cutaway-security / cutsec_tools Goto Github PK

The zeek install script files to install because the package 'python-dev' is no longer available. Thus, no packages are installed. Remove that package or find and option that ignores failed packages.

Also, do not install as the root user or via sudo as this will place everything in the '/root' directory. Add a check that bails if root user.

Scapy can do ASN.1, but I'm not sure how to implement it. I need help.

appears there are some errors in the script

the pcap in /root is kali:kali owned, not by root

any assistance would be appreciated

zeek -Cr /root/4SICS-GeekLounge-151022.pcap /home/kali/Tools/ics-zeek/load.zeek
warning in /home/kali/Tools/ics-zeek/bzar/scripts/./main.zeek, lines 126-130: "when" statement referring to locals without an explicit [] capture is deprecated: BZAR::match, BZAR::orig_h, BZAR::w (when ((BZAR::n1 = lookup_addr(BZAR::orig_h)) && (BZAR::n1 in BZAR::w$orig_names)) { BZAR::match = T} timeout BZAR::whitelist_dns_timeout { BZAR::match = F})
warning in /home/kali/Tools/ics-zeek/bzar/scripts/./main.zeek, lines 137-141: "when" statement referring to locals without an explicit [] capture is deprecated: BZAR::match, BZAR::resp_h, BZAR::w (when ((BZAR::n2 = lookup_addr(BZAR::resp_h)) && (BZAR::n2 in BZAR::w$resp_names)) { BZAR::match = T} timeout BZAR::whitelist_dns_timeout { BZAR::match = F})
error in string and /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, line 25: type clash (string and drsuapi::DRSReplicaSync)
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, line 25 and string: type mismatch (drsuapi::DRSReplicaSync and string)
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, lines 25-26: inconsistent type in set constructor (set(drsuapi::DRSReplicaSync, drsuapi::DRSGetNCChanges))
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, lines 25-26: type clash in assignment (BZAR::t1003_006_rpc_strings = set(drsuapi::DRSReplicaSync, drsuapi::DRSGetNCChanges))
error in string and /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, line 42: type clash (string and eventlog::ElfrClearELFW)
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, line 42 and string: type mismatch (eventlog::ElfrClearELFW and string)
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, lines 43-44: inconsistent type in set constructor (set(eventlog::ElfrClearELFW, eventlog::ElfrClearELFA, IEventService::EvtRpcClearLog))
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, lines 43-44: type clash in assignment (BZAR::t1070_001_rpc_strings = set(eventlog::ElfrClearELFW, eventlog::ElfrClearELFA, IEventService::EvtRpcClearLog))
error in string and /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, line 62: type clash (string and svcctl::CreateServiceWOW64W)
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, line 62 and string: type mismatch (svcctl::CreateServiceWOW64W and string)
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, lines 66-67: inconsistent type in set constructor (set(svcctl::CreateServiceWOW64W, svcctl::CreateServiceWOW64A, svcctl::CreateServiceW, svcctl::CreateServiceA, svcctl::StartServiceW, svcctl::StartServiceA))
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, lines 66-67: type clash in assignment (BZAR::t1569_002_rpc_strings = set(svcctl::CreateServiceWOW64W, svcctl::CreateServiceWOW64A, svcctl::CreateServiceW, svcctl::CreateServiceA, svcctl::StartServiceW, svcctl::StartServiceA))
error in string and /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, line 73: type clash (string and IWbemServices::ExecMethod)
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, line 73 and string: type mismatch (IWbemServices::ExecMethod and string)
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, lines 73-74: inconsistent type in set constructor (set(IWbemServices::ExecMethod, IWbemServices::ExecMethodAsync))
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, lines 73-74: type clash in assignment (BZAR::t1047_rpc_strings = set(IWbemServices::ExecMethod, IWbemServices::ExecMethodAsync))
error in string and /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, line 80: type clash (string and atsvc::JobAdd)
