Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Configuring Locations: the {UserProfiles} variable does not support leading/trailing path #58

Closed
ROBERTPASCAL opened this issue Jan 6, 2022 · 2 comments

Comments

@ROBERTPASCAL
Copy link

Dans le cadre de l'extraction du RDP Bitmap Cache, j'ai essayé d'utiliser la variable {UserProfiles} dans la configuration suivante :

<?xml version="1.0"?>
<getthis nolimits="" reportall="">
    <location>%systemdrive%\users\{UserProfiles}\AppData\Local\Microsoft\Terminal Server Client\Cache\</location>
    <location>%systemdrive%\Documents and Settings\{UserProfiles}\Local Settings\Application Data\Microsoft\Terminal Server Client\Cache\</location>
    <samples>
        <sample>
            <ntfs_find name_match="*"/>
        </sample>
    </samples>
</getthis>

J'obtient l'erreur suivante lors de l'execution (RdpBitmapCache.log) :

GetThis v10.0.23
Sample collection
ERROR (Unspecified error, hr=E_FAIL 0x80004005): Could not determine reader for C:\users\{UserProfiles}\AppData\Local\Microsoft\Terminal Server Client\Cache\
ERROR (Unspecified error, hr=E_FAIL 0x80004005): Could not determine reader for C:\Documents and Settings\{UserProfiles}\Local Settings\Application Data\Microsoft\Terminal Server Client\Cache\
ERROR (Unspecified error, hr=E_FAIL 0x80004005): Syntax error in specific locations parsing in config file

Si je modifie {UserProfiles} par le nom du compte utilisateur, l'execution se déroule parfaitement.

La documentation mentionne les éléments suivants :

Configuring Locations
A location is an access path to a specific NTFS volume. Typically, an access path can be:
...
    an environment variable or a dynamic variable, such as
            %SYSTEMDRIVE%
            {UserProfiles}

Avec l'exemple suivant :

<location>{UserProfiles}\Downloads</location>

Pourriez-vous me dire si cette variable fonctionne correctement ou si je fait une errreur de syntaxe ?

@ghost ghost assigned fabienfl-orc Jan 7, 2022
@fabienfl-orc fabienfl-orc transferred this issue from DFIR-ORC/dfir-orc-config Jan 7, 2022
@fabienfl-orc
Copy link
Collaborator

Hello,

There is a mistake in your configuration but also a bug.

The configuration must never specify '{UserProfile}' prepended with a path.

The '{UserProfile}' element should be replaced during execution with something like :

C:\Windows\system32\config\systemprofile\Downloads
C:\Windows\ServiceProfiles\LocalService\Downloads
C:\Windows\ServiceProfiles\NetworkService\Downloads
C:\Users\Foo\Downloads
C:\Users\Bar\Downloads
...

However it will not work before the 10.0.24 because there is a bug on the path '\Downloads' appended to '{UserProfile}'. Meanwhile you can still use <location>{UserProfiles}</location> and restrict match with ntfs_find's path_match.

Thank you


Bonjour,

Il y a une erreur dans votre configuration mais aussi un bug.

La configuration ne devrait jamais spécifier '{UserProfiles}' précédé d'un chemin.

L'élément '{UserProfile}\Downloads' devrait être remplacé à l'exécution avec par exemple :

C:\Windows\system32\config\systemprofile\Downloads
C:\Windows\ServiceProfiles\LocalService\Downloads
C:\Windows\ServiceProfiles\NetworkService\Downloads
C:\Users\Foo\Downloads
C:\Users\Bar\Downloads
...

Cependant cela ne fonctionnera pas avant la 10.0.24 car il y a un bug sur la gestion d'un chemin '\Downloads' qui suit '{UserProfile}'. En attendant vous pourriez utiliser <location>{UserProfiles}</location> et limiter la recherche avec path_match de ntfs_find.

Merci

@fabienfl-orc
Copy link
Collaborator

Also beware that known folders path like %USERPROFILE%\Downloads can be customized out of %USERPROFILE% tree.


Gardez à l'esprit que les chemins de type known folders comme %USERPROFILE\Downloads peuvent être configuré vers un chemin en dehors de l'arborescence de %USERPROFILE%.

@fabienfl-orc fabienfl-orc changed the title Configuring Locations : la variable {UserProfiles} n'est pas reconnue Configuring Locations: the {UserProfiles} variable does not support leading/trailing path Jan 11, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants