System.OutOfMemoryException

[icaman]

Hi All,

I wonder whether someone is experiencing the same issue I have. I've been testing KAPE on laptops with 8/16Gb uploading the archive in an AWS S4 bucket.

2022-05-23 15:35:04.6686 | E | Error transferring 'C:\Temp\kape-1.2.0.0-light\d\2022-05-23XXXX.zip' to S3. Error message: Exception of type 'System.OutOfMemoryException' was thrown.

Everything else looks fine for S3 credentials check, privileges execution, etc. I was under the impression the issue was the RAM, but the tests do not confirm that.

Any help is appreciated.

[EricZimmerman]

hmm, not seen this before. how big is the file being uploaded? can you replicate this on another machine? perhaps its isolated to one machine? what version of .net is installed? what version of KAPE?

[icaman]

The version I'm testing is in the command blob, 1.2.0.0. I'm using the !SANS_Triage profile. The size of the archives is around ~500Mb, most of the time.
I didn't think about .net. I will check that out.

Thanks for the quick reply, Eric!

[EricZimmerman]

that should not be an issue. ive seen much larger files get shoved upstream.

[AndrewRathbun]

FYI the SANS_Triage, in my opinion, should not blindly be used in production. It's purely meant as an educational tool, from my understanding. If you've validated that SANS_Triage is pulling everything you want and you're good with what it is and ISN'T pulling, then that's great. But if you've not done that, then !BasicCollection and KapeTriage are much better starting points. KapeTriage has been curated to work 1:1 with Eric's parsers in the !EZParser Module, which no other Compound Target can say that for itself.

Just posting this for posterity and hopefully for your benefit and better understanding.

[icaman]

Thanks, Andrew. We are good with that. :)

I'm not aware of any dependencies and the tests done were successful. . We use that profile to collect all we might need in a single shot. Besides, I removed the GUI and the Modules section to make the package lighter from a deployment perspective.

[AndrewRathbun]

Fantastic, thank you for providing that assurance 👍 cheers!

[icaman]

Hi All,

I was taking a bit of time to collect the info. Background, I'm pushing KAPE towards CSSM. To run KAPE as silent as possible, I created a VBS to lunch a cmd with the actual command. During the pilot, no archive was uploaded successfully to AWS S3. The CSSM application has been pushed as SYSTEM; that shouldn't be an issue. The NET version looks similar 10 out of 27 has C:\Windows\Microsoft.NET\Framework64\v4.0.30319. Querying towards osquery the reg key(HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full) I'm still waiting for others to connect with AWS S3. No clue why that is happing.