unable to run on mac M3, VMware fusion + others (3 strikes, project seems)

[steveschofield]

I tried a few different things. Spent off / on for a couple days tinkering. learned vagrant a little, might tinker more on vagrant at a later time. The project seems to need a little TLC or be taken down. :). Looks cool though!

• Hyper-v / win10 - no luck
• Tried Hyper-VM disk (wouldn't boot)

Tried and made it farther with Mac M3 w/vmware fusion. Still no luck

See attached file.

vagrant-vmware-desktop.txt

...went wrong.

[secureideas]

Interesting. We don't have any mac machines, so I can't test that out, but the Hyper-V disk was booting, so I will check.

[secureideas]

Ahhh on note, VMWare Fusion on M3s does not support non-ARM-based VMs. SamuraiWTF is not ARM-based.

[steveschofield]

i'm trying to build a set of introduction videos my students and starting with OWASP projects. Juice Shop uses a container. The last Secure Ideas training in michigan they talked about this project. I wanted to see if I could get working. Ubuntu has an arm ISO and vmware fusion could potentially use vagrant provider. I've not done vagrant before and looks like a cool project. Not sure the demand for others. I try to do stuff locally on my personal M3 mac. My work one right now is intel. The world bends to x86/64.

[JGillam]

@steveschofield when you tried on Windows, did you run the root Vagrant file, or the one under the Ubuntu-20 folder? The ubuntu-20 is the current reference implementation and should be stable. I just did a fresh run this way for hyperv (following the README.md in that folder) and it worked.

[steveschofield]

Are there logs somewhere after I run. I accidentally closed command window but the VM stayed running and looks to be correct. I was able to run ssh and connect. I'm following instructions here. https://github.com/SamuraiWTF/samuraiwtf.

I used the vagrant file in the ubuntu folder, my original with errors above are using root folder one (i believe). Self admitting, I spent a couple of days trying stuff (why read detailed instructions). I didn't thing to try the vagrant in ubuntu. I was able to run and seems working using the vagrant in ubuntu folder. Here are a few others things. ZAP won't install and since there is no UI, I tried to connect and notice via docker starting up on 127.0.0.1.

Is there supposed to be a GUI on the deployed ubuntu server?

the vm has no UI that I know of
samurai@SamuraiWTF:~$ sudo docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
4823b5df1936 827f44e0b2f5 "/nodejs/bin/node /j…" 6 minutes ago Up 3 minutes 127.0.0.1:3000->3000/tcp juice-shop

here is the error

samurai@SamuraiWTF:~$ katana install zap (tried sudo command too.
Running 'install' tasks for module 'zap'...
---> Running: unarchive install
Traceback (most recent call last):
File "./katanacli.py", line 79, in
args.func(args)
File "./katanacli.py", line 15, in install_module
katanacore.install_module(args.name, ((args.step is not None) and args.step))
File "/opt/katana/katanacore.py", line 77, in install_module
_run_function(name, "install", step)
File "/opt/katana/katanacore.py", line 71, in _run_function
return function_to_call(step)
File "/opt/katana/provisioners/DefaultProvisioner.py", line 19, in install
self._run_function("install", step)
File "/opt/katana/provisioners/DefaultProvisioner.py", line 49, in _run_function
self._run_task(task, func_name)
File "/opt/katana/provisioners/DefaultProvisioner.py", line 71, in _run_task
result, msg = method_to_call(task.get(task_type))
File "/opt/katana/plugins/Unarchive.py", line 22, in any
cd = r.headers['content-disposition']
File "/usr/local/lib/python3.8/dist-packages/requests/structures.py", line 52, in getitem
return self._store[key.lower()][1]
KeyError: 'content-disposition'

[steveschofield]

ok i rebooted afterwards and now the GUI comes up. First time newb here so besides the ZAP issue. I'll try again after a reboot

[JGillam]

You are correct - ZAP installation seems to be failing. That said, ZAP moved away from OWASP (I think last year) so during that process the installation likely moved, and we just didn't update it. I'll do some looking into that and see if I can update the katana package to handle it.

Depending on your goals, you may want to also consider just running JuiceShop in a container and installing ZAP locally. But if you have something else in mind, I'm happy to talk through it with you. We have been focusing more on standing up entire classrooms of labs (hence the samuraiwtf/shogun project) rather than just getting a single VM up and running.

[JGillam]

ok, I found and fixed the ZAP download but it's still not installing correctly on the VM. I'm going to need a bit more time to sort this out.

For reference, running katana --update will cause katana to self-update to the latest main branch. This should allow ZAP to be downloaded properly but I found it seemed to stop there. The ZAP package was sitting in /tmp, so I was able to run:
sudo tar -xzf ZAP_2.16.0_Linux.tar.gz -C /opt/samurai/ to get it in the right place but the desktop file was created but doesn't seem to show up in the available apps even after logout / login.

[steveschofield]

Here is the output from the vagrant file from the ubuntu folder. I'm on a M3 24 GB Air. Interesting it dies on the certificates portion. I know you said no Macs were available. I'll try on my intel macbook pro

vagrant-mac-m3.txt

[steveschofield]

An update. Looks like the script in ubuntu folder works. I attached the output for review, if you want, from the published vagrant file, there are some red but from docs it appears the message could be 'a change' not an error. I also ran install_recommended.sh file manually via ssh to the VM, output other attachment with apps-install name.

I'm running as admin on a MacBook air M3 24GB RAM. I would consider this a success and is usable, I plan to move forward with a basic youtube video for anyone who is looking to setup a machine for ethical hacking. I'm NO ansible or vagrant expert, but did get it working. Thanks for the open source repo to use. Maybe someday I'll reverse engineer everything to understand better. My primary goal is have a hacking environment with some tools

samuraiwft-output.docx
samuraiWTF-apps-install.docx

[steveschofield]

i'll see if I can get the apps working now.

