Activities not seen in Grafana

[IrfanNian]

Hi, first of all, such a great project! I am an InfoSec undergraduate and am planning to make use of GHOSTS on one of my side projects. Can say that I am pretty unfamiliar with some of the technologies used here. So to start off, as do some people here, I followed the guide from this website - https://cylab.be/blog/71/simulate-user-activity-with-the-ghosts-framework-introduction

My setup is - Ubuntu VM as Server, Win11 VM as Client. Managed to get the basics up and running -
docker ps on Ubuntu

Grafana managed to detect the Win11 Client successfully

However, the issue I faced is that when using the default timeline.json and modify application.json accordingly (changed the IPs accordingly, using the Ubuntu IP)

And upon running ghost.exe , in addition to downloading the latest Chrome & Firefox and also Office 2019 (Unlicensed)

I am not able to see any Activities in Grafana. On my Win11, I can see it created a Word document and writes something, Excel just opens and close no xlsx files created, blank Powerpoint is created. Firefox and Chrome didn't even launch to browse any websites.

Any thoughts on why this happens?

Tried to also access the Swagger page on my Win11, this is what I get when trying the POST /api/clientresults
Could this be the issue?

Also, for Office, does it being Unlicensed cause any issues? Because when it launches, the product key panel will appear automatically.

[sei-dupdyke]

Hi, thanks for checking out the project.

Sometimes the quick fix is to go into the gear menu at left, and go to datasources. Click through and see if the connection is successful.

[IrfanNian]

Yes, I have changed it to even 'This Fiscal Year' and still Activities are showing zero. Just the Polling number keeps increasing.

For the browser, seems like I found the culprit for Chrome as shown below -

Also one quick question, does an unlicensed MS Office prevents GHOSTS from working as intended, ie. activities listed in the default timeline.json? Using unlicensed/unactivated due to me still being a student. If it does affects, are there other alternative you would suggest that works for GHOSTS ie. WPS / Open Office?

[sei-dupdyke]

Hmm, so let's see if history is in your database.

docker exec -it ghosts-postgres /bin/bash

psql -U ghosts

select count(*) from history_timelines;

For the chrome error, you have to download the appropriate version of chromedriver as outlined here: https://cmu-sei.github.io/GHOSTS/core/client/

Unlicensed office throws lots of errors, I don't recommend it. I haven't had time to work on open office integration, sorry.

[IrfanNian]

This was what I got -

Oh, i see, no worries, I've found a workaround for Office licensing. In addition, when I launched ghost.exe, in the app logs, this error was found, may I know if it affects anything? -
2023/04/19 06:11:38.659|Ghosts.Client.Handlers.BaseBrowserHandler.ExecuteEvents|OpenQA.Selenium.WebDriverException: Could not connect to the remote WebDriver server for URL http://localhost:64528/session/497fc8a5e5cd379dc28f69fc9f3243d1/window.

Also, I have additional questions regarding GHOSTS capability, would appreciate it if you could answer them - Is GHOSTS capable of doing the stuff below?

1. Microsoft Outlook

• Login to Email
• Download Attachments

2. Chrome/Firefox

• Login to Websites (ie. Facebook, Twitter)

3. Windows File Explorer

• Create New Folder/File
• Rename Folder/File
• Delete Folder/File
• Copy & Paste Folder/File from one location to another
  Save Folder/File

4. Software Installation/Clickable

• Installing software by clicking the downloaded .exe file (through drive-by-download) in Downloads folder and clicking through 'Next/Finish' in dialog prompt when trying to install

[sei-dupdyke]

Sorry it is select * from history_timeline; - drop the "s"

[IrfanNian]

Hi, sorry for the late reply. Its finally showing the activities, didn't change any configuration. Probably took awhile to display it.

However, seems like Health is still showing '0'. Am I supposed to expect something to be shown in Health?

In addition, are you able to answer the additional questions asked above, especially 1. Microsoft Outlook and 4. Software Installation/Clickable as these tasks (ie. User logging in to Outlook at a certain time, User 'clicking' through installation setup window) are crucial in the project I'm doing now in regards to user emulation

Thank you.

[sei-dupdyke]

Good to hear!

Health might be turned off on the agents? We changed this to be off by default beginning around v6 or so?

On the client, check ./config/application.json -> "HealthIsEnabled"

https://github.com/cmu-sei/GHOSTS/blob/master/src/Ghosts.Client/config/application.json#LL43C23-L43C23

[IrfanNian]

Hi, yes! That worked! However after generating over 100k+ activities, suddenly one fine day, my entire Dashboard went empty. Everything was wiped out. Changed to 'Last 1 year' also didn't change anything. Could this be due me adding a Firewall to my Simulated Environment? But shouldn't the past activities still be displayed regardless of incoming traffic being block? That being said, I allowed inbound of Port 3000,5000, 5432, is there anymore ports I should take note of? And is there anyway for me to retrieve back my past generated data?

[sei-dupdyke]

Is the data still there?

docker exec -it ghosts-postgres /bin/bash

psql -U ghosts

select count(*) from history_timelines;

I can't imagine how a firewall rule affects this.