{"action":"closed","issue":{"url":"https://api.github.com/repos/mitre/caldera/issues/149","repository_url":"https://api.github.com/repos/mitre/caldera","labels_url":"https://api.github.com/repos/mitre/caldera/issues/149/labels{/name}","comments_url":"https://api.github.com/repos/mitre/caldera/issues/149/comments","events_url":"https://api.github.com/repos/mitre/caldera/issues/149/events","html_url":"https://github.com/mitre/caldera/issues/149","id":446351927,"node_id":"MDU6SXNzdWU0NDYzNTE5Mjc=","number":149,"title":"Multi-line Linux response causes error","user":{"login":"scottctaylor12","id":19297370,"node_id":"MDQ6VXNlcjE5Mjk3Mzcw","avatar_url":"https://avatars0.githubusercontent.com/u/19297370?v=4","gravatar_id":"","url":"https://api.github.com/users/scottctaylor12","html_url":"https://github.com/scottctaylor12","followers_url":"https://api.github.com/users/scottctaylor12/followers","following_url":"https://api.github.com/users/scottctaylor12/following{/other_user}","gists_url":"https://api.github.com/users/scottctaylor12/gists{/gist_id}","starred_url":"https://api.github.com/users/scottctaylor12/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/scottctaylor12/subscriptions","organizations_url":"https://api.github.com/users/scottctaylor12/orgs","repos_url":"https://api.github.com/users/scottctaylor12/repos","events_url":"https://api.github.com/users/scottctaylor12/events{/privacy}","received_events_url":"https://api.github.com/users/scottctaylor12/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2019-05-20T23:27:44Z","updated_at":"2019-05-22T23:18:17Z","closed_at":"2019-05-22T23:18:16Z","author_association":"CONTRIBUTOR","body":"When I use the sandcat client on Linux systems, I am able to run the \"Identify active user\" ability with no issues. When I check the results I see the one word/line response, \"root\". However, when I use abilities such as \"Parse SSH known_hosts\" or \"Collect ARP details\" I receive the following error:\r\n\r\n```\r\nERROR:aiohttp.server:Error handling request\r\nTraceback (most recent call last):\r\n  File \"/usr/local/lib/python3.7/site-packages/aiohttp/web_protocol.py\", line 390, in start\r\n    resp = await self._request_handler(request)\r\n  File \"/usr/local/lib/python3.7/site-packages/aiohttp/web_app.py\", line 366, in _handle\r\n    resp = await handler(request)\r\n  File \"/usr/local/lib/python3.7/site-packages/aiohttp/web_middlewares.py\", line 106, in impl\r\n    return await handler(request)\r\n  File \"/usr/local/lib/python3.7/site-packages/aiohttp_session/__init__.py\", line 152, in factory\r\n    response = await handler(request)\r\n  File \"/usr/local/lib/python3.7/site-packages/aiohttp/web_middlewares.py\", line 96, in impl\r\n    return await handler(request)\r\n  File \"/usr/src/app/plugins/sandcat/app/sand_api.py\", line 35, in results\r\n    data = json.loads(self.utility_svc.decode_bytes(await request.read()))\r\n  File \"/usr/local/lib/python3.7/json/__init__.py\", line 348, in loads\r\n    return _default_decoder.decode(s)\r\n  File \"/usr/local/lib/python3.7/json/decoder.py\", line 337, in decode\r\n    obj, end = self.raw_decode(s, idx=_w(s, 0).end())\r\n  File \"/usr/local/lib/python3.7/json/decoder.py\", line 353, in raw_decode\r\n    obj, end = self.scan_once(s, idx)\r\njson.decoder.JSONDecodeError: Invalid control character at: line 1 column 134 (char 133)\r\nERROR:aiohttp.server:Unhandled exception\r\nTraceback (most recent call last):\r\n  File \"/usr/local/lib/python3.7/site-packages/aiohttp/web_protocol.py\", line 410, in start\r\n    await resp.prepare(request)\r\n  File \"/usr/local/lib/python3.7/site-packages/aiohttp/web_response.py\", line 300, in prepare\r\n    return await self._start(request)\r\n  File \"/usr/local/lib/python3.7/site-packages/aiohttp/web_response.py\", line 608, in _start\r\n    return await super()._start(request)\r\n  File \"/usr/local/lib/python3.7/site-packages/aiohttp/web_response.py\", line 367, in _start\r\n    await writer.write_headers(status_line, headers)\r\n  File \"/usr/local/lib/python3.7/site-packages/aiohttp/http_writer.py\", line 110, in write_headers\r\n    self._write(buf)\r\n  File \"/usr/local/lib/python3.7/site-packages/aiohttp/http_writer.py\", line 67, in _write\r\n    raise ConnectionResetError('Cannot write to closing transport')\r\nConnectionResetError: Cannot write to closing transport\r\n```\r\n\r\nI believe that the issue is the sandcat Linux client cannot handle command responses that are multiple lines. I tested on Windows with the \"Collect ARP details\" and it showed multiple lines properly in the results. \r\n\r\nI see that the 54ndc47.sh file uses a python command so I tested on two machines that use python 2.7.5 and 3.7.0, but both failed to pass back multiple line command outputs.\r\n\r\nI believe it is a multiple line issue, but what do you think?"}}
{"actor":{"display_login":"privateducky"}}