7 | $if title: $title 8 |

├── ffate.pdf ├── README.md ├── webapp ├── templates │ ├── re_li.html │ ├── cfg_li.html │ ├── ioc_li.html │ ├── re_listing.html │ ├── cfg_listing.html │ ├── ioc_listing.html │ ├── archive_li.html │ ├── archive_listing.html │ ├── dash.html │ ├── li.html │ ├── tabbed.html │ └── listing.html ├── ffate.css └── ffate.py ├── scripts ├── update-ffate.sh ├── update-jenkins-jobs.sh ├── guess_profile.pl ├── update-jenkins.sh ├── install-pyelasticsearch.sh ├── create-shares.sh ├── install-pg.sh ├── ffate-bundle-installer.sh ├── install-ffate.sh └── install-jenkins.sh ├── jenkins ├── views │ ├── ForensicatorFATE.xml │ ├── HelperTasks.xml │ ├── FSAnalysis.xml │ └── MemoryAnalysis.xml └── jobs │ ├── IOC.xml │ ├── NSRL.xml │ ├── bulk_extractor_disk.xml │ ├── PlasoExporter.xml │ ├── Volatility.0.xml │ ├── bulk_extractor_memory.xml │ ├── Volatility.8.xml │ ├── Volatility.7.xml │ ├── FStimeline.xml │ ├── Volatility.1.xml │ ├── Volatility.4.xml │ ├── sorter.xml │ ├── Carving.xml │ ├── Volatility.5.xml │ ├── Volatility.2.xml │ ├── Volatility.6.xml │ ├── Volatility.3.xml │ ├── bulk_extractor.xml │ ├── Supertimeline.xml │ ├── Volatility.xml │ └── findWindowsEvidence.xml └── LICENSE /ffate.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/z3ndrag0n/forensicator-fate/HEAD/ffate.pdf -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | forensicator-fate 2 | ================= 3 | 4 | Bringing DevOps to Forensics - your tools, your processes...just automated. 5 | -------------------------------------------------------------------------------- /webapp/templates/re_li.html: -------------------------------------------------------------------------------- 1 | $def with (file, hash) 2 | 3 | 4 | 5 | $file $getsize(file) $hash 6 | 7 | 8 | -------------------------------------------------------------------------------- /webapp/templates/cfg_li.html: -------------------------------------------------------------------------------- 1 | $def with (config_var) 2 | 3 | 4 | 5 | $config_var.param_name $config_var.param_value 6 | 7 | -------------------------------------------------------------------------------- /webapp/templates/ioc_li.html: -------------------------------------------------------------------------------- 1 | $def with (file, hash, short_desc, desc) 2 | 3 | 4 | 5 | $file $getsize(file) $hash $short_desc 6 | 7 | 8 | -------------------------------------------------------------------------------- /scripts/update-ffate.sh: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | 3 | cd ~/forensicator-fate 4 | git pull 5 | sudo cp webapp/ffate.py /var/www/forensicator-fate/ 6 | sudo cp webapp/templates/* /var/www/templates 7 | sudo cp webapp/ffate.css /var/www/public_html/ 8 | cd ~ 9 | forensicator-fate/scripts/update-jenkins.sh 10 | forensicator-fate/scripts/update-jenkins-jobs.sh 11 | -------------------------------------------------------------------------------- /webapp/templates/re_listing.html: -------------------------------------------------------------------------------- 1 | $def with (walk) 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | $if walk: 10 | 11 | 12 | 13 | $for (file, hash) in walk: 14 | $:render.re_li(file, hash) 15 |

Name	Size	Hash

16 | 17 | 18 | -------------------------------------------------------------------------------- /webapp/templates/cfg_listing.html: -------------------------------------------------------------------------------- 1 | $def with (config_vars) 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | $if config_vars: 10 | 11 | 12 | 13 | $for config_var in config_vars: 14 | $:render.cfg_li(config_var) 15 |

Parameter Name	Parameter Value

16 | 17 | -------------------------------------------------------------------------------- /scripts/update-jenkins-jobs.sh: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | 3 | #update jobs 4 | cd forensicator-fate/jenkins/jobs 5 | for job in `ls -1 | sed 's/\.xml//'`; do echo Updating job $job; java -jar /run/jenkins/war/WEB-INF/jenkins-cli.jar -s http://localhost:8080 update-job $job <${job}.xml; done 6 | 7 | cd ~ 8 | sudo cp forensicator-fate/scripts/guess_profile.pl /usr/bin 9 | sudo chown jenkins:jenkins /usr/bin/guess_profile.pl 10 | sudo chmod 755 /usr/bin/guess_profile.pl 11 | -------------------------------------------------------------------------------- /webapp/templates/ioc_listing.html: -------------------------------------------------------------------------------- 1 | $def with (walk) 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | $if walk: 10 | 11 | 12 | 13 | $for (file, hash, short_desc, desc) in walk: 14 | $:render.ioc_li(file, hash, short_desc, desc) 15 |

IOC	Size	Hash	Description

16 | 17 | 18 | -------------------------------------------------------------------------------- /scripts/guess_profile.pl: -------------------------------------------------------------------------------- 1 | #!/usr/bin/perl 2 | while(<>) { 3 | if (/Suggested Profile$s$ \: (.*?)( $Instantiated with .*)?$/) { 4 | $profiles = $1; 5 | @profiles = split / |,/, $profiles; 6 | } 7 | elsif (/Image Type \(Service Pack$ \: (.*)$/) { 8 | $profile = $1; 9 | } 10 | } 11 | 12 | open(my $fh, ">", "imageinfo.properties") or die "cannot open > imageinfo.properties: $!"; 13 | print $fh "VOLATILITY_PROFILE = ", grep(/SP$profile/,@profiles), "\n"; 14 | close $fh; 15 | -------------------------------------------------------------------------------- /webapp/templates/archive_li.html: -------------------------------------------------------------------------------- 1 | $def with (case) 2 | 3 | 4 | 5 | $case.id $case.casename $case.memory_image $case.disk_image $case.disk_name $case.timezone $case.volatility_profile $case.notes $case.case_keywords 6 | 7 | 11 | 12 | 13 | -------------------------------------------------------------------------------- /scripts/update-jenkins.sh: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | 3 | #update Jenkins 4 | cd /usr/share/jenkins 5 | sudo mv jenkins.war jenkins-last-install.war 6 | # need to pin this to 1.575 as this is where jenkins devs (re)broke the cli 7 | sudo curl -o jenkins.war -L http://updates.jenkins-ci.org/download/war/1.575/jenkins.war 8 | cd ~ 9 | sudo service jenkins restart 10 | 11 | #wait for Jenkins to start 12 | until wget http://localhost:8080/ 2>&1 | grep "response" | grep -c "200 OK"; do echo Sleeping 15 seconds waiting for Jenkins to start... ; sleep 15 ; done 13 | -------------------------------------------------------------------------------- /webapp/templates/archive_listing.html: -------------------------------------------------------------------------------- 1 | $def with (cases) 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | $if cases: 10 | 11 | 12 | 13 | $for case in cases: 14 | $:render.archive_li(case) 15 |

id	casename	memory image	disk image	disk name	timezone	volatility_profile	notes	keywords

16 | 17 | 18 | -------------------------------------------------------------------------------- /scripts/install-pyelasticsearch.sh: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # Make sure plaso is up-to-date before continuing (thanks BMG) 3 | sudo apt-get update 4 | sudo apt-get install python-plaso 5 | # Download and install python library to interact with Elasticsearch 6 | git clone https://github.com/rhec/pyelasticsearch.git 7 | cd pyelasticsearch 8 | python setup.py build 9 | sudo python setup.py install 10 | cd ~ 11 | wget https://plaso.googlecode.com/git/extra/plaso_kibana_example.json 12 | scp plaso_kibana_example.json ls_user@$1: 13 | ssh -t ls_user@$1 sudo cp plaso_kibana_example.json /opt/logstash/vendor/kibana/app/dashboards/plaso.json 14 | -------------------------------------------------------------------------------- /webapp/templates/dash.html: -------------------------------------------------------------------------------- 1 | $def with (plaso_url, jenkins_url, for572_url, xplico_url) 2 | 3 | The following dashboards are available (and will open in a new browser tab/window): 4 |

Supertimeline.
Jenkins Tasks.
Advanced Network Forensics (for SANS FOR572).
Xplico.
Issues and Enhancement requests. 10 |

11 | -------------------------------------------------------------------------------- /jenkins/views/ForensicatorFATE.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | Forensicator FATE 4 | false 5 | false 6 | 7 | 8 | 9 | findWindowsEvidence 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | false 22 | 23 | -------------------------------------------------------------------------------- /jenkins/views/HelperTasks.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | Helper Tasks 4 | Tasks for del 5 | false 6 | false 7 | 8 | 9 | 10 | IOC 11 | NSRL 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | false 24 | -------------------------------------------------------------------------------- /webapp/ffate.css: -------------------------------------------------------------------------------- 1 | body { 2 | height: 100%; 3 | font-family: "Trebuchet MS", "Helvetica", "Arial", "Verdana", "sans-serif"; 4 | font-size: 62.5%; 5 | } 6 | 7 | iframe[name="frame2"] { 8 | width: 95%; 9 | height: auto !important; 10 | min-height: 600; 11 | //background-color: #666699; 12 | } 13 | 14 | table, td, th { 15 | border: 2px solid green; 16 | padding: 5px; 17 | border-collapse: collapse; 18 | } 19 | 20 | th { 21 | background-color: green; 22 | color: white; 23 | } 24 | 25 | label 26 | { 27 | width: 20em; 28 | float: left; 29 | text-align: right; 30 | margin-right: 0.5em; 31 | } 32 | 33 | .submit input 34 | { 35 | margin-left: 21em; 36 | } 37 | 38 | .ui-dialog-case { 39 | -moz-border-radius: 8px 8px 8px 8px; 40 | -webkit-border-radius: 8px 8px 20px 8px; 41 | border-radius: 8px 8px 8px 8px; 42 | border-width: 8px 8px 8px 8px; 43 | } 44 | -------------------------------------------------------------------------------- /scripts/create-shares.sh: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | sudo mkdir /ioc /blacklist /whitelist /reverse /artifacts 3 | sudo mv /etc/samba/smb.conf /etc/samba/smb.conf-default 4 | sudo su - root -c "cat >/etc/samba/smb.conf-fate" </etc/samba/smb.conf" 37 | sudo service smbd restart 38 | -------------------------------------------------------------------------------- /jenkins/views/FSAnalysis.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | Disk Analysis 4 | false 5 | false 6 | 7 | 8 | 9 | bulk_extractor_disk 10 | Carving 11 | FStimeline 12 | sorter 13 | Supertimeline 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | false 26 | 27 | -------------------------------------------------------------------------------- /scripts/install-pg.sh: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | sudo apt-get install postgresql python-psycopg2 3 | sudo service postgresql start 4 | sudo su - postgres -c psql < 4 | 5 | $case.id $case.casename $case.memory_image $case.disk_image $case.disk_name $case.timezone $case.volatility_profile $case.notes $case.case_keywords 6 | 7 | 16 | 17 | 18 | 22 | 23 | 24 | -------------------------------------------------------------------------------- /jenkins/views/MemoryAnalysis.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | Memory Analysis 4 | false 5 | false 6 | 7 | 8 | 9 | bulk_extractor_memory 10 | Volatility 11 | Volatility.0 12 | Volatility.1 13 | Volatility.2 14 | Volatility.3 15 | Volatility.4 16 | Volatility.5 17 | Volatility.6 18 | Volatility.7 19 | Volatility.8 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | 31 | false 32 | 33 | -------------------------------------------------------------------------------- /scripts/ffate-bundle-installer.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | if [[ $USER = "root" ]]; then 4 | echo "You're running this script as root. Bad things will happen." 5 | echo "I'll su to sansforensics and run again now." 6 | su - sansforensics -c "forensicator-fate/scripts/ffate-bundle-installer.sh" 7 | elif [[ $USER = "sansforensics" ]]; then 8 | echo "The SANS Gold Paper says to run me, then set up your ELK VM and manually" 9 | echo "setup the kibana dash. However, if you are willing to set up your ELK" 10 | echo "VM first, I'll automagically setup Kibana for you. Go ahead (I'll wait)..." 11 | echo "Please enter your ELK IP address,which is displayed" 12 | echo -n "on the console of the VM: " 13 | read ELK_IP 14 | 15 | cd ~ 16 | forensicator-fate/scripts/install-pyelasticsearch.sh ${ELK_IP} 17 | forensicator-fate/scripts/create-shares.sh 18 | forensicator-fate/scripts/install-jenkins.sh 19 | forensicator-fate/scripts/install-pg.sh ${ELK_IP} 20 | forensicator-fate/scripts/install-ffate.sh 21 | cp forensicator-fate/ffate.pdf Desktop/ 22 | else 23 | echo "You started this script as neither sansforensics (correct), nor root" 24 | echo "(incorrect, but understandable). I can't guess your intention. Giving up." 25 | fi -------------------------------------------------------------------------------- /jenkins/jobs/IOC.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | Copy downloaded (or created!) Indicators of Compromise found in the provided directory to /ioc; 5 | false 6 | 7 | 8 | 9 | 10 | IOC_DOWNLOAD_DIRECTORY 11 | The directory the .ioc files have been downloaded to or created in. 12 | /home/sansforensics/Downloads 13 | 14 | 15 | 16 | 17 | 18 | true 19 | false 20 | false 21 | false 22 | 23 | false 24 | 25 | 26 | cp ${IOC_DOWNLOAD_DIRECTORY}/*.ioc /ioc 27 | 28 | 29 | 30 | 31 | 32 | -------------------------------------------------------------------------------- /jenkins/jobs/NSRL.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | Unzip the NSRL zip found in the provided directory; 5 | move the resulting file to /whitelist; 6 | produce the indices; 7 | false 8 | 9 | 10 | 11 | 12 | NSRL_DOWNLOAD_DIRECTORY 13 | The directory the NSRLFile.txt.zip archive has been downloaded to. 14 | /home/sansforensics/Downloads 15 | 16 | 17 | 18 | 19 | 20 | true 21 | false 22 | false 23 | false 24 | 25 | false 26 | 27 | 28 | cd /tmp && unzip ${NSRL_DOWNLOAD_DIRECTORY}/NSRLFile.txt.zip && mv NSRLFile.txt /whitelist && cd /whitelist && hfind -i nsrl-md5 NSRLFile.txt && hfind -i nsrl-sha1 NSRLFile.txt 29 | 30 | 31 | 32 | 33 | 34 | -------------------------------------------------------------------------------- /webapp/templates/tabbed.html: -------------------------------------------------------------------------------- 1 | $def with (title, jenkins_url, plaso_url) 2 | 3 | 4 | 5 | 6 | 7 | $if title: $title 8 | 9 | 10 | 11 | 12 | 13 | 14 | 28 | 29 | 30 | 31 | 32 |

