log2timeline/plaso

Empty username causes TypeError: unsupported format string passed to NoneType.__format__ in debug log statement

Melantrix opened this issue · 5 comments

Describe the problem:

There is an logger.debug command within the function AddUserAccount() in the file https://github.com/log2timeline/plaso/blob/main/plaso/preprocessors/mediator.py. This logger.debug command tries to print user_account.username. However, when the username is empty (e.g. when it's a Entra ID user and only a SID is known on the local system) the preprocessing fails, because the logger receives a TypeError because it's None.

There are a few checks in the class WindowsUserAccountsPlugin() in the file https://github.com/log2timeline/plaso/blob/main/plaso/preprocessors/windows.py which calls AddUserAccount(), but there aren't any in AddUserAccount().

It's fixable by commenting out the logger.debug command, however i think it would be better to add some checks/safeguards in the function.

To Reproduce:

The version of Plaso you used: 20240308

The operating system you are running Plaso on (Not the operating system of the image/files you're trying to analyze):
In docker on Ubuntu 22.04.4 LTS

Steps to reproduce the behavior including command line and arguments and output:

log2timeline.py --workers 30 --storage_file timeline.plaso diskimage.img

Please provide the source data you used when you experienced the problem. For publicly available data please provide a URL or path of the source data.
this is not possible because of an active investigation

The method you used to install Plaso:
I pulled the docker image and ran the command within the docker with
docker run -t -i --entrypoint=/bin/bash -v /home/investigation:/data log2timeline/plaso

Expected behavior:
I would expect log2timeline to continue instead of hard failing.

Debug output/tracebacks:

You can run log2timeline tools with "-d" to generate debug output, and include anything relevant. Also see: [Producing debug logs][https://plaso.readthedocs.io/en/latest/sources/Troubleshooting.html#producing-debug-logs]

Processing started.
Traceback (most recent call last):
  File "/usr/bin/log2timeline.py", line 33, in <module>
    sys.exit(load_entry_point('plaso==20240308', 'console_scripts', 'log2timeline')())
  File "/usr/lib/python3/dist-packages/plaso/scripts/log2timeline.py", line 81, in Main
    tool.ExtractEventsFromSources()
  File "/usr/lib/python3/dist-packages/plaso/cli/extraction_tool.py", line 754, in ExtractEventsFromSources
    processing_status = self._ProcessSource(session, storage_writer)
  File "/usr/lib/python3/dist-packages/plaso/cli/extraction_tool.py", line 446, in _ProcessSource
    system_configurations = extraction_engine.PreprocessSource(
  File "/usr/lib/python3/dist-packages/plaso/engine/engine.py", line 345, in PreprocessSource
    preprocess_manager.PreprocessPluginsManager.RunPlugins(
  File "/usr/lib/python3/dist-packages/plaso/preprocessors/manager.py", line 351, in RunPlugins
    cls.CollectFromWindowsRegistry(artifacts_registry, mediator, searcher)
  File "/usr/lib/python3/dist-packages/plaso/preprocessors/manager.py", line 224, in CollectFromWindowsRegistry
    preprocess_plugin.Collect(mediator, artifact_definition, searcher)
  File "/usr/lib/python3/dist-packages/plaso/preprocessors/interface.py", line 264, in Collect
    self._ParseKey(mediator, registry_key, value_name)
  File "/usr/lib/python3/dist-packages/plaso/preprocessors/windows.py", line 916, in _ParseKey
    mediator.AddUserAccount(user_account)
  File "/usr/lib/python3/dist-packages/plaso/preprocessors/mediator.py", line 115, in AddUserAccount
    logger.debug(f'adding user account: {user_account.username:s}')
TypeError: unsupported format string passed to NoneType.__format__

Please DO NOT provide screenshots, they can be hard to read.

For more information see the [troubleshooting guide][https://plaso.readthedocs.io/en/latest/sources/Troubleshooting.html]

Additional context

Any other context about the problem here.

@Melantrix any indication to why the username is None?

@joachimmetz I think it's because it's an Azure Entra ID registrated device, which means the user information is stored in Entra ID. Apparently the registry key's only contain the SID's, and username is empty.

The username is derived from the ProfileImagePath (see: https://github.com/log2timeline/plaso/blob/main/plaso/preprocessors/windows.py#L905)

that would imply this "Azure Entra" useraccount also has no profile directory? Is this some kind of non-interactive useraccount?

If you can give #4892 a try

@Melantrix could you pass me the value of profile path for this user, this might be something with the username extraction not supporting the path value?