From 61a875bc00ad2d1bb4d6a024aa00c47ce72fa811 Mon Sep 17 00:00:00 2001 From: Howard Enos Date: Mon, 20 Jul 2026 15:18:40 -0700 Subject: [PATCH] sync: auto-sync from HOWARD-HOME at 2026-07-20 15:18:15 Author: Howard Enos Machine: HOWARD-HOME Timestamp: 2026-07-20 15:18:15 --- .../2026-07-20-howard-bug-bounty-sweep.md | 76 ++++++++++++++++++- 1 file changed, 75 insertions(+), 1 deletion(-) diff --git a/session-logs/2026-07/2026-07-20-howard-bug-bounty-sweep.md b/session-logs/2026-07/2026-07-20-howard-bug-bounty-sweep.md index c4b5f6b4..5e21cd9a 100644 --- a/session-logs/2026-07/2026-07-20-howard-bug-bounty-sweep.md +++ b/session-logs/2026-07/2026-07-20-howard-bug-bounty-sweep.md @@ -84,7 +84,81 @@ Ran /simplify code review (3 parallel agents: reuse, quality, efficiency). One a - **Triaged/reclassified:** CT#6 (blocked), RMM#105 (bug->feature) ### Syncro -- Ticket 114023383 -- 4 internal progress notes posted (Round 1, Round 2, Commits, Code Review) +- Ticket 114023383 -- 5 internal progress notes posted (Round 1, Round 2, Commits, Code Review, Round 3 Security) ### Dashboard - tracker.azcomputerguru.com -- live bug tracker dashboard + +--- + +## Update: 15:10 PT -- RMM Security Hardening + LAB-SERVER + Verification + +### Session Summary + +Continued the bug bounty session with three additional areas: RMM IPC security hardening, LAB-SERVER agent install investigation, and full verification of all fixes. + +Round 3 tackled the two open GuruRMM security bugs. RMM #16 (Windows IPC peer-credential authz) implemented real peer identification: `GetNamedPipeClientProcessId` captures the client PID at pipe connection time, then `OpenProcessToken` + `CheckTokenMembership` checks admin group membership (S-1-5-32-544) for StopAgent, and admin-or-active-session-user for ForceCheckin. `PeerIdentity` extended with a `#[cfg(windows)] pid` field. RMM #17 (Linux logind console user resolution) replaced the sysinfo-based user lookup with a loginctl-first approach: queries `loginctl list-sessions` for the active session on seat0, then `show-session` for the username, with graceful fallback to sysinfo on non-systemd systems. + +Howard attempted to install the GuruRMM agent on LAB-SERVER (Len's Auto Brokerage, Server 2008 SP2 6.0.6002). The installer failed with missing `api-ms-win-core-synch-l1-2-0.dll` -- UCRT APIs unavailable on this kernel version. VC++ 2013 redistributable also failed (VersionNT64 condition false -- likely 32-bit OS). No legacy agent build exists yet (gururmm#88). Documented the finding on the tracker as a real-world driver for the legacy build. LAB-SERVER is being replaced; ScreenConnect (session `4a870093`) is available for remote command execution in the interim. + +Ran full verification: 6 harness/skill fixes verified by review agent (all correct, no regressions). `cargo check` on the agent crate found 2 compile errors in the Windows IPC code -- PSID was in `Win32::Security` not `Foundation`, and HANDLE constructor takes `*mut c_void` not `isize` in windows 0.58. Fixed both, recompiled clean (0 errors). + +### Key Decisions + +- Used `CheckTokenMembership` with a duplicated impersonation token (not `GetTokenInformation/TokenGroups`) for admin group checks -- more reliable for restricted tokens and elevation detection. +- `authorize_stop_agent` requires admin-only on Windows (not session-user), matching the Unix behavior where only root/admin-group can stop the service. +- `authorize_force_checkin` allows admin OR active session user on Windows, matching Unix behavior. +- Logind resolution queries seat0 specifically (physical console) rather than any active session, to prevent SSH sessions from qualifying as "console user." +- Did not attempt to build a legacy agent for LAB-SERVER -- machine is being replaced, ScreenConnect covers the interim need. + +### Problems Encountered + +- guru-rmm remote had new commits from Mike's concurrent session; push rejected twice during the session. Resolved with `git stash && git pull --rebase && git stash pop` each time. +- `cargo check` failed with PSID import path and HANDLE constructor type mismatches. The agent used the `windows` crate 0.58 which moved PSID to `Win32::Security` and changed HANDLE's inner type to `*mut c_void`. Fixed in commit `5019ebc`. + +### Configuration Changes (Round 3) + +#### Files Modified +- `projects/msp-tools/guru-rmm/agent/src/ipc.rs` -- Windows IPC authz implementation (peer_token_is_admin, peer_token_username, GetNamedPipeClientProcessId integration) + Linux logind_active_username + PSID/HANDLE compile fixes + +### Credentials & Secrets + +- No new credentials. + +### Infrastructure & Servers + +- LAB-SERVER (Len's Auto Brokerage): Server 2008 SP2 (6.0.6002), possibly 32-bit. ScreenConnect session ID: `4a870093-cea4-4d9f-b331-d7034ab537d6`. Being replaced by LAB-SVR (already in GuruRMM, agent ID `8afb1430-c8f2-4fa2-8335-35b13d8a732f`). + +### Commands & Outputs + +``` +cargo check (agent crate): + error[E0433]: cannot find `PSID` in `Foundation` -> fixed: Win32::Security::PSID + error[E0308]: HANDLE(raw as isize) -> fixed: HANDLE(raw as *mut _) + After fix: Finished dev profile, 0 errors, 15 pre-existing warnings +``` + +### Pending / Incomplete Tasks + +- GuruRMM agent changes need a full build verification before deploy (cargo check passes, cargo build not yet run for release). +- gururmm#88 (legacy agent build) has a real-world driver now (LAB-SERVER) but remains status Raw -- needs Mike's design decision. +- GuruConnect security findings (#8, #10-#14, #16-#22) remain open -- separate scope from RMM. +- Phase 3 remediation checklist (gururmm#75) has 13 warning items still pending. + +### Reference Information + +#### Commits (Round 3) +- guru-rmm `72564cf` -> `5019ebc` -- IPC authz implementation + compile fix (rebased) +- claudetools `89b8197` -- sync with guru-rmm submodule update + +#### Tracker Tickets (Round 3) +- **Fixed:** RMM #16 (Windows IPC authz), RMM #17 (Linux logind resolution) +- **Commented:** RMM #88 (legacy build -- LAB-SERVER driver documented) + +#### Updated Session Totals +- 21 tracker tickets resolved (15 bugs fixed, 4 dupes closed, 2 triaged/reclassified) +- 5 Syncro ticket notes posted +- All code reviewed (/simplify) and compile-tested (cargo check) + +#### ScreenConnect +- LAB-SERVER session: `4a870093-cea4-4d9f-b331-d7034ab537d6` (Company: LAB)