33 |

42 | 43 | 44 | 49 |

50 | 51 | Plaso dash Tasks Issues 52 | 53 | 54 | -------------------------------------------------------------------------------- /jenkins/jobs/bulk_extractor_disk.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | false 6 | 7 | 8 | 9 | 10 | DISK_IMAGE_FILE 11 | 12 | 13 | 14 | 15 | KEYWORDS_FILE 16 | 17 | /cases/${CASE_NAME}/keywords.txt 18 | 19 | 20 | DISK_ARTIFACTS 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | true 29 | false 30 | false 31 | false 32 | 33 | false 34 | 35 | 36 | if [[ ! -d $OUTPUT_LOCATION ]]; then mkdir $OUTPUT_LOCATION; fi 37 | if [[ ! -f $KEYWORDS_FILE ]]; then touch $KEYWORDS_FILE; fi 38 | bulk_extractor -F $KEYWORDS_FILE -o $DISK_ARTIFACTS $DISK_IMAGE_FILE 39 | 40 | 41 | 42 | 43 | 44 | -------------------------------------------------------------------------------- /scripts/install-ffate.sh: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | sudo easy_install web.py 3 | sudo apt-get install apache2 4 | sudo apt-get install libapache2-mod-wsgi 5 | sudo a2enmod rewrite wsgi 6 | 7 | sudo service apache2 restart 8 | 9 | sudo ed /etc/apache2/sites-available/default < 16 | SetHandler wsgi-script 17 | Options ExecCGI FollowSymLinks 18 | 19 | 20 | AddType text/html .py 21 | 22 | 23 | # RewriteEngine on 24 | # RewriteBase / 25 | # RewriteCond %{REQUEST_URI} !^/static 26 | # RewriteCond %{REQUEST_URI} !^(/.*)+ffate.py/ 27 | # RewriteRule ^(.*)$ ffate.py/$1 [PT] 28 | 29 | . 30 | w 31 | q 32 | EOF 33 | 34 | wget http://code.jquery.com/jquery-1.11.1.min.js 35 | wget http://jqueryui.com/resources/download/jquery-ui-1.11.1.zip 36 | unzip jquery-ui-1.11.1.zip 37 | wget http://jqueryui.com/resources/download/jquery-ui-themes-1.11.1.zip 38 | unzip jquery-ui-themes-1.11.1.zip 39 | 40 | sudo mkdir /var/www/forensicator-fate 41 | sudo mkdir /var/www/public_html 42 | sudo mv /var/www/index.html /var/www/public_html 43 | 44 | sudo mv jquery-1.11.1.min.js /var/www/public_html/jquery.js 45 | sudo mv jquery-ui-1.11.1/jquery-ui.min.js /var/www/public_html/jquery-ui.js 46 | sudo mv jquery-ui-1.11.1/jquery-ui.theme.min.css /var/www/public_html/jquery-ui.theme.css 47 | sudo mv jquery-ui-1.11.1/jquery-ui.min.css /var/www/public_html/jquery-ui.css 48 | sudo mv jquery-ui-1.11.1/jquery-ui.structure.min.css /var/www/public_html/jquery-ui.structure.css 49 | sudo mv jquery-ui-1.11.1/images/ /var/www/public_html/ 50 | sudo mv jquery-ui-themes-1.11.1/themes/ /var/www/public_html/ 51 | 52 | sudo cp forensicator-fate/webapp/ffate.css /var/www/public_html/ 53 | sudo cp forensicator-fate/webapp/ffate.py /var/www/forensicator-fate/ 54 | sudo cp -R forensicator-fate/webapp/templates /var/www/templates 55 | 56 | sudo service apache2 restart 57 | -------------------------------------------------------------------------------- /jenkins/jobs/PlasoExporter.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | false 6 | 7 | 8 | 9 | 10 | ELK_IP 11 | The IP address of the server with the Elasticsearch, Logstash, Kibana (ELK) stack. 12 | 13 | 14 | 15 | TIMEZONE 16 | Timezone of the target machine, not the examiner's. 17 | 18 | 19 | 20 | CASE_NAME 21 | Name of the case - used to build the output path. 22 | 23 | 24 | 25 | OUTPUT_LOCATION 26 | Location of the evidence processing output 27 | /artifacts/${CASE_NAME} 28 | 29 | 30 | 31 | 32 | 33 | true 34 | false 35 | false 36 | false 37 | 38 | false 39 | 40 | 41 | psort.py -z$TIMEZONE -o Elastic --elastic_server_ip=${ELK_IP} ${OUTPUT_LOCATION}/plaso.dump 42 | 43 | 44 | 45 | 46 | 47 | -------------------------------------------------------------------------------- /jenkins/jobs/Volatility.0.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | Volatility - Step 0 - Identify the memory image profile 5 | false 6 | 7 | 8 | 9 | 10 | MEMORY_IMAGE_FILE 11 | Path of the memory image for volatility to process. 12 | /cases/sift408pc-memory.img 13 | 14 | 15 | VOLATILITY_LOCATION 16 | Specify the location of the memory image to analyse. 17 | file://${MEMORY_IMAGE_FILE} 18 | 19 | 20 | CASE_NAME 21 | Name of the case - used to build output paths. 22 | 23 | 24 | 25 | OUTPUT_LOCATION 26 | Location for the volatility output 27 | /artifacts/${CASE_NAME} 28 | 29 | 30 | 31 | 32 | 33 | true 34 | false 35 | false 36 | false 37 | 38 | true 39 | 40 | 41 | if [[ ! -d $OUTPUT_LOCATION ]]; then mkdir $OUTPUT_LOCATION; fi 42 | vol.py imageinfo >${OUTPUT_LOCATION}/imageinfo_output 43 | 44 | 45 | 46 | 47 | 48 | -------------------------------------------------------------------------------- /jenkins/jobs/bulk_extractor_memory.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | false 6 | 7 | 8 | 9 | 10 | MEMORY_IMAGE_FILE 11 | 12 | 13 | 14 | 15 | KEYWORDS_FILE 16 | 17 | /cases/${CASE_NAME}/keywords.txt 18 | 19 | 20 | MEMORY_ARTIFACTS 21 | 22 | ${OUTPUT_LOCATION}/bulk_extractor_memory 23 | 24 | 25 | OUTPUT_LOCATION 26 | 27 | /artifacts/${CASE_NAME} 28 | 29 | 30 | CASE_NAME 31 | Name of the case - used to build output paths. 32 | 33 | 34 | 35 | 36 | 37 | 38 | true 39 | false 40 | false 41 | false 42 | 43 | false 44 | 45 | 46 | if [[ ! -d $OUTPUT_LOCATION ]]; then mkdir $OUTPUT_LOCATION; fi 47 | if [[ ! -f $KEYWORDS_FILE ]]; then touch $KEYWORDS_FILE; fi 48 | bulk_extractor -F $KEYWORDS_FILE -e net -e aes -e wordlist -o $MEMORY_ARTIFACTS $MEMORY_IMAGE_FILE 49 | 50 | 51 | 52 | 53 | 54 | -------------------------------------------------------------------------------- /jenkins/jobs/Volatility.8.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | Volatility - Step 8 - Memory Timelining 5 | false 6 | 7 | 8 | 9 | 10 | VOLATILITY_LOCATION 11 | Specify the location of the memory image to analyse. 12 | file://${MEMORY_IMAGE_FILE} 13 | 14 | 15 | VOLATILITY_PROFILE 16 | Specify the profile of the memory image to analyse. 17 | 18 | 19 | 20 | MEMORY_IMAGE_FILE 21 | Location of the raw memory image. 