Title
#extensions
Pensamento Profundo

Pensamento Profundo

07/30/2021, 5:54 AM
Hi fellows, when I run my extension without Administrator privileges I get this error, which I expect, cos' the pipe was opened by an elevated process:
Unable to connect to \\.\pipe\osquery.em with uds_windows::UnixStream: Os { code: 10013, kind: PermissionDenied, message: "An attempt was made to access a socket in a way forbidden by its access permissions." }
But when I execute with Admin user or as the user guide explains to manually load an extension it cannot connect to the socket with this error:
Unable to connect to \\.\pipe\osquery.em with uds_windows::UnixStream: Os { code: 10061, kind: ConnectionRefused, message: "No connection could be made because the target machine actively refused it." }
I just checked the flags to include the path and name of the socket and enable the extension loading:
--extensions_socket=\\.\pipe\osquery.em
--disable_extensions=false
I compiled the extension, moved it to the installed folder of osquery (
c:\Programs Files\osquery
) as
myshinny.ext.exe
and executed like this without success:
.\osqueryi.exe --allow-unsafe --extension myshinny.ext.exe
Then I tried to create a Extension folder, move the extensions inside it and apply the
icacls.exe
commands listed on the osquery's extension guide but again with no success. I'm trying to update the (https://github.com/zacbrown/osquery-rs) to support windows through (https://github.com/haraldh/rust_uds_windows/)
6:07 AM
Unable to connect to \\.\pipe\shell.em with uds_windows::UnixStream: Os { code: 10061, kind: ConnectionRefused, message: "No connection could be made because the target machine actively refused it." }
Mike Myers

Mike Myers

07/30/2021, 5:38 PM
5:39 PM
although
--allow-unsafe
ought to have bypassed that problem and apparently it did not
5:40 PM
Does the example extension work?
Pensamento Profundo

Pensamento Profundo

07/30/2021, 7:11 PM
the example extension on the osquery-rs repo?
7:14 PM
they are built to work on unix like system's
Mike Myers

Mike Myers

07/30/2021, 9:01 PM
Oh, I meant checking that the example extension in the osquery core repo would load correctly as a sanity test, but I suppose there are several. https://github.com/osquery/osquery/tree/master/external/examples
9:03 PM
the osquery extensions SDK changed since 3 years ago when it looks like zacbrown/osquery-rs was written, perhaps that is it
Pensamento Profundo

Pensamento Profundo

07/30/2021, 9:09 PM
So the SDK in Windows uses the socket/pipe internally to communicate with osquery? I'll try to build those examples and investigate further, thanks for your time @Mike Myers
Mike Myers

Mike Myers

07/30/2021, 9:14 PM
building osquery from source should build the example extensions automatically (I think)
9:14 PM
in Windows, Thrift is implemented as a Named Pipe, whereas on POSIX it's a Unix Domain Socket yes
9:20 PM
Ah, but
Unable to connect to \\.\pipe\osquery.em with uds_windows::UnixStream: Os { code: 10061, kind: ConnectionRefused, message: "No connection could be made because the target machine actively refused it." }
implies that the Rust code is trying to use a Unix Domain Socket abstraction instead of a Named Pipe
Pensamento Profundo

Pensamento Profundo

07/30/2021, 9:20 PM
the uds_windows is a lib to open a af_linux socket in windows (since it got support in 2017), I dont think this gonna work in this case, do you? I don't have deep understand about those 2, but I think the communication differs between each other, what you think?
Mike Myers

Mike Myers

07/30/2021, 9:21 PM
I don't think it's the right thing in this case. Is the Rust
thrift
crate trying to use that?
Pensamento Profundo

Pensamento Profundo

07/30/2021, 9:21 PM
No
9:22 PM
Zac created a custom server to connect to the socket via UnixSocket
9:22 PM
But leave the Windows part unimplemented
Mike Myers

Mike Myers

07/30/2021, 9:22 PM
A Windows named pipe has its own API. Here I'll find the osquery code that has the conditional stuff for Windows Thrift connections
9:24 PM
oh, osquery just uses Thrift classes like
TPipeServer
, but Thrift itself handles the underlying Windows API
CreateNamedPipeA
9:29 PM
Giving the Thrift rust crate a look, I am not sure they made a wrapper for
TPipeServer
here, only
TServer
Pensamento Profundo

Pensamento Profundo

07/30/2021, 9:32 PM
9:32 PM
that's why he created the custom LocalServer
Mike Myers

Mike Myers

07/30/2021, 9:33 PM
I see. At least on the osquery side, the code is using the Thrift cpp library where
TPipeServer
exists and that's what it uses on Windows
9:39 PM
Maybe one day the project can use this https://github.com/apache/thrift/pull/2327
9:41 PM
Ah yea, confirmed: Rust doesn't have the Pipe implemented https://github.com/apache/thrift/blob/master/LANGUAGES.md
Pensamento Profundo

Pensamento Profundo

07/30/2021, 9:43 PM
Fantastic mate, thanks again. You cover all the points. So in this point in time I cannot go further with this implementation.