0

I have run decrypted JSON file with pythonSTIX2 as per mvt-ios guide. I now have an output I do not understand. Any suggestions comments much appreciated.

a@a:~/Peg$ mvt-ios check-backup --iocs ~/Peg/+iPhoneSTX ~/Peg/+iPhonejson
11:07:50 INFO     [mvt.ios.cli] Checking iTunes backup located at: /home/a/Peg/+iPhonejson         
         INFO     [mvt.ios.cli] Parsing STIX2 indicators file at path /home/a/Peg/+iPhoneSTX       
Traceback (most recent call last):
  File "/home/a/.local/bin/mvt-ios", line 8, in <module>
    sys.exit(cli())
  File "/home/a/.local/lib/python3.9/site-packages/click/core.py", line 1137, in __call__
    return self.main(*args, **kwargs)
  File "/home/a/.local/lib/python3.9/site-packages/click/core.py", line 1062, in main
    rv = self.invoke(ctx)
  File "/home/a/.local/lib/python3.9/site-packages/click/core.py", line 1668, in invoke
    return _process_result(sub_ctx.command.invoke(sub_ctx))
  File "/home/a/.local/lib/python3.9/site-packages/click/core.py", line 1404, in invoke
    return ctx.invoke(self.callback, **ctx.params)
  File "/home/a/.local/lib/python3.9/site-packages/click/core.py", line 763, in invoke
    return __callback(*args, **kwargs)
  File "/home/a/.local/lib/python3.9/site-packages/click/decorators.py", line 26, in new_func
    return f(get_current_context(), *args, **kwargs)
  File "/home/a/.local/lib/python3.9/site-packages/mvt/ios/cli.py", line 152, in check_backup
    indicators.parse_stix2(ioc_path)
  File "/home/a/.local/lib/python3.9/site-packages/mvt/common/indicators.py", line 39, in parse_stix2
    with open(file_path, "r") as handle:
IsADirectoryError: [Errno 21] Is a directory: '/home/a/Peg/+iPhoneSTX'
0

1 Answer 1

0

There are multiple issues here - it appears that (1) you may need to install homebrew and the MVT dependencies, and (2) the STIX2 file must be a file, not a directory.

I would suggest making sure all your dependencies are all set by checking the MVT docs here:

https://docs.mvt.re/en/latest/install.html

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .