ValueError: Target not recognized as a citrix-netscaler #2
Comments
|
I have same problem: python3 iocitrix.py md0.img+da0.img
Traceback (most recent call last):
File "/mnt/datastore/temp/netscaller/nsg1-clone/citrix-netscaler-triage/iocitrix.py", line 267, in
main()
File "/mnt/datastore/temp/netscaller/nsg1-clone/citrix-netscaler-triage/iocitrix.py", line 263, in main
check_targets(args.targets)
File "/mnt/datastore/temp/netscaller/nsg1-clone/citrix-netscaler-triage/iocitrix.py", line 227, in check_targets
raise ValueError(f"Target not recognized as a citrix-netscaler: {target.path}: {target.os}")
ValueError: Target not recognized as a citrix-netscaler: md0.img+da0.img: default
I already tried load vmx too, but same problem. Max |
|
It looks it doesn't recognise it as a NetScaler device, can you try loading it with $ target-shell netscaler.vmx
...<snipped>
netscaler.vmx /> ls
.nscli_history
.snap
bin
colorful
...<snipped> |
|
Here are the two examples run from the same laptop (manjaro linux) non-working working |
$ target-shell da0.img 2023-08-17T14:51:31.344873Z [warning ] : Can't identify filesystem: [dissect.target.target] 2023-08-17T14:51:31.345339Z [warning ] : Can't identify filesystem: [dissect.target.target] 2023-08-17T14:51:31.345666Z [warning ] : Can't identify filesystem: [dissect.target.target] 2023-08-17T14:51:31.346011Z [warning ] : Can't identify filesystem: [dissect.target.target] 2023-08-17T14:51:31.398467Z [error ] Unable to import dissect.target.plugins.filesystem.yara [dissect.target.plugin] 2023-08-17T14:51:31.663025Z [warning ] : Failed to find OS plugin, falling back to default [dissect.target.target] $ target-shell nsg1-clone_3-flat.vmdk 2023-08-17T14:54:02.007151Z [warning ] : Can't identify filesystem: [dissect.target.target] 2023-08-17T14:54:02.007616Z [warning ] : Can't identify filesystem: [dissect.target.target] 2023-08-17T14:54:02.007962Z [warning ] : Can't identify filesystem: [dissect.target.target] 2023-08-17T14:54:02.008331Z [warning ] : Can't identify filesystem: [dissect.target.target] 2023-08-17T14:54:02.060458Z [error ] Unable to import dissect.target.plugins.filesystem.yara [dissect.target.plugin] 2023-08-17T14:54:02.329494Z [warning ] : Failed to find OS plugin, falling back to default [dissect.target.target] $ target-shell nsg1-clone.vmx 2023-08-17T14:54:37.019520Z [warning ] : Can't identify filesystem: [dissect.target.target] 2023-08-17T14:54:37.019983Z [warning ] : Can't identify filesystem: [dissect.target.target] 2023-08-17T14:54:37.020318Z [warning ] : Can't identify filesystem: [dissect.target.target] 2023-08-17T14:54:37.020679Z [warning ] : Can't identify filesystem: [dissect.target.target] 2023-08-17T14:54:37.075745Z [error ] Unable to import dissect.target.plugins.filesystem.yara [dissect.target.plugin] 2023-08-17T14:54:37.354086Z [warning ] : Failed to find OS plugin, falling back to default [dissect.target.target] |
|
@Michael-Hennemann @maxdevaine It looks like dissect doesn't recognise the partitions or disk, can you run $ ssh netscaler
Done
> shell
root@ns# gpart show
=> 63 41942977 da0 MBR (20G)
63 41942943 1 freebsd [active] (20G)
41943006 34 - free - (17K)
=> 0 41942943 da0s1 BSD (20G)
0 3354624 1 freebsd-ufs (1.6G)
3354624 8597504 2 freebsd-swap (4.1G)
11952128 4096 4 freebsd-ufs (2.0M)
11956224 29986719 5 freebsd-ufs (14G) |
|
Life NetScaller: root@ns# gpart show
=> 63 41942977 da0 MBR (20G)
63 41929587 1 freebsd [active] (20G)
41929650 13390 - free - (6.6M)
=> 0 41929587 da0s1 BSD (20G)
0 3276800 1 freebsd-ufs (1.6G)
3276800 8601600 2 freebsd-swap (4.1G)
11878400 4096 4 freebsd-ufs (2.0M)
11882496 30047091 5 freebsd-ufs (14G)