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, line 80 and string: type mismatch (atsvc::JobAdd and string)
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, line 80: inconsistent type in set constructor (set(atsvc::JobAdd))
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, line 80: type clash in assignment (BZAR::t1053_002_rpc_strings = set(atsvc::JobAdd))
error in string and /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, line 86: type clash (string and ITaskSchedulerService::SchRpcRegisterTask)
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, line 86 and string: type mismatch (ITaskSchedulerService::SchRpcRegisterTask and string)
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, lines 87-88: inconsistent type in set constructor (set(ITaskSchedulerService::SchRpcRegisterTask, ITaskSchedulerService::SchRpcRun, ITaskSchedulerService::SchRpcEnableTask))
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, lines 87-88: type clash in assignment (BZAR::t1053_005_rpc_strings = set(ITaskSchedulerService::SchRpcRegisterTask, ITaskSchedulerService::SchRpcRun, ITaskSchedulerService::SchRpcEnableTask))
error in string and /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, line 103: type clash (string and winreg::BaseInitiateSystemShutdown)
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, line 103 and string: type mismatch (winreg::BaseInitiateSystemShutdown and string)
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, lines 108-109: inconsistent type in set constructor (set(winreg::BaseInitiateSystemShutdown, winreg::BaseInitiateSystemShutdownEx, InitShutdown::BaseInitiateShutdown, InitShutdown::BaseInitiateShutdownEx, WindowsShutdown::WsdrInitiateShutdown, winstation_rpc::RpcWinStationShutdownSystem, samr::SamrShutdownSamServer))
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, lines 108-109: type clash in assignment (BZAR::t1529_rpc_strings = set(winreg::BaseInitiateSystemShutdown, winreg::BaseInitiateSystemShutdownEx, InitShutdown::BaseInitiateShutdown, InitShutdown::BaseInitiateShutdownEx, WindowsShutdown::WsdrInitiateShutdown, winstation_rpc::RpcWinStationShutdownSystem, samr::SamrShutdownSamServer))
error in string and /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, line 125: type clash (string and ISecLogon::SeclCreateProcessWithLogonW)
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, line 125 and string: type mismatch (ISecLogon::SeclCreateProcessWithLogonW and string)
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, lines 125-126: inconsistent type in set constructor (set(ISecLogon::SeclCreateProcessWithLogonW, ISecLogon::SeclCreateProcessWithLogonExW))
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, lines 125-126: type clash in assignment (BZAR::t1547_004_rpc_strings = set(ISecLogon::SeclCreateProcessWithLogonW, ISecLogon::SeclCreateProcessWithLogonExW))
error in string and /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, line 132: type clash (string and spoolss::RpcAddMonitor)
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, line 132 and string: type mismatch (spoolss::RpcAddMonitor and string)
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, lines 134-135: inconsistent type in set constructor (set(spoolss::RpcAddMonitor, spoolss::RpcAddPrintProcessor, IRemoteWinspool::RpcAsyncAddMonitor, IRemoteWinspool::RpcAsyncAddPrintProcessor))
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, lines 134-135: type clash in assignment (BZAR::t1547_010_rpc_strings = set(spoolss::RpcAddMonitor, spoolss::RpcAddPrintProcessor, IRemoteWinspool::RpcAsyncAddMonitor, IRemoteWinspool::RpcAsyncAddPrintProcessor))
error in string and /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, line 159: type clash (string and srvsvc::NetrServerTransportEnum)
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, line 159 and string: type mismatch (srvsvc::NetrServerTransportEnum and string)
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, lines 159-160: inconsistent type in set constructor (set(srvsvc::NetrServerTransportEnum, wkssvc::NetrWkstaTransportEnum))
