SnaffCon/Snaffler

UltraSnaffler Dependencies

cmprmsd opened this issue · 6 comments

cmprmsd commented

Heyhey!

I updated since a while and now see that UltraSnaffler is not working any more 😢

From what I see your added a local dependency AlphaFS from your local Group3r repo:
20cbe33

I tried cloning and compiling grouper in the same folder level where Snaffler is located, but it does not work.
Compilation errors in Group3r:
image

So I installed AlphaFS from Nuget (2.2.6) for Snaffler and UltraSnaffler in the UltrtaSnaffler solution and am left with the error on the bottom of this image:
image

Note. Snaffler itself compiles fine :)

Edit:
I just had a more in depth look and it seems UltraSnaffler does not like the new way of checking permissions.
I removed all RwStatus related stuff and it compiles. Of course now it does lack all permission checks. 😅

l0ss commented

yeah i'm pretty sure that's what i did in snaffler itself too. I'm working on a better way inside group3r but i'm not sure when i'll bring it over to snaffler. AlphaFS should have been removed as it's no longer used by snaffler.

cmprmsd commented

Heyho,

Not sure how to pull request this, without messing up the project (Visual Studio is a bitch)

Got the newrules branch working with UltraSnaffler by doing the following changes. I only tested it locally at this moment. Have to check on network shares.

  • Remove all content from EffectiveAccess.cs in UltraSnaffler solution and insert the following:
namespace SnaffCore.Classifiers.EffectiveAccess
{
    public class RwStatus
    {
        public bool CanRead { get; set; }
        public bool CanWrite { get; set; }
        public bool CanModify { get; set; }
    }

}
  • Remove the AlphaFS entry in References
  • Remove the missing .cs files

Edit: yup, just checked. Permission checking is broken 🤷‍♂️. Everything is an R :D

cmprmsd commented

For the new toml files of course a relay target for content search has to be added:

[[ClassifierRules]]
EnumerationScope = "FileEnumeration"
RuleName = "OfficeContentByExt"
MatchAction = "Relay"
RelayTargets = ["KeepOfficeRegexRed"]
Description = "Files with these extensions will be searched for sensitive strings."
MatchLocation = "FileExtension"
WordListType = "Exact"
MatchLength = 0
WordList = ["\\.xls", "\\.xlt", "\\.xlsx", "\\.xlst", "\\.doc", "\\.docx", "\\.dotx", "\\.rtf", "\\.eml", "\\.msg", "\\.pdf", "\\.accdb"]
Triage = "Green"

with some very important strings that you want to find in your KeepOfficeRegexRed toml file :)

l0ss commented

Permission checking is 'known broken', but it's not really a problem for 99% of use cases. I've been pretty busy with work but should have some time to look at this late next week.

  • 👍1
l0ss commented

fixed up ultrasnaffler to work with the newrules stuff.

  • 🎉1
l0ss commented

I'm going to open a separate issue for the permission checking issue and close this one. please reopen if ultrasnaffler still won't build for you.

  • 👍1