Disk da0.img $ gdisk -l da0.img GPT fdisk (gdisk) version 1.0.9.1 Partition table scan: MBR: MBR only BSD: not present APM: not present GPT: not present *************************************************************** Found invalid GPT and valid MBR; converting MBR to GPT format in memory. *************************************************************** Disk da0.img: 41943040 sectors, 20.0 GiB Sector size (logical): 512 bytes Disk identifier (GUID): 78D1B62E-EE34-41F1-A6D7-D91F9FE2864C Partition table holds up to 128 entries Main partition table begins at sector 2 and ends at sector 33 First usable sector is 34, last usable sector is 41943006 Partitions will be aligned on 1-sector boundaries Total free space is 13386 sectors (6.5 MiB) Number Start (sector) End (sector) Size Code Name 1 63 41929649 20.0 GiB A500 FreeBSD disklabel $ fdisk -l da0.img Disk da0.img: 20 GiB, 21 474 836 480 bajtů, 41 943 040 sektorů Jednotky: sektorů po 1 * 512 = 512 bajtech Velikost sektoru (logického/fyzického): 512 bajtů / 512 bajtů Velikost I/O (minimální/optimální): 512 bajtů / 512 bajtů Typ popisu disku: dos Identifikátor disku: 0x0f800000 Zařízení Zaveditelný Začátek Konec Sektory Velikost ID Druh da0.img1 * 63 41929649 41929587 20G a5 FreeBSD vmdk image: $ gdisk -l nsg1-clone_3-flat.vmdk GPT fdisk (gdisk) version 1.0.9.1 Partition table scan: MBR: MBR only BSD: not present APM: not present GPT: not present *************************************************************** Found invalid GPT and valid MBR; converting MBR to GPT format in memory. *************************************************************** Disk nsg1-clone_3-flat.vmdk: 41943040 sectors, 20.0 GiB Sector size (logical): 512 bytes Disk identifier (GUID): 1607B779-D7A9-4E83-A577-5DB05485D246 Partition table holds up to 128 entries Main partition table begins at sector 2 and ends at sector 33 First usable sector is 34, last usable sector is 41943006 Partitions will be aligned on 1-sector boundaries Total free space is 13386 sectors (6.5 MiB) Number Start (sector) End (sector) Size Code Name 1 63 41929649 20.0 GiB A500 FreeBSD disklabel $ fdisk -l nsg1-clone_3-flat.vmdk Disk nsg1-clone_3-flat.vmdk: 20 GiB, 21 474 836 480 bajtů, 41 943 040 sektorů Jednotky: sektorů po 1 * 512 = 512 bajtech Velikost sektoru (logického/fyzického): 512 bajtů / 512 bajtů Velikost I/O (minimální/optimální): 512 bajtů / 512 bajtů Typ popisu disku: dos Identifikátor disku: 0x0f800000 Zařízení Zaveditelný Začátek Konec Sektory Velikost ID Druh nsg1-clone_3-flat.vmdk1 * 63 41929649 41929587 20G a5 FreeBSD |
|
Netscaler Live Non-Working Other-Netscaler Live Working |
|
Netsclaer Non-Working Other-Netscaler Working |
|
Hi, we are investigating the issues but we are unable to reproduce with a clean NS13.0-91.13 build. Were these systems upgraded from an older version? and what were those versions? In > shell
root@ns# ls /flash/*.gz
/flash/ns-13.0-52.24.gz
/flash/ns-13.0-58.32.gz
/flash/ns-13.1-49.13.gz |
|
Hm, is it possible that this gets cleaned up after some updates ? The one that is non working says "/flash/ns-12.0-63.21.gz /flash/ns-13.0-91.13.gz" but I am pretty sure that I have done at least 10-20 updates... The same with the one that is working |
|
Yes, that's possible. Maybe it only keeps the last 4 kernels. But good to know it's been upgraded from a 12.1. We've been investigating a bit and think there may be something funky going on with the parsing of the disklabel partition. From the Dissect logging you provided, we can tell that in the broken case, Dissect thinks that the "swap" partition starts at offset dd if=netscaler-flat.vmdk of=debug-file.bin bs=1M count=1You could then attach @maxdevaine your Dissect logs do not contain the |
|
I can probably send it via email. I guess the first 1 MB won't contain any personal information... :-) |
You can double check with a hexdump on your own file of course, but it only contains the partition tables, the superblock, root inode and some other miscellaneous metadata of the first UFS filesystem! |
|
@Michael-Hennemann It should be fixed by above merged patch. Thank you providing the test data, it really helped with debugging this issue! You need to install the updated It might complain about pinned dependencies, but you can ignore this. If you can verify if this works, we can probably release a new patch version of Dissect. |
|
