Problem with VMX path

[rurik]

Problem with VMX path

[Rurik]

It sounds like some options are being dropped off the VMRUN command line when calling the VM. Can you run with the 'debug' (--debug) option set and paste the command lines shown for this error?

[najashark]

PS D:\Users\Pins\Desktop\Noriben-master> python .\NoribenSandbox.py --update --screenshot -t 45 -f .\suspicious_exe.exe --debug
[*] Processing: .\suspicious_exe.exe
"C:\Program Files (x86)\VMware\VMware Workstation\vmrun.exe" -T ws revertToSnapshot "D:\Users\user\Documents\VM\win7x64\win7x64.vmx" snap1
"C:\Program Files (x86)\VMware\VMware Workstation\vmrun.exe" -T ws start "D:\Users\user\Documents\VM\win7x64\win7x64.vmx"
"C:\Program Files (x86)\VMware\VMware Workstation\vmrun.exe" -gu user -gp  copyFileFromHostToGuest "D:\Users\user\Documents\VM\win7x64\win7x64.vmx" ".\suspicious_exe.exe" "C:\\Malware\\malware_suspicious_exe.exe"
Error: Unrecognized command: D:\Users\user\Documents\VM\win7x64\win7x64.vmx
[!] Error trying to copy file to guest. Error 0xffffffff: Unexpected Error

And here is my config

VMX = r'D:\Users\Pins\Documents\VM\win7x64\win7x64.vmx'
# VMX = os.path.expanduser(r'~/VMs/Windows.vmwarevm/Windows.vmx')
VMRUN = vmrun_os['windows']
VM_SNAPSHOT = 'snap1'
VM_USER = 'user'
VM_PASS = ''
noribenPath = 'C:\\\\Users\\\\{}\\\\Desktop\\\\Noriben-master'.format(VM_USER)
guestNoribenPath = '{}\\\\Noriben.py'.format(noribenPath)
procmonConfigPath = '{}\\\\ProcmonConfiguration.pmc'.format(noribenPath)
reportPathStructure = '{}/{}_NoribenReport.zip'  # (hostMalwarePath, hostMalwareNameBase)
hostScreenshotPathStructure = '{}/{}.png'  # (hostMalwarePath, hostMalwareNameBase)
guestLogPath = 'C:\\\\Noriben_Logs'
guestZipPath = 'C:\\\\Program Files\\\\VMware\\\\VMware Tools\\\\zip.exe'
#guestPythonPath = 'C:\\\\Python27\\\\python.exe'
guestPythonPath = 'C:\\\\Python36-32\\\\python.exe'
hostNoribenPath = os.path.join(os.path.dirname(os.path.abspath(sys.argv[0])), 'Noriben.py')
guestMalwarePath = 'C:\\\\Malware\\\\malware_'

[Rurik]

Did you redact out the password, or is it really blank?

If it's really blank, unfortunately VMware requires a password on an account to do any external commands.

If it's redacted out, can you try to run that command directly to get the raw output instead of running it within NoribenSandbox? That is, take all the command lines that you see on the output and just copy/paste them to run them, and see if there are any additional errors displayed on the screen.

[najashark]

Set the password, and now its working perfectly!
Thank you Brian

[Rurik]

Good to hear!
It's one of the little things about VMware that I learned the hard way. I'll add a check to the script to ensure it's checked so that this issue is caught in the future. Thanks for letting me know!