Posh-service not finding Yaml module about poshc2

[nickkilla]

Saw same issue in closed, will try solution there.

[nickkilla]

nickkilla@box:~$ sudo posh
Traceback (most recent call last):
File "start.py", line 8, in
run()
File "/opt/PoshC2/poshc2/init.py", line 10, in run
client.start()
File "/opt/PoshC2/poshc2/client/init.py", line 5, in start
from poshc2.client.command_handlers.ImplantHandler import main
File "/opt/PoshC2/poshc2/client/command_handlers/ImplantHandler.py", line 5, in
from poshc2.server.DB import update_item, get_c2server_all, get_implants_all, get_tasks, get_implantdetails, new_urldetails
File "/opt/PoshC2/poshc2/server/DB.py", line 4, in
from poshc2.server.Config import Database
File "/opt/PoshC2/poshc2/server/Config.py", line 1, in
import os, yaml
ModuleNotFoundError: No module named 'yaml'

[nickkilla]

So tried the steps in the other Yaml closed issue. I did the pip install requirements and redid the ./Install and still shows no yaml when trying to run posh lister

[nickkilla]

Not sure if this is the issue

Package libicu63 is not available, but is referred to by another package.
This may mean that the package is missing, has been obsoleted, or
is only available from another source

E: Package 'libicu63' has no installation candidate

[m3ldis]

I had the same issue (I didn't see the libicu63 problem). After running python3 -m pip install --force-reinstall -r requirements.txt it showed that PyYAML had been installed by distutils and couldn't be installed by pip. So I did apt remove PyYAML, re-ran the pip command, and updated posh. It worked for me. I am using the docker install.

Warning, if you see this in the next few hours, see my other issue regarding the kali docker build.

Edit: there's probably a better way to do this, i.e., tell pip or pipenv or whatever to use the system PyYAML, but this was the quickest fix.

[riskydissonance]

Thanks @clhefton. @nickkilla are you able to confirm if this fixed the issue?

Unfortunately we can't account for what's installed on the OS and if it clashes. You can try docker if it still doesn't work.

[m3ldis]

@m0rv4i this issue happens with the docker installation. I don't know about the normal one. I just re-tried the fix I mentioned and I'm not sure how it happened the first time, but it didn't work this time.

Different fix.

@nickkilla I did actually notice the libicu63 error but it doesn't affect anything. The root issue is actually with pipenv somehow not calling the right python, even though I only have one on my system. Maybe it was using some random version within the docker build and that version can't find anything installed with pip?

To get it to work, in /usr/bin/posh-server, change the following:

    python3 -m pipenv run python3 -u start.py --server 2>&1 | tee -a "$POSH_PROJECT_DIR/poshc2_server.log"

to:

    python3 -m /usr/bin/pipenv run python3 -u start.py --server 2>&1 | tee -a "$POSH_PROJECT_DIR/poshc2_server.log"

[nickkilla]

@clhefton The solution yesterday solved the issue.

[yg-ht]

I have hitting my head against this issue and trying to work through it and suddenly realised that I was running Install.sh as non-priv user with sudo... This sets up a Virtualenv for the low-priv user which means when you come to run the service as root it can't find the libraries.

It might be a good idea to stick a flag in Install.sh for "don't use sudo" or to change the venv creation process to cope. Off the top of my head though, I don't know how to do this...

(edited for grammar)

[riskydissonance]

I agree I think I need to investigate the sudo/pipenv behaviour, will add that to the shortlist

[riskydissonance]

@yg-ht i'm actually confused a little by your last comment, as if you're using a none-priv user and sudo to install the script then are you not using that same low privileged user to run PoshC2 (using sudo again)? If so it should be using the same environment. Either way it would be recommended to use the same technique for installing and running PoshC2.

Having done some testing across OSs and users, my observations are:

• Running install as sudo creates the virtual environment under /root
• Running posh- commands using sudo uses the same virtualenv and it works
• Running the posh- commands without sudo or as a different user doesn't work, as the virtual env is not set up for that user
  

Is that inline with what you're seeing?

[yg-ht]

Thanks for having a look.  I think the difference lies with the fact that I didn't curl and then pipe to bash.  I had the repo cloned locally and then "sudo ./Install.sh" which does not maintain the privs for the creation of the virtual env.  I believe the reason yours works is because you elevate the shell and then give it things to do, whilst my method elevates the script and not necessarily the actions it calls.  Hope that clarifies it.

…

On 04/05/2020 10:22, m0rv4i wrote: @yg-ht <https://github.com/yg-ht> i'm actually confused a little by your last comment, as if you're using a none-priv user and sudo to install the script then are you /not/ using that same low privileged user to run PoshC2 (using sudo again)? If so it should be using the same environment. Either way it would be recommended to use the same technique for installing and running PoshC2. Having done some testing across OSs and users, my observations are: * Running install as sudo creates the virtual environment under /root * Running |posh-| commands using sudo uses the same virtualenv and it works * Running the |posh-| commands without sudo or as a different user doesn't work, as the virtual env is not set up for that user image <https://user-images.githubusercontent.com/20513519/80952124-12c8b680-8df1-11ea-9141-34d12a0d1b4d.png> Is that inline with what you're seeing? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#86 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABZEP7VB4NBNVTH7SNBWEXLRP2COPANCNFSM4K2NYVJA>.

[ramoncjs3]

Because postgresql is supported in the configuration, and postgresql is not installed in Kali, an error is reported during the automatic installation process because psycopg2 is not installed successfully.
The solution is as follows:
apt-get install postgresql
apt-get install python-psycopg2
apt-get install libpq-dev
python3 -m pip install --force-reinstall -r requirements.txt

[riskydissonance]

👍 thanks ramoncjs3