Hi, I got the following error: target-shell netscaler-flat.vmdk still cannot "ls" the netscaler disk. But the iocitrix script seems to work right now ! :-D I will test it and get back to you. Thank you very much so far !! |
|
Hm, the script throws an error and exits during execution: |
|
Thank you, new patch for dissect.volume solved my problem. All works now. Max |
|
@Michael-Hennemann this looks a bit more difficult to troubleshoot using GitHub issues, let's discuss this further over email. |
|
Any news on this issue? ~/citrix-netscaler-triage$ python3 iocitrix.py da0.img disk -l da0.img GPT fdisk (gdisk) version 1.0.9 Warning: File size is not a multiple of 512 bytes! Misbehavior is likely! Creating new GPT entries in memory. target-shell da0.img 2023-08-21T18:32:38.235729Z [warning ] : Can't identify volume system, adding as raw volume instead: [dissect.target.target] 2023-08-21T18:32:38.357247Z [warning ] : Can't identify filesystem: [dissect.target.target] 2023-08-21T18:32:38.434419Z [error ] Unable to import dissect.target.plugins.filesystem.yara [dissect.target.plugin] 2023-08-21T18:32:38.844824Z [warning ] : Failed to find OS plugin, falling back to default [dissect.target.target] da0.img /> ls da0.img /> |
|
@SnaXen Strange, what command did you use to acquire the image? We recently made our instructions more concise in our README. Can you post the first few bytes of the $ hexdump -C da0.img | head |
Here: hexdump -C da0.img | head It was a colleague og mine that made the image a few days ago. |
|
@SnaXen Somehow your NetScaler outputted an error message to stdout before the command. Looking from the hexdump bytes I can also see the cat da0.img | tail -c +141 > da0.img.fixedAlso, did your colleague create an image of |
@yunzheng Here is a hexdump from md0.img, Is it the same fix? And here are the dump from md0.img.fixed: |
|
Yes same fix, your |
Yes. python3 iocitrix.py md0.img.fixed Volumes
|
|
@SnaXen make sure to run it with both python3 iocitrix.py md0.img.fixed+ad0.img.fixed |
|
No errors when running python3 iocitrix.py da0.img.fixed python3 iocitrix.py md0.img.fixed+da0.img.fixed <Target md0.img.fixed+da0.img.fixed>
|
|
ah this error was fixed yesterday (see also #4). please do the following: pip install --upgrade --pre dissect.targetAnd then run Sorry for the inconvience, we will check what the best way is to ensure these fixes go into a stable release or if we update the README. |
Thank you for all the assistance. With --pre I get this error : ERROR: pip's dependency resolver does not currently take into account all the packages that are installed. This behaviour is the source of the following dependency conflicts. |
|
The So you can ignore that error, it's just complaining that the pinned versions of the stable release are now mismatching and can cause issues. Good to hear it's working now :) |
|
How big are these .img files? Mine are all coming out as 10MB. |
My da0.img's are about 20GB's and md0.img's are about 439 MB's. |
|
Thank you; I figured out that the files were not getting dumped to my local machine and I got similar sizes as yours. Next issue: target-shell: command not found Any ideas here? |
It’s most likely installed in |
|
Even after running the cat command to snip the error that was written to stdout in my md0 and da0 files, I still get the "Target not recognized as a citrix-netscaler" error. When I look at the file in hex, I see the following, followed by a buch of zero-space before what looks like the beginning of some content. Do I need to trim more? Warning: One or more RPC nodes are configured with default passwords. For enhanced security, you must change the default RPC node password. |
Hi! :)
I am getting an error when I try to check one of my Netscaler vmdks (NetScaler NS13.0: Build 91.13.nc)
With the same setup I was able to check another one successfully so I am cautiously optimistic that I am not per se dooing something wrong... ^^
any ideas ?
cheers
Michael
The text was updated successfully, but these errors were encountered: