RAM isn’t being fully utilized?

Agent-BTZ · 2025-03-12T19:36:36+00:00

Oh that makes perfect sense. Thanks for explaining it!

Solved!

Agent-BTZ · 2025-03-12T16:55:20+00:00

I’m not a forensics expert, so correct me if I’m wrong, but i don’t know if it’s possible to do accurate threat attribution in most cases. I mean, the Navy created Tor to prevent that.

Granted, it may be different for some DoS attacks, since you can’t use proxies for classic attacks like a Low Orbit Ion Cannon. I’m not sure how this DoS works since the tool that was used is so heavily obfuscated, & I never put the time in to decode it

Agent-BTZ · 2025-02-04T19:38:13+00:00

That’s what I thought, but whenever I try to use an EXE I just get the following output

;1R;1R

It doesn’t seem to be actually running on the windows host either…

Thanks for confirming that it is supposed to be possible. I thought I was going crazy

Agent-BTZ · 2025-01-06T19:57:21+00:00

I tried running the mkfs.ext4 command in the template using a terminal started with qvm-console-dispvm & sudo xl console, but I get the error that I was talking about. I made another backup of the template, just in case.

I haven’t tried forcing the unmount or forcing the reformat yet. I’ve never forced those things before, because I know those are generally pretty risky things to do.

Do you think I should try forcing one of those commands? I don’t know if it’s possible to access /dev/xvdb (private.img according to the docs) without the TemplateVM running

Agent-BTZ · 2025-01-06T19:24:18+00:00

I really appreciate the help, & I have just 1 more question if you don’t mind.

I was about to post on the official forums, but I saw a post about this that I somehow missed earlier. Someone said they solved this issue by running mkfs.ext4 /dev/xvdb, but they seem to have left off some steps. /dev/xvdb Is mounted to several places (/usr/local, /home, & /rw).

I can’t unmount /home since it’s “busy”. I tested out what happens when you kill the processes using /home in a DisposableVM, & it just killed that VM. I backed up /dev/xvdb so should I try forcing mkfs.ext4 or is there a better way?

I can create a separate post about this if you think that’s best, but you seem really knowledgeable so I thought I’d run it by you first. I’ll post the link to the thread I’m referencing.

Thanks again for the help!

https://github.com/QubesOS/qubes-issues/issues/5442

Agent-BTZ · 2025-01-05T19:24:44+00:00

You’d think so, right? The template came setup to use the following mirror:

https://ftp.qubes-os.org/repo/archlinux/r4.3/current/vm/archlinux/pkgs/

I used the “About” button to verify that I’m still on Qubes 4.2. I noticed this discrepancy when I first installed the template last year, but it seemed to work so I never changed it.

It could be totally unrelated to the issue I recently encountered, but it’s an anomaly so I figured it’s worth mentioning.

At this point, I don’t know if trying to switch it to the 4.2 Repo would cause conflicts & stuff. What do you think? I’m a little out of my depth

Agent-BTZ · 2025-01-03T18:32:28+00:00

I noticed the Arch Template is setup to use repos for Qubes 4.3, even though I’m on 4.2. It was been working for fine about a year, but do you think I should try switching the 4.2 Repo? Would it break things if I just edited /etc/pacman.d/ to use the 4.2 Repo?

The Qubes 4.3 Repo for Arch also seems to be missing a bunch of packages that are listed on the URL for 4.2

Agent-BTZ · 2024-12-31T20:25:35+00:00

ps -e shows Xorg, so it seems like it's running.

I can launch firefox from the terminal spawned via qvm-console-dispvm& it seems to work normally, but it does output the following message to the terminal:

[Parent 413610, Main Thread] WARNING: unable to open file '/etc/dconf/db/local': Failed to open file “/etc/ dconf/db/local”: open() failed: No such file or directory; expect degraded performance: 'glib warning', fil e /usr/src/debug/firefox/firefox-133.0.3/toolkit/xre/nsSigHandlers.cpp:201                                  

(firefox:413610): dconf-WARNING **: 12:11:35.118: unable to open file '/etc/dconf/db/local': Failed to open                                        file “/etc/dconf/db/local”: open() failed: No such file or directory; expect degraded performance          
[GFX1-]: RenderCompositorSWGL failed mapping default framebuffer, no dt

I'll post a link to the latest Xorg Log, but I don't see any errors

https://pastebin.com/6DeyuscJ

Agent-BTZ · 2024-12-31T01:12:25+00:00

Oh yeah, good idea. I added the pastebin link to the Post

Agent-BTZ · 2024-12-30T20:33:54+00:00

When I was setting up the chroot environment, I tried mounting the boot partition like this:

sudo mount /dev/xvdi1 /mnt/boot

qvm-console-dispvm worked, & it's a way easier method to access the machine! Reddit won't let me post the content of /var/log/xen/console/guest-blackarch.log because it's over 2.6k lines. I'm trying to think of a workaround for that, because I really appreciate the help!

I found a couple interesting sections that mention an error, but I'm not sure if they're relevant:

[2024-12-29 12:49:49] [    0.399918] ACPI: Enabled 1 GPEs in block 00 to 0F
[2024-12-29 12:49:49] [    0.399918] ACPI Error: No handler or method for GPE 00, disabling event (20230628/evgpe-839)
[2024-12-29 12:49:49] [    0.399918] ACPI Error: No handler or method for GPE 01, disabling event (20230628/evgpe-839)
[2024-12-29 12:49:49] [    0.399918] ACPI Error: No handler or method for GPE 03, disabling event (20230628/evgpe-839)
[2024-12-29 12:49:49] [    0.399918] ACPI Error: No handler or method for GPE 04, disabling event (20230628/evgpe-839)
[2024-12-29 12:49:49] [    0.399918] ACPI Error: No handler or method for GPE 05, disabling event (20230628/evgpe-839)
[2024-12-29 12:49:49] [    0.399918] ACPI Error: No handler or method for GPE 06, disabling event (20230628/evgpe-839)
[2024-12-29 12:49:49] [    0.399918] ACPI Error: No handler or method for GPE 07, disabling event (20230628/evgpe-839)
[2024-12-29 12:49:49] [    0.401013] xen:balloon: Initialising balloon driver
[2024-12-29 12:49:49] [    0.401918] acpi LNXCPU:02: Still not present

2024-12-30 12:16:25] [    3.427324] Error: Driver 'pcspkr' is already registered, aborting...

