Timed out waiting for script to completed on RTR

[hermanmaleiane]

Hi,

I have been calling falcon_rtra.check_admin_command_status since two weeks without problem.
I have notice that when i submit a script to be executed using:

req = falcon_rtr.execute_active_responder_command(    base_command="runscript",
                                                               command_string=f"runscript -CloudFile='{cmd}'",
                                                               session_id=session_id
                                                               )

The script runs, but the problem is the timeout when i call check_admin_command_status.

{
	"status_code": 200,
	"headers": {
		"Content-Encoding": "gzip",
		"Content-Length": "312",
		"Content-Type": "application/json",
		"Date": "Wed, 15 Dec 2021 18:28:18 GMT",
		"Strict-Transport-Security": "max-age=31536000; includeSubDomains",
		"X-Cs-Region": "us-1",
		"X-Cs-Traceid": "7c9dda47-b965-4636-8ec7-22d757c2a61f",
		"X-Ratelimit-Limit": "6000",
		"X-Ratelimit-Remaining": "5999"
	},
	"body": {
		"meta": {
			"query_time": 0.006413349,
			"powered_by": "empower-api",
			"trace_id": "7c9dda47-b965-4636-8ec7-22d757c2a61f"
		},
		"resources": [{
			"session_id": "d0519a79-81c9-487b-adeb-845a77b89fd6",
			"task_id": "caf89f53-8aba-4be8-817e-8f445f2c2c13",
			"complete": true,
			"stdout": "\n\n\n\n\n\n\n\n\n\n\n\n",
			"stderr": "Timed out waiting for script to complete\n",
			"base_command": "runscript"
		}],
		"errors": []
	}
}

Is there any reason for this?
I'm not understanding why i'm getting this timeout.

[hermanmaleiane]

I tried to use the command directly instead of reading the uploaded script on console.

response = falcon_rtra.execute_admin_command(     base_command="runscript",
                                                  command_string=f"runscript -Raw=```Start-MpScan -ScanType QuickScan ```",
                                                  session_id=session_id
                                                  )

And i don't get the timeout.
I'm busy validating both approaches.

[crowdstrikedcs]

Hey There!

Based on the stderr message: Timed out waiting for script to complete it seems like the script you executed did not complete in the expected time window. This, by default is only 30 seconds.

When using falcon_rtr.execute_active_responder_command you can optionally include another item in your command_string that will increase this time up to ten minutes. For Example:

response = falcon_rtra.execute_admin_command(     base_command="runscript",
                                                  command_string=f"runscript -CloudFile='{cmd}' -Timeout=600"",
                                                  session_id=session_id
                                                  )

Try that out and see, I'm thinking the added time of retrieving the script may be causing it to run for too long. Additionally, make sure that when initializing the session, you are using an appropriate length timeout_duration argument.

[hermanmaleiane]

Hi @crowdstrikedcs !!
Thanks for helping.
I tried your suggestion.
Unfortunately , I'm still getting timeout.

What i did?

In the init_session

session = falcon_rtr.init_session(body={ # Open a new session and store the session ID "device_id": aid, "timeout_duration":600 # Pass in the AID we looked up previously })

The first call to execute the script
(-Timeout=600" ) It doesn't work.

req = falcon_rtr.execute_active_responder_command(base_command="runscript", command_string=f"runscript -CloudFile='{cmd}'", session_id=session_id, timeout=600 )

Then i get request_id = req["body"]["resources"][0]["cloud_request_id"] to submit on check_admin_command_status.
The error is coming from this execution.

` response = falcon_rtra.check_admin_command_status(
cloud_request_id=uuid_value, sequence_id=0
)

print(response)`

[crowdstrikedcs]

Try This Out, the Timeout argument needs to be part of the command_string:

req = falcon_rtr.execute_active_responder_command(base_command="runscript", command_string=f"runscript -CloudFile='{cmd}' -Timeout=600", session_id=session_id)