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, lines 159-160: type clash in assignment (BZAR::t1016_rpc_strings = set(srvsvc::NetrServerTransportEnum, wkssvc::NetrWkstaTransportEnum))
error in string and /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, line 166: type clash (string and srvsvc::NetrServerGetInfo)
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, line 166 and string: type mismatch (srvsvc::NetrServerGetInfo and string)
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, lines 167-168: inconsistent type in set constructor (set(srvsvc::NetrServerGetInfo, srvsvc::NetrServerAliasEnum, wkssvc::NetrWkstaGetInfo))
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, lines 167-168: type clash in assignment (BZAR::t1018_rpc_strings = set(srvsvc::NetrServerGetInfo, srvsvc::NetrServerAliasEnum, wkssvc::NetrWkstaGetInfo))
error in string and /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, line 174: type clash (string and lsarpc::LsarGetUserName)
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, line 174 and string: type mismatch (lsarpc::LsarGetUserName and string)
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, lines 185-186: inconsistent type in set constructor (set(lsarpc::LsarGetUserName, lsarpc::LsarEnumerateTrustedDomainsEx, lsarpc::LsarGetSystemAccessAccount, lsarpc::LsarQueryDomainInformationPolicy, lsarpc::LsarQueryInfoTrustedDomain, samr::SamrEnumerateGroupsInDomain, samr::SamrEnumerateDomainsInSamServer, samr::SamrQueryInformationDomain, samr::SamrQueryInformationDomain2, samr::SamrQueryInformationGroup))
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, lines 185-186: type clash in assignment (BZAR::t1033_rpc_strings = set(lsarpc::LsarGetUserName, lsarpc::LsarEnumerateTrustedDomainsEx, lsarpc::LsarGetSystemAccessAccount, lsarpc::LsarQueryDomainInformationPolicy, lsarpc::LsarQueryInfoTrustedDomain, samr::SamrEnumerateGroupsInDomain, samr::SamrEnumerateDomainsInSamServer, samr::SamrQueryInformationDomain, samr::SamrQueryInformationDomain2, samr::SamrQueryInformationGroup))
error in string and /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, line 192: type clash (string and srvsvc::NetrConnectionEnum)
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, line 192 and string: type mismatch (srvsvc::NetrConnectionEnum and string)
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, lines 192-193: inconsistent type in set constructor (set(srvsvc::NetrConnectionEnum, srvsvc::NetrSessionEnum))
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, lines 192-193: type clash in assignment (BZAR::t1049_rpc_strings = set(srvsvc::NetrConnectionEnum, srvsvc::NetrSessionEnum))
error in string and /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, line 199: type clash (string and lsarpc::LsarEnumerateAccountRights)
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, line 199 and string: type mismatch (lsarpc::LsarEnumerateAccountRights and string)
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, lines 209-210: inconsistent type in set constructor (set(lsarpc::LsarEnumerateAccountRights, lsarpc::LsarEnumerateAccountsWithUserRight, lsarpc::LsarEnumeratePrivileges, lsarpc::LsarEnumeratePrivilegesAccount, lsarpc::LsarLookupPrivilegeValue, lsarpc::LsarLookupPrivilegeName, lsarpc::LsarLookupPrivilegeDisplayName, samr::SamrGetGroupsForUser, samr::SamrGetAliasMembership, samr::SamrGetMembersInAlias, samr::SamrGetMembersInGroup))
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, lines 209-210: type clash in assignment (BZAR::t1069_rpc_strings = set(lsarpc::LsarEnumerateAccountRights, lsarpc::LsarEnumerateAccountsWithUserRight, lsarpc::LsarEnumeratePrivileges, lsarpc::LsarEnumeratePrivilegesAccount, lsarpc::LsarLookupPrivilegeValue, lsarpc::LsarLookupPrivilegeName, lsarpc::LsarLookupPrivilegeDisplayName, samr::SamrGetGroupsForUser, samr::SamrGetAliasMembership, samr::SamrGetMembersInAlias, samr::SamrGetMembersInGroup))
error in string and /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, line 216: type clash (string and lsarpc::LsarQueryInformationPolicy)
