来自 API 的 Wazuh 远程命令不起作用

Question

I'm trying to execute remote command from Wazuh manager to the agent using API, below waht i'm trying to do:

curl -k -X PUT "https://192.168.1.76:55000/active-response?agents_list=001" -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" -d '{"command": "customA", "custom":true}'

and then the response:

{"data": {"affected_items": ["001"], "total_affected_items": 1, "total_failed_items": 0, "failed_items": []}, "message": "AR command was sent to all agents", "error": 0}

The problem is simply that the command "customA" isn't triggered in the agent. Here the body of the "/var/ossec/etc/ossec.conf" file in the MANAGER:

  <command>
    <name>customA</name>
    <executable>launcher.cmd</executable>
    <extra_args>custom_remove.py</extra_args>
  </command>

  <command>
    <name>customB</name>
    <executable>launcher.cmd</executable>
    <extra_args>custom_remove.py</extra_args>
  </command>

  <command>
    <name>forRemote</name>
    <executable>custom_remove.exe</executable>
  </command>

  <active-response>
     <disabled>no</disabled>
     <command>customA</command>
     <location>local</location>
     <rules_id>255001</rules_id>
  </active-response>

  <active-response>
     <disabled>no</disabled>
     <command>customA</command>
     <location>local</location>
     <rules_id>999001</rules_id>
  </active-response>

And this is the "local_internal_options.conf" file in the Windows AGENT 001:

windows.debug=2
rootcheck.sleep=0
syscheck.sleep=0
logcollector.remote_commands=1
wazuh_command.remote_commands=1

Eventually, I think that command and active response are correctly configured, because they will work correctly if i try to test them triggering a rule (for exampple rule 999001). Moreover, i post the response of the api "GET /manager/configuration/analysis/command":

{
  "data": {
    "affected_items": [
      {
        "command": [
          {
            "name": "disable-account",
            "executable": "disable-account",
            "timeout_allowed": 1
          },
          {
            "name": "restart-wazuh",
            "executable": "restart-wazuh",
            "timeout_allowed": 0
          },
          {
            "name": "firewall-drop",
            "executable": "firewall-drop",
            "timeout_allowed": 1
          },
          {
            "name": "host-deny",
            "executable": "host-deny",
            "timeout_allowed": 1
          },
          {
            "name": "route-null",
            "executable": "route-null",
            "timeout_allowed": 1
          },
          {
            "name": "win_route-null",
            "executable": "route-null.exe",
            "timeout_allowed": 1
          },
          {
            "name": "netsh",
            "executable": "netsh.exe",
            "timeout_allowed": 1
          },
          {
            "name": "customA",
            "executable": "launcher.cmd",
            "timeout_allowed": 0
          },
          {
            "name": "customB",
            "executable": "launcher.cmd",
            "timeout_allowed": 0
          },
          {
            "name": "forRemote",
            "executable": "custom_remove.exe",
            "timeout_allowed": 0
          },
          {
            "name": "remove-threat",
            "executable": "remove-threat.exe",
            "timeout_allowed": 0
          }
        ]
      }
    ],
    "total_affected_items": 1,
    "total_failed_items": 0,
    "failed_items": []
  },
  "message": "Active configuration was successfully read",
  "error": 0
}

I hope that someone will help me. Thanks in advice!

Answer 1

please open C:\Program Files (x86)\ossec-agent\etc\shared\ar.conf file and verify that you have:

customA0 - launcher.cmd - 0

if you don't have it, create any file in /var/ossec/etc/shared/default/ for the manager to update the agent by sending a merged.mg, this resets the agent and updates it according to what you configured in ossec.conf from the manager.

The command should have customA0 instead of customA.

Example: curl -k -X PUT "https://192.168.1.72:55000/active-response?agents_list=001" -H "Authorization: Bearer $(curl -u wazuh:wazuh -k -X GET "https://192.168.1.xxx:55000/security/user/authenticate?raw=true)" -H "content-type: application/json" -d ' {"command": "customA0", "custom":true} '

I hope this is useful. Regards

Note: I attach an example that I did to test manager agent