Pensamento Profundo
07/30/2021, 5:54 AMUnable to connect to \\.\pipe\osquery.em with uds_windows::UnixStream: Os { code: 10013, kind: PermissionDenied, message: "An attempt was made to access a socket in a way forbidden by its access permissions." }
But when I execute with Admin user or as the user guide explains to manually load an extension it cannot connect to the socket with this error:
Unable to connect to \\.\pipe\osquery.em with uds_windows::UnixStream: Os { code: 10061, kind: ConnectionRefused, message: "No connection could be made because the target machine actively refused it." }
I just checked the flags to include the path and name of the socket and enable the extension loading:
--extensions_socket=\\.\pipe\osquery.em
--disable_extensions=false
I compiled the extension, moved it to the installed folder of osquery (c:\Programs Files\osquery
) as myshinny.ext.exe
and executed like this without success:
.\osqueryi.exe --allow-unsafe --extension myshinny.ext.exe
Then I tried to create a Extension folder, move the extensions inside it and apply the icacls.exe
commands listed on the osquery's extension guide but again with no success.
I'm trying to update the (https://github.com/zacbrown/osquery-rs) to support windows through (https://github.com/haraldh/rust_uds_windows/)Unable to connect to \\.\pipe\shell.em with uds_windows::UnixStream: Os { code: 10061, kind: ConnectionRefused, message: "No connection could be made because the target machine actively refused it." }
Mike Myers
07/30/2021, 5:38 PM--allow-unsafe
ought to have bypassed that problem and apparently it did notPensamento Profundo
07/30/2021, 7:11 PMMike Myers
07/30/2021, 9:01 PMPensamento Profundo
07/30/2021, 9:09 PMMike Myers
07/30/2021, 9:14 PMUnable to connect to \\.\pipe\osquery.em with uds_windows::UnixStream: Os { code: 10061, kind: ConnectionRefused, message: "No connection could be made because the target machine actively refused it." }
implies that the Rust code is trying to use a Unix Domain Socket abstraction instead of a Named PipePensamento Profundo
07/30/2021, 9:20 PMMike Myers
07/30/2021, 9:21 PMthrift
crate trying to use that?Pensamento Profundo
07/30/2021, 9:21 PMMike Myers
07/30/2021, 9:22 PMTPipeServer
, but Thrift itself handles the underlying Windows API CreateNamedPipeA
TPipeServer
here, only TServer
Pensamento Profundo
07/30/2021, 9:32 PMMike Myers
07/30/2021, 9:33 PMTPipeServer
exists and that's what it uses on WindowsPensamento Profundo
07/30/2021, 9:43 PM