splunk/attack_range

Build Error on Local Installation

Closed this issue · 1 comments

Im trying to run the attack range on a Local Machine (Ubuntu 22.04) and im getting this error when i build for the first time and subsequent times:

`2023-10-21 23:45:15,839 - INFO - attack_range - [action] > build

Bringing machine 'ar-splunk-attack-range-key-pair-ar' up with 'virtualbox' provider...
Bringing machine 'ar-win-attack-range-key-pair-ar-0' up with 'virtualbox' provider...
==> ar-splunk-attack-range-key-pair-ar: Importing base box 'generic/ubuntu2004'...
==> ar-splunk-attack-range-key-pair-ar: Matching MAC address for NAT networking...
==> ar-splunk-attack-range-key-pair-ar: Checking if box 'generic/ubuntu2004' version '4.3.2' is up to date...
==> ar-splunk-attack-range-key-pair-ar: Setting the name of the VM: ar-splunk
==> ar-splunk-attack-range-key-pair-ar: Clearing any previously set network interfaces...
==> ar-splunk-attack-range-key-pair-ar: Preparing network interfaces based on configuration...
    ar-splunk-attack-range-key-pair-ar: Adapter 1: nat
    ar-splunk-attack-range-key-pair-ar: Adapter 2: hostonly
==> ar-splunk-attack-range-key-pair-ar: Forwarding ports...
    ar-splunk-attack-range-key-pair-ar: 8000 (guest) => 8000 (host) (adapter 1)
    ar-splunk-attack-range-key-pair-ar: 8089 (guest) => 8089 (host) (adapter 1)
    ar-splunk-attack-range-key-pair-ar: 8080 (guest) => 8080 (host) (adapter 1)
    ar-splunk-attack-range-key-pair-ar: 22 (guest) => 2222 (host) (adapter 1)
==> ar-splunk-attack-range-key-pair-ar: Running 'pre-boot' VM customizations...
==> ar-splunk-attack-range-key-pair-ar: Booting VM...
**There was an error while executing `VBoxManage`, a CLI used by Vagrant
for controlling VirtualBox. The command and stderr is shown below.

Command: ["startvm", "1204ba7b-a89f-4613-807e-d1f661e85949", "--type", "gui"]

Stderr: VBoxManage: error: The machine 'ar-splunk' is already locked by a session (or being locked or unlocked)
VBoxManage: error: Details: code VBOX_E_INVALID_OBJECT_STATE (0x80bb0007), component MachineWrap, interface IMachine, callee nsISupports
VBoxManage: error: Context: "LaunchVMProcess(a->session, sessionType.raw(), ComSafeArrayAsInParam(aBstrEnv), progress.asOutParam())" at line 726 of file VBoxManageMisc.cpp**

2023-10-21 23:46:05,750 - ERROR - attack_range - vagrant failed to build`

I already tried to clean the VM from Virtual Box and didn't work. Im just trying to build one Windows machine with no Splunk SOAR.

if you're facing a situation where your VirtualBox VMs are getting into a locked state during the build process of the attack range, preventing them from being deleted or unregistered.

  1. Identify the VM UUID:

    • Run VBoxManage list vms to find the UUID of the locked VM.
  2. Emergency Stop the VM:

    • Execute VBoxManage startvm {vm-uuid} --type emergencystop with the correct VM UUID.
  3. Unregister and Delete the VM:

    • Use VBoxManage unregistervm --delete {vm-uuid} to remove the unlocked VM.
  4. Or Unregister the VM:

    • If the VM files are deleted, unregister with VBoxManage unregistervm {vm-uuid}.