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, line 216 and string: type mismatch (lsarpc::LsarQueryInformationPolicy and string)
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, lines 219-221: inconsistent type in set constructor (set(lsarpc::LsarQueryInformationPolicy, lsarpc::LsarQueryInformationPolicy2, lsarpc::LsarQueryTrustedDomainInfo, lsarpc::LsarQueryTrustedDomainInfoByName, samr::SamrGetUserDomainPasswordInformation))
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, lines 219-221: type clash in assignment (BZAR::t1082_rpc_strings = set(lsarpc::LsarQueryInformationPolicy, lsarpc::LsarQueryInformationPolicy2, lsarpc::LsarQueryTrustedDomainInfo, lsarpc::LsarQueryTrustedDomainInfoByName, samr::SamrGetUserDomainPasswordInformation))
error in string and /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, line 227: type clash (string and srvsvc::NetrFileEnum)
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, line 227 and string: type mismatch (srvsvc::NetrFileEnum and string)
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, line 227: inconsistent type in set constructor (set(srvsvc::NetrFileEnum))
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, line 227: type clash in assignment (BZAR::t1083_rpc_strings = set(srvsvc::NetrFileEnum))
error in string and /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, line 233: type clash (string and lsarpc::LsarEnumerateAccounts)
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, line 233 and string: type mismatch (lsarpc::LsarEnumerateAccounts and string)
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, lines 252-254: inconsistent type in set constructor (set(lsarpc::LsarEnumerateAccounts, lsarpc::LsarLookupNames, lsarpc::LsarLookupNames2, lsarpc::LsarLookupNames3, lsarpc::LsarLookupNames4, lsarpc::LsarLookupSids, lsarpc::LsarLookupSids2, lsarpc::LsarLookupSids3, samr::SamrEnumerateAliasesInDomain, samr::SamrEnumerateUsersInDomain, samr::SamrLookupNamesInDomain, samr::SamrLookupIdsInDomain, samr::SamrLookupDomainInSamServer, samr::SamrQueryDisplayInformation, samr::SamrQueryDisplayInformation2, samr::SamrQueryDisplayInformation3, samr::SamrQueryInformationAlias, samr::SamrQueryInformationUser, samr::SamrQueryInformationUser2, wkssvc::NetrWkstaUserEnum))
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, lines 252-254: type clash in assignment (BZAR::t1087_rpc_strings = set(lsarpc::LsarEnumerateAccounts, lsarpc::LsarLookupNames, lsarpc::LsarLookupNames2, lsarpc::LsarLookupNames3, lsarpc::LsarLookupNames4, lsarpc::LsarLookupSids, lsarpc::LsarLookupSids2, lsarpc::LsarLookupSids3, samr::SamrEnumerateAliasesInDomain, samr::SamrEnumerateUsersInDomain, samr::SamrLookupNamesInDomain, samr::SamrLookupIdsInDomain, samr::SamrLookupDomainInSamServer, samr::SamrQueryDisplayInformation, samr::SamrQueryDisplayInformation2, samr::SamrQueryDisplayInformation3, samr::SamrQueryInformationAlias, samr::SamrQueryInformationUser, samr::SamrQueryInformationUser2, wkssvc::NetrWkstaUserEnum))
error in string and /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, line 260: type clash (string and srvsvc::NetrRemoteTOD)
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, line 260 and string: type mismatch (srvsvc::NetrRemoteTOD and string)
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, line 260: inconsistent type in set constructor (set(srvsvc::NetrRemoteTOD))
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, line 260: type clash in assignment (BZAR::t1124_rpc_strings = set(srvsvc::NetrRemoteTOD))
error in string and /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, line 266: type clash (string and srvsvc::NetrShareEnum)
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, line 266 and string: type mismatch (srvsvc::NetrShareEnum and string)
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, lines 266-267: inconsistent type in set constructor (set(srvsvc::NetrShareEnum, srvsvc::NetrShareGetInfo))
error in /home/kali/Tools/ics-zeek/bzar/scripts/./bzar_dce-rpc_consts.zeek, lines 266-267: type clash in assignment (BZAR::t1135_rpc_strings = set(srvsvc::NetrShareEnum, srvsvc::NetrShareGetInfo))