22 | 23 | 24 | 25 | CASE_NAME 26 | Name of the case - used to build output paths. 27 | 28 | 29 | 30 | OUTPUT_LOCATION 31 | Location of the evidence processing output. 32 | /artifacts/${CASE_NAME} 33 | 34 | 35 | 36 | 37 | 38 | true 39 | false 40 | false 41 | false 42 | 43 | true 44 | 45 | 46 | if [[ ! -d $OUTPUT_LOCATION ]]; then mkdir $OUTPUT_LOCATION; fi 47 | vol.py timeliner --output=body >${OUTPUT_LOCATION}/timeliner_bodyfile_output 48 | 49 | 50 | 51 | 52 | 53 | -------------------------------------------------------------------------------- /jenkins/jobs/Volatility.7.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | Volatility - Step 7 - Registry Analysis 5 | false 6 | 7 | 8 | 9 | 10 | MEMORY_IMAGE_FILE 11 | Location of the raw memory image 12 | 13 | 14 | 15 | VOLATILITY_LOCATION 16 | Specify the location of the memory image to analyse. 17 | file://${MEMORY_IMAGE_FILE} 18 | 19 | 20 | VOLATILITY_PROFILE 21 | Specify the profile of the memory image to analyse. 22 | 23 | 24 | 25 | CASE_NAME 26 | Name of the case - used to build output paths. 27 | 28 | 29 | 30 | OUTPUT_LOCATION 31 | Location of the evidence processing output. 32 | /artifacts/{CASE_NAME} 33 | 34 | 35 | 36 | 37 | 38 | true 39 | false 40 | false 41 | false 42 | 43 | true 44 | 45 | 46 | if [[ ! -d $OUTPUT_LOCATION ]]; then mkdir $OUTPUT_LOCATION; fi 47 | vol.py hivelist >${OUTPUT_LOCATION}/hivelist_output 48 | vol.py userassist >${OUTPUT_LOCATION}/userassist_output 49 | 50 | 51 | 52 | 53 | 54 | -------------------------------------------------------------------------------- /jenkins/jobs/FStimeline.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | Create a filesystem timeline with fls and mactime for analysis 5 | false 6 | 7 | 8 | 9 | 10 | DISK_IMAGE_FILE 11 | Location of the disk image to create the filesystem timeline from 12 | 13 | 14 | 15 | DISK_NAME 16 | Name of the disk for output 17 | C: 18 | 19 | 20 | CASE_NAME 21 | Name of the case - used to build the output path. 22 | 23 | 24 | 25 | OUTPUT_LOCATION 26 | Location of the timeline output file 27 | /artifacts/${CASE_NAME} 28 | 29 | 30 | TIMEZONE 31 | Timezone of the system under analysis 32 | EST5EDT 33 | 34 | 35 | 36 | 37 | 38 | true 39 | false 40 | false 41 | false 42 | 43 | true 44 | 45 | 46 | if [[ ! -d $OUTPUT_LOCATION ]]; then mkdir $OUTPUT_LOCATION; fi 47 | fls -r -m $DISK_NAME $DISK_IMAGE_FILE >${OUTPUT_LOCATION}/bodyfile && mactime -d -b ${OUTPUT_LOCATION}/bodyfile -z $TIMEZONE >${OUTPUT_LOCATION}/fs-timeline.csv 48 | 49 | 50 | 51 | 52 | 53 | -------------------------------------------------------------------------------- /jenkins/jobs/Volatility.1.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | Volatility - Step 1 - Identify Rogue Processes 5 | false 6 | 7 | 8 | 9 | 10 | MEMORY_IMAGE_FILE 11 | Path of the memory image for volatility to analyse. 12 | 13 | 14 | 15 | VOLATILITY_LOCATION 16 | Specify the location of the memory image to analyse. 17 | file://${MEMORY_IMAGE_FILE} 18 | 19 | 20 | VOLATILITY_PROFILE 21 | Specify the profile of the memory image to analyse. 22 | 23 | 24 | 25 | CASE_NAME 26 | Name of the case - used to build output paths. 27 | 28 | 29 | 30 | OUTPUT_LOCATION 31 | Location for volatility output. 32 | /artifacts/${CASE_NAME} 33 | 34 | 35 | 36 | 37 | 38 | true 39 | false 40 | false 41 | false 42 | 43 | true 44 | 45 | 46 | if [[ ! -d $OUTPUT_LOCATION ]]; then mkdir $OUTPUT_LOCATION; fi 47 | vol.py pslist >${OUTPUT_LOCATION}/pslist_output 48 | vol.py psscan >${OUTPUT_LOCATION}/psscan_output 49 | vol.py pstree >${OUTPUT_LOCATION}/pstree_output 50 | 51 | 52 | 53 | 54 | 55 | -------------------------------------------------------------------------------- /jenkins/jobs/Volatility.4.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | Volatility - Step 4 - Look for Evidence of Code Injection 5 | false 6 | 7 | 8 | 9 | 10 | MEMORY_IMAGE_FILE 11 | Location of the raw memory image 12 | 13 | 14 | 15 | VOLATILITY_LOCATION 16 | Specify the location of the memory image to analyse. 17 | file://${MEMORY_IMAGE_FILE} 18 | 19 | 20 | VOLATILITY_PROFILE 21 | Specify the profile of the memory image to analyse. 22 | 23 | 24 | 25 | CASE_NAME 26 | Name of the case - used to build output paths. 27 | 28 | 29 | 30 | OUTPUT_LOCATION 31 | Specify the location of the memory image to analyse. 32 | /artifacts/${CASE_NAME} 33 | 34 | 35 | 36 | 37 | 38 | true 39 | false 40 | false 41 | false 42 | 43 | true 44 | 45 | 46 | if [[ ! -d $OUTPUT_LOCATION ]]; then mkdir $OUTPUT_LOCATION; fi 47 | vol.py malfind --dump-dir ${OUTPUT_LOCATION} >${OUTPUT_LOCATION}/malfind_output 48 | vol.py ldrmodules -v > ${OUTPUT_LOCATION}/ldrmodules_output 49 | 50 | 51 | 52 | 53 | 54 | -------------------------------------------------------------------------------- /jenkins/jobs/sorter.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | false 6 | 7 | 8 | 9 | 10 | DISK_IMAGE_FILE 11 | 12 | 13 | 14 | 15 | SORTER_ARTIFACTS 16 | 17 | ${OUTPUT_LOCATION}/sorter 18 | 19 | 20 | DISK_NAME 21 | Name of the disk for output. 22 | C: 23 | 24 | 25 | BLACKLIST 26 | A list of hashes of files known to be bad 27 | /blacklist/known_bad_files.txt 28 | 29 | 30 | WHITELIST 31 | A list of hashes of files we trust. 32 | /whitelist/known_good_files.txt 33 | 34 | 35 | 36 | 37 | 38 | true 39 | false 40 | false 41 | false 42 | 43 | false 44 | 45 | 46 | if [[ ! -d $OUTPUT_LOCATION ]]; then mkdir $OUTPUT_LOCATION; fi 47 | if [[ ! -d $SORTER_ARTIFACTS ]] ; then 48 | mkdir $SORTER_ARTIFACTS 49 | fi 50 | if [[ -f /whitelist/NSRLFile.txt ]]; then 51 | sorter -s -h -n /whitelist/NSRLFile.txt -a $BLACKLIST -x $WHITELIST -m ${DISK_NAME} -d $SORTER_ARTIFACTS $DISK_IMAGE_FILE 52 | else 53 | sorter -s -h -a $BLACKLIST -x $WHITELIST -m ${DISK_NAME} -d $SORTER_ARTIFACTS $DISK_IMAGE_FILE 54 | fi 55 | 56 | 57 | 58 | 59 | 60 | 61 | -------------------------------------------------------------------------------- /jenkins/jobs/Carving.