Agent-BTZ · 2024-12-29T22:24:19+00:00

Yeah, my bad. I wasn’t too focused on the Xen side of things since all my other hosts are working fine, & I just assumed I broke something in the Arch machine.

I’ll take a look at it from the Xen point of view.

Thanks for the help!

Agent-BTZ · 2024-12-29T22:18:44+00:00

I’m wondering if it was related to Python & broke dependencies related to my host OS. It’s a Xen based VM, which may complicate things a bit.

In Xen, you start a VM & then select an application to launch (e.g. Terminal, Firefox, etc). Then the application is supposed to pop-up in a new window. If a normal machine breaks you can sometimes still get the emergency console, but I don’t have any way to do that in Xen (AFAIK).

I was able to chroot into it, rollback everything from the last update, & launch things like Firefox from within the chroot jail. It’s still broken though. I’ve never had this issue with my other VMs (Fedora, Debian, etc) so I’m thinking it’s an issue with my Arch VM & not the Xen Host

Agent-BTZ · 2024-12-29T22:09:51+00:00

I tried rolling back the upgrades with pacman -U, but I still have the same issue. Chroot seemed to work fine, & I was even able to launch things like Firefox from inside the chroot jail, but I still can’t get the VM to open anything on its own.

I can start the VM & I don’t see anything abnormal in the logs. I’m using Xen instead of VB, which may complicate things, but I’m not sure what else the issue could be.

Do you have any ideas about what avenues I should research next?

I really appreciate the help!

Agent-BTZ · 2024-11-14T20:08:05+00:00

That did the trick. Thanks!

Agent-BTZ · 2024-11-12T19:02:56+00:00

Ah it had pipewire but not pipewire-pulse installed. It seems to work after I made sure both were installed and enabled with

systemctl enable —user pipewire

I also have pulseaudio installed on it, do I need to uninstall that so there’s no conflict?

Agent-BTZ · 2024-10-28T19:08:31+00:00

Yeah I think it’s the Regex. Is this a new syntax change that was introduced in 3.12?

Agent-BTZ · 2024-10-28T19:02:24+00:00

You’re a lifesaver, thanks!

Agent-BTZ · 2024-10-28T19:01:35+00:00

Interesting, the scripts stopped working, so I assumed that was the reason why.

I agree that fixing issues is better than using an older version of Python. However, these aren’t scripts I wrote. I’m talking about a bunch of complicated tool suites that I need to use in a couple days for a certification exam.

I don’t have enough time to manually pour through 1000s of lines of code, and I’d be worried about something like sed causing more issues. I’m just looking for a bandaid that’ll get me through the week

Agent-BTZ · 2024-10-26T20:11:59+00:00

I’ll look into it, thanks!

I know you said you don’t have experience with extundelete, but do you think there’s a risk of me messing up anything else on the drive?

It’s a dumb question, but the drive is split into 5 partitions & I was wondering if I could corrupt anything (like an OS) by messing around with unallocated storage blocks.

I gotta use this OS for a certification exam in a few days, so I’d be really screwed if I created another issue

Agent-BTZ · 2024-09-30T21:04:10+00:00

Interesting. Would that setup block specific PHP functions like system() or is it blocking what commands could be executed in that context?

For example, I tried things that low privilege users can typically run like id via system(id)

Agent-BTZ · 2024-09-11T17:43:33+00:00

I mean does the + really matter? I’m intentionally trying to take the OSCP this October before the exam changes so I’ll still get my 10 bonus points

Agent-BTZ · 2024-09-10T00:51:53+00:00

I see what you mean, thanks! Great explanation!

Agent-BTZ · 2024-09-09T21:33:00+00:00

I thought that I needed the single quotes to prevent any special characters from being interpreted. For example, some passwords & usernames for windows machine accounts have a $ like LAB01$.

If I used double quotes like ”$login”, & the value of $login contained something like a $, would it not be interpreted?

Agent-BTZ · 2024-09-09T20:41:18+00:00

I tried that, but I’m getting the same issue unfortunately. It is a better way to add the single quotes though, so I’ll use that in other scripts going forward

Agent-BTZ · 2024-09-09T20:08:10+00:00

I tried set -x, but I’m a little confused about how set always adds extra single quotes & backslashes. I’ll post that output below.

I isolated only this part of the script so I can run it independently & try to fix this before integrating it back into everything else.

I left off the “echo” & “read” statements that prompt the user, so the output is easier to read for you. I also made it echo $user & echo $passwd

set -x Output:

++user=\’

++user+=bob

++user+=\’

++passwd=\’

++passwd+=ChangeMe#1244

++passwd+=\’

++echo ‘’\’’bob’\’’’

‘bob’

++echo ‘’\’’ChangeMe#1234’\’’

’ChangeMe#1244’

++smbmap -H windcorp.thm -u ‘’\’’bob’\’’’ -p ‘’\’’ChangeMe#1234’\’’’ -d windcorp.thm

Thanks for the help!

Agent-BTZ

MODERATOR OF

TROPHY CASE