[steveschofield]

Most of the apps will download / install the container but when attempting to start them, the "run man" icon will not start. I'll keep tinkering.

[steveschofield]

What i'm finding the containers used with samuraiWTF don't support or some packages within the sample vuln apps don't like MacOS silicon. The OS itself has ARM support. I'll try on my win10 / hyperv setup (have two old desktops) I use for homelab. It's fun to reverse engineer something like, like pentesting it's an exercise in controlled failure and some success (even when I fail). The DVGA (graphql) publishes an Dockerfile.arm64 but doesn't work or at least on my machine.

[JGillam]

@steveschofield I've been working on an ubuntu 22.04 rebuild but have so far only tested on hyperv.

[steveschofield]

i evolved my pursuit and using it as a learning opportunity, as you know, learning never stopos. My main workstation is MacBook M-series and seems like a good opportunity to go deeper. https://github.com/steveschofield/build-beginner-ethical-hacking-environment/tree/main/MacBook-M-Series-vagrant-ubuntu-2204 builds upon the good work samuraiWTF project. Some sample apps are not compatible with M3. Until now, I've never used Vagrant and Ansible. After a few days, I'm pretty comfortable and recently got Ubuntu 22.04 working locally. My focus is going to switch back to hacking apps, learning which ones work on Mac and sharing my findings with others. "Always need a goal right!"

PS - My #homelab machines are win10, hyperv (dell 7010 optiplex) so I have a place to try. I also adjunct teach so having these stills to pass along and share with students is another motiviation. thanks again for the good project, even though SamuraiWTF wasn't seemless on M3, it was very helpful! Keep up the good work and reach out if you want to chat

[steveschofield]

Here is the article sharing my findings https://www.linkedin.com/posts/stevecschofield_github-samuraiwtfsamuraiwtf-the-main-activity-7296554752417349632-kTwf/

[steveschofield]

Next question - I've gotten the wayfarer project to run (swapping out mysql for mariadb:10). The documentation is sparse on this project. Is this project meant to be a stand-alone project for attacking?

[mgillam]

Good morning Steve.

Correct on all accounts, Wayfarer is a React-based single page app, target for attacking. There's not a published list of vulns for it as of right now, but it has XSS, Broken Auth, privilege escalations flaws, a JWT with an HS256 signature using a secret that appears in word lists... possibly SQLi. It was built as a more modern app at the time, but it hasn't had any attention in a few years.
Addendum: It's API-driven as well, so to an extent the API can be tested directly. I think the Postman file in the repo may be reasonably close to correct. There's also a data seeding script in there somewhere that populates the base data and accounts.

[mgillam]

https://github.com/SamuraiWTF/wayfarer/blob/132dc94bfd53519816fc3cdc02971edee42bf3e5/wayfarerDB/init/initTickets.sql#L101-L113 has the seeding with the passwords for the user accounts (the comments show the passwords, ignore the -- and leading space, but include all other punctuation). The 3 "pentester" accounts with different roles all share the password samurai I believe.

[steveschofield]

that helps. i've gotten dvwa, webgoat, a popular API example and this, it's enough for now to take next steps to do attacks. On a related note, I've migrated to 22.04 and also tried the 22.04 on my win10 / hyper-v. It deployed but i've not tested individual apps. I've seen on occasion within the Win10/HyperV version katana.test page something will download, but not start. Any tips on troubleshooting. If the intent is for the person deploying to troubleshoot, I realize this in not a fully supported solution, let me know. I've learned a lot about vagrant and ansible. This will go along with an ethical hacking class i'l be teaching at a local college. I'd love to have some additional options for students beyond the material. Thanks again for the responses.

[mgillam]

Any tips on troubleshooting. If the intent is for the person deploying to troubleshoot, I realize this in not a fully supported solution, let me know.

The goal is generally not to have the person deploying have to troubleshoot, but things break and go unnoticed sometimes if we're not regularly rebuilding the solution. It's been a while since I personally have done troubleshooting on it, but iirc running katana start <module> commands from the CLI will give you more verbose output that isn't presented through the web app. Since it's the same codebase behind the scenes, it should generally be the same error occurring there. The most common issues I recall were 1) related to the mkcert cert generation for targets using TLS - if the cert wasn't where it was expected it be, it would cause an nginx config error. 2) If the URL we were sourcing something from were to change, it would cause it to fail, but I think that issue would be at the install step, not the start step. 3) For wayfarer specifically, there's some more complicated container orchestration involved, so occasionally there's been an error spinning up the docker containers.

i've gotten dvwa, webgoat, a popular API example and this, it's enough for now to take next steps to do attacks

Musashi might also be worth a look. It's different in that it's not a target app, it's an interactive demo. It's simpler in that it's a single Express app listening on multiple ports, with no actual database, it's built more for demonstrating web app security controls (CORS configurations and CSP in particular), rather than being a target. It was built specifically for classes taught at conferences. https://github.com/SamuraiWTF/musashi-js

[Joshua-olagunju]

please guys follow my account

[Joshua-olagunju]

I am new to github, so I need followers to see my work and boost my confidence. Thank you. I appreciate your follow

[JGillam]

Adding comments to random conversations is not a good way to get people to follow you. I would suggest meaningful contributions and promoting of those contributions through social media as a much better way to get attention.

[Joshua-olagunju]

Alright. Thank you for the hint ✌️

[secureideas]

This is not the way to do that. If you want to grow followers, then work with projects and contribute. The followers will come.

[Joshua-olagunju]

Can we work together and you give out project to me as task so I can improve my hands on experience.

Been in the field over a year now, so I’m still not familiar with the GitHub interface. Sorry for the comment earlier