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | Runs blkls to collect unallocated storage, then determines the cluster size from the disk image with fsstat, then runs foremost with the appropriate parameters to carve out deleted files. 5 | false 6 | 7 | 8 | 9 | 10 | DISK_IMAGE_FILE 11 | 12 | 13 | 14 | 15 | UNALLOCATED_STORAGE_FILE 16 | 17 | ${OUTPUT_LOCATION}/${CASE_NAME}.blkls 18 | 19 | 20 | CASE_NAME 21 | Name of the case - used to build the paths to output files to. 22 | 23 | 24 | 25 | OUTPUT_LOCATION 26 | Location of evidence processing artifacts 27 | /artifacts/${CASE_NAME} 28 | 29 | 30 | FOREMOST_OUTPUT 31 | 32 | ${OUTPUT_LOCATION}/foremost 33 | 34 | 35 | 36 | 37 | 38 | true 39 | false 40 | false 41 | false 42 | 43 | false 44 | 45 | 46 | if [[ ! -d $OUTPUT_LOCATION ]]; then mkdir $OUTPUT_LOCATION; fi 47 | blkls $DISK_IMAGE_FILE >$UNALLOCATED_STORAGE_FILE 48 | CLUSTER_SIZE=`fsstat $DISK_IMAGE_FILE | awk '/Cluster Size: /{print $3}'` 49 | foremost -q -b $CLUSTER_SIZE -o $FOREMOST_OUTPUT $UNALLOCATED_STORAGE_FILE 50 | 51 | 52 | 53 | 54 | 55 | -------------------------------------------------------------------------------- /jenkins/jobs/Volatility.5.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | Volatility - Step 5 - Check for Signs of a Rootkit 5 | false 6 | 7 | 8 | 9 | 10 | MEMORY_IMAGE_FILE 11 | Location of the raw memory image 12 | 13 | 14 | 15 | VOLATILITY_LOCATION 16 | Specify the location of the memory image to analyse. 17 | file://${MEMORY_IMAGE_FILE} 18 | 19 | 20 | VOLATILITY_PROFILE 21 | Specify the profile of the memory image to analyse. 22 | 23 | 24 | 25 | CASE_NAME 26 | Name of the case - used for building output paths 27 | 28 | 29 | 30 | OUTPUT_LOCATION 31 | Location of the evidence processing output. 32 | /artifacts/${CASE_NAME} 33 | 34 | 35 | 36 | 37 | 38 | true 39 | false 40 | false 41 | false 42 | 43 | true 44 | 45 | 46 | if [[ ! -d $OUTPUT_LOCATION ]]; then mkdir $OUTPUT_LOCATION; fi 47 | vol.py psxview >${OUTPUT_LOCATION}/psxview_output 48 | vol.py modscan >${OUTPUT_LOCATION}/modscan_output 49 | vol.py apihooks >${OUTPUT_LOCATION}/apihooks_output 50 | vol.py ssdt >${OUTPUT_LOCATION}/ssdt_output 51 | vol.py driverirp >${OUTPUT_LOCATION}/driverirp_output 52 | vol.py idt >${OUTPUT_LOCATION}/idt_output 53 | 54 | 55 | 56 | 57 | 58 | -------------------------------------------------------------------------------- /jenkins/jobs/Volatility.2.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | Volatility - Step 2 - Analyze Process DLLs and Handles 5 | false 6 | 7 | 8 | 9 | 10 | MEMORY_IMAGE_FILE 11 | Pat of the raw memory image. 12 | 13 | 14 | 15 | VOLATILITY_LOCATION 16 | Specify the location of the memory image to analyse. 17 | file://${MEMORY_IMAGE_FILE} 18 | 19 | 20 | VOLATILITY_PROFILE 21 | Specify the profile of the memory image to analyse. 22 | 23 | 24 | 25 | CASE_NAME 26 | Name of the case - used to build output paths. 27 | 28 | 29 | 30 | OUTPUT_LOCATION 31 | Location of the evidence processing output 32 | /artifacts/${CASE_NAME} 33 | 34 | 35 | 36 | 37 | 38 | true 39 | false 40 | false 41 | false 42 | 43 | true 44 | 45 | 46 | if [[ ! -d $OUTPUT_LOCATION ]]; then mkdir $OUTPUT_LOCATION; fi 47 | vol.py dlllist >${OUTPUT_LOCATION}/dlllist_output 48 | vol.py getsids >${OUTPUT_LOCATION}/getsids_output 49 | vol.py handles >${OUTPUT_LOCATION}/handles_output 50 | vol.py filescan >${OUTPUT_LOCATION}/filescan_output 51 | vol.py mutantscan >${OUTPUT_LOCATION}/mutantscan_output 52 | vol.py svcscan >${OUTPUT_LOCATION}/svcscan_output 53 | vol.py cmdscan >${OUTPUT_LOCATION}/cmdscan_output 54 | vol.py consoles >${OUTPUT_LOCATION}/consoles_output 55 | 56 | 57 | 58 | 59 | 60 | -------------------------------------------------------------------------------- /jenkins/jobs/Volatility.6.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | Volatility - Step 6 - Dump Suspicious Processes and Drivers 5 | false 6 | 7 | 8 | 9 | 10 | MEMORY_IMAGE_FILE 11 | Location of the raw memory image. 12 | 13 | 14 | 15 | VOLATILITY_LOCATION 16 | Specify the location of the memory image to analyse. 17 | file://${MEMORY_IMAGE_FILE} 18 | 19 | 20 | VOLATILITY_PROFILE 21 | Specify the profile of the memory image to analyse. 22 | 23 | 24 | 25 | CASE_NAME 26 | Name of the case - used to build output paths. 27 | 28 | 29 | 30 | OUTPUT_LOCATION 31 | Location of the evidence processing output. 32 | /artifacts/${CASE_NAME} 33 | 34 | 35 | VOLATILITY_OUTPUT_LOCATION 36 | 37 | ${OUTPUT_LOCATION}/volatility-dumps 38 | 39 | 40 | 41 | 42 | 43 | true 44 | false 45 | false 46 | false 47 | 48 | true 49 | 50 | 51 | if [[ ! -d $OUTPUT_LOCATION ]]; then mkdir $OUTPUT_LOCATION; fi 52 | if [[ ! -d $VOLATILITY_OUTPUT_LOCATION ]] ; then 53 | mkdir $VOLATILITY_OUTPUT_LOCATION 54 | fi 55 | vol.py dlldump --dump-dir ${VOLATILITY_OUTPUT_LOCATION} >${OUTPUT_LOCATION}/dlldump_output 56 | vol.py moddump --dump-dir ${VOLATILITY_OUTPUT_LOCATION} >${OUTPUT_LOCATION}/moddump_output 57 | vol.py procdump --dump-dir ${VOLATILITY_OUTPUT_LOCATION} >${OUTPUT_LOCATION}/procdump_output 58 | vol.py memdump --dump-dir ${VOLATILITY_OUTPUT_LOCATION} >${OUTPUT_LOCATION}/memdump_output 59 | 60 | 61 | 62 | 63 | 64 | -------------------------------------------------------------------------------- /jenkins/jobs/Volatility.3.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | Volatility - Step 3 - Review Network Artifacts 5 | false 6 | 7 | 8 | 9 | 10 | MEMORY_IMAGE_FILE 11 | Location of the raw memory image. 12 | 13 | 14 | 15 | VOLATILITY_LOCATION 16 | Specify the location of the memory image to analyse. 17 | file://${MEMORY_IMAGE_FILE} 18 | 19 | 20 | VOLATILITY_PROFILE 21 | Specify the profile of the memory image to analyse. 22 | 23 | 24 | 25 | CASE_NAME 26 | Name of the case - used to build output paths. 27 | 28 | 29 | 30 | OUTPUT_LOCATION 31 | Specify the location of the memory image to analyse. 