update            # read which repo errors
sudo mv /etc/apt/sources.list.d/<broken>.list /etc/apt/sources.list.d/disabled/

Then re-run sudo ./install.sh.

---

"This script must be run as root"

install.sh needs root to install packages and create symlinks:

sudo ./install.sh

ghostline.sh itself does not need root, run it as your normal user.

---

CrackMapExec / NetExec not detected

Ghostline accepts crackmapexec, cme or nxc. If none resolve:

pipx install crackmapexec      # or
pipx install netexec           # provides nxc
pipx ensurepath && source ~/.bashrc

---

Impacket scripts not found (secretsdump, GetNPUsers)

Ghostline accepts both secretsdump.py / GetNPUsers.py and the apt impacket-* names. If neither resolves:

pipx install impacket
source ~/.bashrc

---

Anonymous modules return nothing

RPC null session, anonymous LDAP and parts of enum4linux-ng only work where the target permits unauthenticated access. Empty output typically means the DC is hardened, that is a valid finding, not a bug. Re-try with credentials via Active Enumeration.

---

The banner / colors look broken

The UI is TTY-aware. In a real terminal you get colors and ASCII art; piped or in a "dumb" terminal it falls back to plain text. If glyphs render as boxes, use a terminal/font with Unicode + 256-color support (the ASCII raven uses braille glyphs).

---

Results directory not where I expected

Output paths are relative to the directory you launched ghostline.sh from. Run Ghostline from your engagement workspace, or set an absolute path in Configuration → [4] Set Output Directory.

---

nmap says "Couldn't open a raw socket"

You are almost certainly inside the rootless podman box (the default on Fedora, Bazzite and similar hosts). The container is granted NET_RAW, but the capability is ineffective over the host's network namespace, so raw-socket scans cannot open a socket, even as root inside the box.

Ghostline handles this automatically: nmap falls back to an unprivileged TCP connect scan. For a real SYN scan or OS detection, run the toolkit natively on a Debian/Kali host, or use a rootful container.

---

Still stuck

• Re-read Installation for what each tool needs.
• Open an issue using the templates at .github/ISSUE_TEMPLATE/.
• For security-sensitive reports, follow docs/SECURITY.md (private disclosure).