32 | /artifacts/${CASE_NAME} 33 | 34 | 35 | 36 | 37 | 38 | true 39 | false 40 | false 41 | false 42 | 43 | true 44 | 45 | 46 | if [[ ! -d $OUTPUT_LOCATION ]]; then mkdir $OUTPUT_LOCATION; fi 47 | if [[ $VOLATILITY_PROFILE =~ "WinXP" ]] ; then vol.py connections >${OUTPUT_LOCATION}/connections_output && vol.py connscan >${OUTPUT_LOCATION}/connscan_output && vol.py sockets >${OUTPUT_LOCATION}/sockets_output && vol.py sockscan >${OUTPUT_LOCATION}/sockscan_output; elif [[ $VOLATILITY_PROFILE =~ "Win2K3" ]] ; then vol.py connections >${OUTPUT_LOCATION}/connections_output && vol.py connscan >${OUTPUT_LOCATION}/connscan_output && vol.py sockets >${OUTPUT_LOCATION}/sockets_output && vol.py sockscan >${OUTPUT_LOCATION}/sockscan_output; elif [[ $VOLATILITY_PROFILE =~ "Win" ]] ; then vol.py netscan >${OUTPUT_LOCATION}/netscan_output; else echo "Unsupported Memory Image Profile to Review Network Artifacts"; fi 48 | 49 | 50 | 51 | 52 | 53 | -------------------------------------------------------------------------------- /jenkins/jobs/bulk_extractor.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | Stream Analysis - Runs Simson Garfinkel's bulk_Extractor against both Memory and Disk Image 5 | false 6 | 7 | 8 | 9 | 10 | MEMORY_IMAGE_FILE 11 | Location of the raw memory image 12 | /cases/xp-tdungan-10.3.58.7/xp-tdungan-memory/xp-tdungan-memory-raw.001 13 | 14 | 15 | DISK_IMAGE_FILE 16 | Location of the raw disk image 17 | /cases/xp-tdungan-10.3.58.7/xp-tdungan-c-drive/xp-tdungan-c-drive.E01 18 | 19 | 20 | DISK_ARTIFACTS 21 | 22 | /artifacts/xp-tdungan-10.3.58.7/bulk_extractor_disk 23 | 24 | 25 | MEMORY_ARTIFACTS 26 | 27 | /artifacts/xp-tdungan-10.3.58.7/bulk_extractor_memory 28 | 29 | 30 | 31 | 32 | 33 | true 34 | false 35 | false 36 | false 37 | 38 | true 39 | 40 | 41 | 42 | 43 | 44 | 45 | 46 | bulk_extractor_memory,bulk_extractor_disk 47 | ALWAYS 48 | false 49 | 50 | 51 | FAILURE 52 | 2 53 | RED 54 | true 55 | 56 | 57 | UNSTABLE 58 | 1 59 | YELLOW 60 | true 61 | 62 | 63 | FAILURE 64 | 2 65 | RED 66 | true 67 | 68 | 69 | false 70 | 71 | 72 | 73 | 74 | 75 | 76 | 77 | -------------------------------------------------------------------------------- /jenkins/jobs/Supertimeline.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | Create a Supertimeline with plaso for analysis 5 | false 6 | 7 | 8 | 9 | 10 | DISK_IMAGE_FILE 11 | Location of the disk image to create the supertimeline from 12 | 13 | 14 | 15 | CASE_NAME 16 | Name of the case - used to build the output path. 17 | 18 | 19 | 20 | OUTPUT_LOCATION 21 | Location of the supertimeline output file 22 | /artifacts/${CASE_NAME} 23 | 24 | 25 | TIMEZONE 26 | Timezone of the system being analysed. 27 | EST5EDT 28 | 29 | 30 | 31 | 32 | 33 | true 34 | false 35 | false 36 | false 37 | 38 | true 39 | 40 | 41 | 42 | 43 | ^$ 44 | ${ELK_IP} 45 | 46 | 47 | 48 | echo ELK_IP=`psql -d webpy -U webpy -S -t -c "select param_value from config where param_name = 'ELK-IP'"| sed 's/^ //'`>imageinfo.properties 49 | 50 | 51 | 52 | 53 | if [[ ! -d $OUTPUT_LOCATION ]]; then mkdir $OUTPUT_LOCATION; fi 54 | log2timeline.py ${OUTPUT_LOCATION}/plaso.dump $DISK_IMAGE_FILE 55 | psort.py -z$TIMEZONE -o L2tcsv -w ${OUTPUT_LOCATION}/supertimeline.csv ${OUTPUT_LOCATION}/plaso.dump 56 | 57 | 58 | 59 | 60 | 61 | 62 | imageinfo.properties 63 | true 64 | false 65 | false 66 | 67 | 68 | 69 | PlasoExporter 70 | ALWAYS 71 | false 72 | false 73 | 74 | 75 | 76 | 77 | 78 | 79 | 80 | -------------------------------------------------------------------------------- /webapp/ffate.py: -------------------------------------------------------------------------------- 1 | import web, os, hashlib 2 | import requests 3 | import threading 4 | import time 5 | import lxml.objectify 6 | 7 | urls = ( 8 | '/', 'index', 9 | '/reverse', 'reverse', 10 | '/ioc','ioc', 11 | '/search', 'search', 12 | '/search_archive', 'search_archive', 13 | '/add','add', 14 | '/process', 'process', 15 | '/config', 'config', 16 | '/dash','dashboard', 17 | '/close','close', 18 | '/reopen','reopen' 19 | ) 20 | 21 | db = web.database(dbn='postgres', db='webpy', user='webpy', pw='') 22 | 23 | render = web.template.render('/var/www/templates') 24 | 25 | web.template.Template.globals.update(dict( 26 | render = render, 27 | getsize = os.path.getsize, 28 | )) 29 | 30 | 31 | param_results = db.select('config',what='param_value', where='param_name = \'ELK-IP\'') 32 | for plaso_result in param_results: 33 | plaso_ip = plaso_result.param_value 34 | param_results = db.select('config',what='param_value', where='param_name = \'Plaso-dash\'') 35 | for plaso_result in param_results: 36 | plaso_dash = plaso_result.param_value 37 | plaso_url = "http://" + plaso_ip + ":9292/index.html#/dashboard/file/" + plaso_dash 38 | for572_url = "http://" + plaso_ip + ":9292/index.html#/dashboard/file/for572.json" 39 | xplico_url = "http://" + plaso_ip + ":9876/" 40 | 41 | 42 | class index: 43 | def GET(self): 44 | jenkins_url = web.ctx.homedomain + ":8080/" 45 | return render.tabbed("Forensicator FATE", jenkins_url, plaso_url) 46 | 47 | 48 | class add: 49 | def POST(self): 50 | i = web.input() 51 | n = db.insert('cases', casename=i.casename,memory_image=i.memory_image,disk_image=i.disk_image,disk_name=i.disk_name,timezone=i.timezone,volatility_profile=i.volatility_profile,notes=i.notes,case_keywords=i.case_keywords,status='open') 52 | raise web.seeother('/') 53 | 54 | 55 | class close: 56 | def POST(self): 57 | i = web.input() 58 | n = db.update('cases', where="id = " + i.CASE_ID,status='closed') 59 | raise web.seeother('/') 60 | 61 | 62 | class reopen: 63 | def POST(self): 64 | i = web.input() 65 | n = db.update('cases', where="id = " + i.CASE_ID,status='open') 66 | raise web.seeother('/') 67 | 68 | 69 | class reverse: 70 | def GET(self): 71 | name_hash = [] 72 | for (dirname, dirs, files) in os.walk('/reverse'): 73 | for filename in files: 74 | thefile = os.path.join(dirname,filename) 75 | name_hash.append(tuple([thefile, hashlib.md5(open(thefile, 'r').read()).hexdigest()])) 76 | 77 | return render.re_listing(name_hash) 78 | 79 | 80 | class ioc: 81 | def GET(self): 82 | name_hash = [] 83 | for (dirname, dirs, files) in os.walk('/ioc'): 84 | for filename in files: 85 | thefile = os.path.join(dirname,filename) 86 | 87 | # next 3 lines idea courtesy of Jeff Bryner http://www.jeffbryner.com/blog/itsec/pythoniocdump.html 88 | ioc_root = lxml.objectify.parse(thefile).getroot() 89 | short_desc = ioc_root.short_description 90 | desc = ioc_root.description 91 | 92 | name_hash.append(tuple([thefile, hashlib.md5(open(thefile, 'r').read()).hexdigest(), short_desc, desc])) 93 | 94 | return render.ioc_listing(name_hash) 95 | 96 | 97 | class search: 98 | def GET(self): 99 | return render.listing(db.select('cases',what='*',where="status is null or status<>'closed'",order='id',limit=10000), 'process') 100 | 101 | 102 | class search_archive: 103 | def GET(self): 104 | return render.archive_listing(db.select('cases',what='*',where="status='closed'",order='id',limit=10000)) 105 | 106 | 107 | class config: 108 | def GET(self): 109 | return render.cfg_listing(db.select('config',what='*',limit=10000)) 110 | 111 | 112 | class dashboard: 113 | def GET(self): 114 | jenkins_url = web.ctx.homedomain + ":8080/" 115 | return render.dash(plaso_url, jenkins_url, for572_url, xplico_url) 116 | 117 | 118 | class process: 119 | def POST(self): 120 | i = web.input() 121 | jenkins_url = web.ctx.homedomain + ":8080/" 122 | jenkins_job_url = jenkins_url + "job/findWindowsEvidence/buildWithParameters" 123 | jenkins_job_url_with_params = jenkins_job_url + "?CASE_NAME=" + i.CASE_NAME + "&MEMORY_IMAGE_FILE=" + i.MEMORY_IMAGE_FILE + "&DISK_IMAGE_FILE=" + i.DISK_IMAGE_FILE + "&DISK_NAME=" + i.DISK_NAME + "&TIMEZONE=" + i.TIMEZONE + "&VOLATILITY_PROFILE=" + i.VOLATILITY_PROFILE 124 | threading.Thread(target=requests.get, args=(jenkins_job_url_with_params,)).start() 125 | raise web.seeother('/') 126 | 127 | 128 | if __name__ == "__main__": 129 | app.run() 130 | 131 | 132 | app = web.application(urls, globals()) 133 | application = app.wsgifunc() 134 | -------------------------------------------------------------------------------- /jenkins/jobs/Volatility.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | Perform a Volatility Memory Analysis 5 | false 6 | 7 | 8 | 9 | 10 | MEMORY_IMAGE_FILE 11 | 12 | 13 | 14 | 15 | VOLATILITY_LOCATION 16 | Specify the location of the memory image to analyse. 17 | file://${MEMORY_IMAGE_FILE} 18 | 19 | 20 | VOLATILITY_PROFILE 21 | Specify the profile of the memory image to analyse. 22 | 23 | 24 | 25 | CASE_NAME 26 | Name of the case - used to build output paths 27 | 28 | 29 | 30 | OUTPUT_LOCATION 31 | 32 | /artifacts/${CASE_NAME} 33 | 34 | 35 | 36 | 37 | 38 | true 39 | false 40 | false 41 | false 42 | 43 | true 44 | 45 | 46 | 47 | 48 | ^$ 49 | $VOLATILITY_PROFILE 50 | 51 | 52 | 53 | vol.py imageinfo | guess_profile.pl 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | imageinfo.properties 64 | true 65 | false 66 | false 67 | 68 | 69 | Volatility.1,Volatility.2,Volatility.3,Volatility.4,Volatility.5,Volatility.6,Volatility.7,Volatility.8 70 | ALWAYS 71 | false 72 | 73 | 74 | FAILURE 75 | 2 76 | RED 77 | true 78 | 79 | 80 | UNSTABLE 81 | 1 82 | YELLOW 83 | true 84 | 85 | 86 | FAILURE 87 | 2 88 | RED 89 | true 90 | 91 | 92 | false 93 | 94 | 95 | 96 | 97 | 98 | 99 | 100 | -------------------------------------------------------------------------------- /scripts/install-jenkins.sh: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | sudo apt-get install jenkins 3 | #update Volatility to 2.4 4 | sudo apt-get install python-volatility 5 | sudo chgrp jenkins /ioc /blacklist /whitelist /reverse /artifacts 6 | sudo chmod g+w /ioc /blacklist /whitelist /reverse /artifacts 7 | sudo su - root -c 'echo "%jenkins ALL=(ALL:ALL) NOPASSWD:ALL" >/etc/sudoers.d/jenkins' 8 | sudo chmod 440 /etc/sudoers.d/jenkins 9 | sudo adduser sansforensics jenkins 10 | 11 | #from lucabelmondo on github (comment on https://gist.github.com/rowan-m/1026918) 12 | wget -O default.js http://updates.jenkins-ci.org/update-center.json 13 | sed '1d;$d' default.js > default.json 14 | sudo mkdir /var/lib/jenkins/updates 15 | sudo mv default.json /var/lib/jenkins/updates/ 16 | sudo chown -R jenkins:jenkins /var/lib/jenkins/updates 17 | sudo service jenkins restart 18 | 19 | #update Jenkins 20 | cd /usr/share/jenkins 21 | sudo mv jenkins.war jenkins-last-install.war 22 | # need to pin this to 1.575 as this is where jenkins devs (re)broke the cli 23 | sudo curl -o jenkins.war -L http://updates.jenkins-ci.org/download/war/1.575/jenkins.war 24 | cd ~ 25 | sudo service jenkins restart 26 | 27 | #wait for Jenkins to start 28 | until wget http://localhost:8080/ 2>&1 | grep "response" | grep -c "200 OK"; do echo Sleeping 15 seconds waiting for Jenkins to start... ; sleep 15 ; done 29 | 30 | #install plugins 31 | java -jar /run/jenkins/war/WEB-INF/jenkins-cli.jar -s http://localhost:8080 install-plugin parameterized-trigger 32 | java -jar /run/jenkins/war/WEB-INF/jenkins-cli.jar -s http://localhost:8080 install-plugin conditional-buildstep 33 | sudo service jenkins restart 34 | 35 | #wait for Jenkins to start 36 | until wget http://localhost:8080/ 2>&1 | grep "response" | grep -c "200 OK"; do echo Sleeping 15 seconds waiting for Jenkins to start... ; sleep 15 ; done 37 | 38 | #install jobs 39 | java -jar /run/jenkins/war/WEB-INF/jenkins-cli.jar -s http://localhost:8080 create-job bulk_extractor_disk 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 113 | 114 | 115 | 116 | $if cases: 117 | 118 | 119 | 120 | $for case in cases: 121 | $:render.li(case,jenkins_job_url) 122 |

id	casename	memory image	disk image	disk name	timezone	volatility_profile	notes	keywords

123 | 124 | 125 |

126 |

Required fields are case_name, at least one image file and timezone.

127 | 128 | 153 |

154 | 155 | 156 | 157 | -------------------------------------------------------------------------------- /jenkins/jobs/findWindowsEvidence.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | The Forensicator Pro "Find Evidence" Button as a Jenkins job - but only for Windows. 5 | false 6 | 7 | 8 | 9 | 10 | MEMORY_IMAGE_FILE 11 | Location of the raw memory image 12 | 13 | 14 | 15 | DISK_IMAGE_FILE 16 | Location of the raw disk image 17 | 18 | 19 | 20 | CASE_NAME 21 | 22 | 23 | 24 | 25 | OUTPUT_LOCATION 26 | Location of the evidence processing output 27 | /artifacts/${CASE_NAME} 28 | 29 | 30 | DISK_ARTIFACTS 31 | Location of the evidence bulk_extractor produces stream processing the disk image 32 | ${OUTPUT_LOCATION}/bulk_extractor_disk 33 | 34 | 35 | MEMORY_ARTIFACTS 36 | Location of the evidence bulk_extractor produces stream processing the memory image 37 | ${OUTPUT_LOCATION}/bulk_extractor_memory 38 | 39 | 40 | DISK_NAME 41 | Name of the disk for timeline output 42 | C: 43 | 44 | 45 | TIMEZONE 46 | Timezone of the system under analysis (*NOT* the examiner's timezone). 47 | EST5EDT 48 | 49 | 50 | VOLATILITY_PROFILE 51 | The target system type (if known) corresponding to any memory image supplied for analysis. If not provided, volatility will be invoked with the imageinfo plugin in an attempt to determine the correct value. 52 | 53 | 54 | 55 | WHITELIST 56 | List of hashes of files we trust. 57 | /whitelist/known_good_files.txt 58 | 59 | 60 | BLACKLIST 61 | List of hashes of known bad files. 62 | /blacklist/known_bad_files.txt 63 | 64 | 65 | 66 | 67 | 68 | true 69 | false 70 | false 71 | false 72 | 73 | true 74 | 75 | 76 | 77 | 78 | 79 | ^$ 80 | ${MEMORY_IMAGE_FILE} 81 | 82 | 83 | 84 | 85 | 86 | 87 | 88 | 89 | 90 | Volatility,bulk_extractor_memory 91 | ALWAYS 92 | false 93 | 94 | 95 | FAILURE 96 | 2 97 | RED 98 | true 99 | 100 | 101 | UNSTABLE 102 | 1 103 | YELLOW 104 | true 105 | 106 | 107 | FAILURE 108 | 2 109 | RED 110 | true 111 | 112 | 113 | false 114 | 115 | 116 | 117 | 118 | 119 | 120 | 121 | 122 | 123 | ^$ 124 | ${DISK_IMAGE_FILE} 125 | 126 | 127 | 128 | 129 | 130 | 131 | 132 | 133 | 134 | FStimeline,Supertimeline,sorter,bulk_extractor_disk,Carving 135 | ALWAYS 136 | false 137 | 138 | 139 | FAILURE 140 | 2 141 | RED 142 | true 143 | 144 | 145 | UNSTABLE 146 | 1 147 | YELLOW 148 | true 149 | 150 | 151 | FAILURE 152 | 2 153 | RED 154 | true 155 | 156 | 157 | false 158 | 159 | 160 | 161 | 162 | 163 | 164 | 165 | 166 | 167 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | Apache License 2 | Version 2.0, January 2004 3 | http://www.apache.org/licenses/ 4 | 5 | TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 6 | 7 | 1. Definitions. 8 | 9 | "License" shall mean the terms and conditions for use, reproduction, 10 | and distribution as defined by Sections 1 through 9 of this document. 11 | 12 | "Licensor" shall mean the copyright owner or entity authorized by 13 | the copyright owner that is granting the License. 14 | 15 | "Legal Entity" shall mean the union of the acting entity and all 16 | other entities that control, are controlled by, or are under common 17 | control with that entity. For the purposes of this definition, 18 | "control" means (i) the power, direct or indirect, to cause the 19 | direction or management of such entity, whether by contract or 20 | otherwise, or (ii) ownership of fifty percent (50%) or more of the 21 | outstanding shares, or (iii) beneficial ownership of such entity. 22 | 23 | "You" (or "Your") shall mean an individual or Legal Entity 24 | exercising permissions granted by this License. 25 | 26 | "Source" form shall mean the preferred form for making modifications, 27 | including but not limited to software source code, documentation 28 | source, and configuration files. 29 | 30 | "Object" form shall mean any form resulting from mechanical 31 | transformation or translation of a Source form, including but 32 | not limited to compiled object code, generated documentation, 33 | and conversions to other media types. 34 | 35 | "Work" shall mean the work of authorship, whether in Source or 36 | Object form, made available under the License, as indicated by a 37 | copyright notice that is included in or attached to the work 38 | (an example is provided in the Appendix below). 39 | 40 | "Derivative Works" shall mean any work, whether in Source or Object 41 | form, that is based on (or derived from) the Work and for which the 42 | editorial revisions, annotations, elaborations, or other modifications 43 | represent, as a whole, an original work of authorship. For the purposes 44 | of this License, Derivative Works shall not include works that remain 45 | separable from, or merely link (or bind by name) to the interfaces of, 46 | the Work and Derivative Works thereof. 47 | 48 | "Contribution" shall mean any work of authorship, including 49 | the original version of the Work and any modifications or additions 50 | to that Work or Derivative Works thereof, that is intentionally 51 | submitted to Licensor for inclusion in the Work by the copyright owner 52 | or by an individual or Legal Entity authorized to submit on behalf of 53 | the copyright owner. For the purposes of this definition, "submitted" 54 | means any form of electronic, verbal, or written communication sent 55 | to the Licensor or its representatives, including but not limited to 56 | communication on electronic mailing lists, source code control systems, 57 | and issue tracking systems that are managed by, or on behalf of, the 58 | Licensor for the purpose of discussing and improving the Work, but 59 | excluding communication that is conspicuously marked or otherwise 60 | designated in writing by the copyright owner as "Not a Contribution." 61 | 62 | "Contributor" shall mean Licensor and any individual or Legal Entity 63 | on behalf of whom a Contribution has been received by Licensor and 64 | subsequently incorporated within the Work. 65 | 66 | 2. Grant of Copyright License. Subject to the terms and conditions of 67 | this License, each Contributor hereby grants to You a perpetual, 68 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable 69 | copyright license to reproduce, prepare Derivative Works of, 70 | publicly display, publicly perform, sublicense, and distribute the 71 | Work and such Derivative Works in Source or Object form. 72 | 73 | 3. Grant of Patent License. Subject to the terms and conditions of 74 | this License, each Contributor hereby grants to You a perpetual, 75 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable 76 | (except as stated in this section) patent license to make, have made, 77 | use, offer to sell, sell, import, and otherwise transfer the Work, 78 | where such license applies only to those patent claims licensable 79 | by such Contributor that are necessarily infringed by their 80 | Contribution(s) alone or by combination of their Contribution(s) 81 | with the Work to which such Contribution(s) was submitted. If You 82 | institute patent litigation against any entity (including a 83 | cross-claim or counterclaim in a lawsuit) alleging that the Work 84 | or a Contribution incorporated within the Work constitutes direct 85 | or contributory patent infringement, then any patent licenses 86 | granted to You under this License for that Work shall terminate 87 | as of the date such litigation is filed. 88 | 89 | 4. Redistribution. You may reproduce and distribute copies of the 90 | Work or Derivative Works thereof in any medium, with or without 91 | modifications, and in Source or Object form, provided that You 92 | meet the following conditions: 93 | 94 | (a) You must give any other recipients of the Work or 95 | Derivative Works a copy of this License; and 96 | 97 | (b) You must cause any modified files to carry prominent notices 98 | stating that You changed the files; and 99 | 100 | (c) You must retain, in the Source form of any Derivative Works 101 | that You distribute, all copyright, patent, trademark, and 102 | attribution notices from the Source form of the Work, 103 | excluding those notices that do not pertain to any part of 104 | the Derivative Works; and 105 | 106 | (d) If the Work includes a "NOTICE" text file as part of its 107 | distribution, then any Derivative Works that You distribute must 108 | include a readable copy of the attribution notices contained 109 | within such NOTICE file, excluding those notices that do not 110 | pertain to any part of the Derivative Works, in at least one 111 | of the following places: within a NOTICE text file distributed 112 | as part of the Derivative Works; within the Source form or 113 | documentation, if provided along with the Derivative Works; or, 114 | within a display generated by the Derivative Works, if and 115 | wherever such third-party notices normally appear. The contents 116 | of the NOTICE file are for informational purposes only and 117 | do not modify the License. You may add Your own attribution 118 | notices within Derivative Works that You distribute, alongside 119 | or as an addendum to the NOTICE text from the Work, provided 120 | that such additional attribution notices cannot be construed 121 | as modifying the License. 122 | 123 | You may add Your own copyright statement to Your modifications and 124 | may provide additional or different license terms and conditions 125 | for use, reproduction, or distribution of Your modifications, or 126 | for any such Derivative Works as a whole, provided Your use, 127 | reproduction, and distribution of the Work otherwise complies with 128 | the conditions stated in this License. 129 | 130 | 5. Submission of Contributions. Unless You explicitly state otherwise, 131 | any Contribution intentionally submitted for inclusion in the Work 132 | by You to the Licensor shall be under the terms and conditions of 133 | this License, without any additional terms or conditions. 134 | Notwithstanding the above, nothing herein shall supersede or modify 135 | the terms of any separate license agreement you may have executed 136 | with Licensor regarding such Contributions. 137 | 138 | 6. Trademarks. This License does not grant permission to use the trade 139 | names, trademarks, service marks, or product names of the Licensor, 140 | except as required for reasonable and customary use in describing the 141 | origin of the Work and reproducing the content of the NOTICE file. 142 | 143 | 7. Disclaimer of Warranty. Unless required by applicable law or 144 | agreed to in writing, Licensor provides the Work (and each 145 | Contributor provides its Contributions) on an "AS IS" BASIS, 146 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or 147 | implied, including, without limitation, any warranties or conditions 148 | of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A 149 | PARTICULAR PURPOSE. You are solely responsible for determining the 150 | appropriateness of using or redistributing the Work and assume any 151 | risks associated with Your exercise of permissions under this License. 152 | 153 | 8. Limitation of Liability. In no event and under no legal theory, 154 | whether in tort (including negligence), contract, or otherwise, 155 | unless required by applicable law (such as deliberate and grossly 156 | negligent acts) or agreed to in writing, shall any Contributor be 157 | liable to You for damages, including any direct, indirect, special, 158 | incidental, or consequential damages of any character arising as a 159 | result of this License or out of the use or inability to use the 160 | Work (including but not limited to damages for loss of goodwill, 161 | work stoppage, computer failure or malfunction, or any and all 162 | other commercial damages or losses), even if such Contributor 163 | has been advised of the possibility of such damages. 164 | 165 | 9. Accepting Warranty or Additional Liability. While redistributing 166 | the Work or Derivative Works thereof, You may choose to offer, 167 | and charge a fee for, acceptance of support, warranty, indemnity, 168 | or other liability obligations and/or rights consistent with this 169 | License. However, in accepting such obligations, You may act only 170 | on Your own behalf and on Your sole responsibility, not on behalf 171 | of any other Contributor, and only if You agree to indemnify, 172 | defend, and hold each Contributor harmless for any liability 173 | incurred by, or claims asserted against, such Contributor by reason 174 | of your accepting any such warranty or additional liability. 175 | 176 | END OF TERMS AND CONDITIONS 177 | 178 | APPENDIX: How to apply the Apache License to your work. 179 | 180 | To apply the Apache License to your work, attach the following 181 | boilerplate notice, with the fields enclosed by brackets "{}" 182 | replaced with your own identifying information. (Don't include 183 | the brackets!) The text should be enclosed in the appropriate 184 | comment syntax for the file format. We also recommend that a 185 | file or class name and description of purpose be included on the 186 | same "printed page" as the copyright notice for easier 187 | identification within third-party archives. 188 | 189 | Copyright {yyyy} {name of copyright owner} 190 | 191 | Licensed under the Apache License, Version 2.0 (the "License"); 192 | you may not use this file except in compliance with the License. 193 | You may obtain a copy of the License at 194 | 195 | http://www.apache.org/licenses/LICENSE-2.0 196 | 197 | Unless required by applicable law or agreed to in writing, software 198 | distributed under the License is distributed on an "AS IS" BASIS, 199 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 200 | See the License for the specific language governing permissions and 201 | limitations under the License. 202 | 203 | --------------------------------------------------------------------------------