Pin
238
analyses.sh
Normal file
238
analyses.sh
Normal file
@@ -0,0 +1,238 @@
|
||||
#!/bin/bash
|
||||
|
||||
function EchoStatus {
|
||||
printf "\033[33;5m$1\033[0m\n"
|
||||
}
|
||||
|
||||
function EchoWarn {
|
||||
printf "\033[31;5m$1\033[0m\n"
|
||||
}
|
||||
|
||||
if [[ "$EUID" -ne 0 ]]; then
|
||||
EchoWarn "Please run as root... exiting"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [[ ! $(pwd | grep -E ".cuckoo/storage/analyses/[0-9]{1,}") ]] && [[ -z "$SKIP_CHECKS" ]]; then
|
||||
echo "This script is intended to be called while you are in
|
||||
~/.cuckoo/storage/analyses/{n}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if ! command -v docker >/dev/null; then
|
||||
EchoWarn "Please ensure Docker is installed"
|
||||
fi
|
||||
|
||||
EchoStatus "Creating /opt/latex-gen"
|
||||
mkdir -p /opt/latex-gen
|
||||
|
||||
EchoStatus "Generating Memory Profile"
|
||||
mem_profile=${mem_profile:-$(volatility -f $1 imageinfo 2>/dev/null | grep "Suggested Profile(s)" | tr -s " " | cut -d " " -f 5 | sed 's/,$//')}
|
||||
|
||||
## Psxview Section
|
||||
EchoStatus "Generating psxview report"
|
||||
psxview_report=$(volatility -f "$1" --profile="$mem_profile" psxview 2>/dev/null | tail -n +3 | tr -s " " | sed 's/ / \& /g;s/$/ \\\\/g')
|
||||
|
||||
## Svcscan Section
|
||||
EchoStatus "Generating svcscan report"
|
||||
svcscan_scan=$(volatility -f "$1" --profile="$mem_profile" svcscan 2>/dev/null)
|
||||
declare -a svcscan_array=()
|
||||
|
||||
x=0
|
||||
while IFS= read -r line; do
|
||||
if [[ -z $line ]]; then
|
||||
x=$(( $x + 1 ))
|
||||
else
|
||||
svcscan_array[$x]="${svcscan_array[$x]}$line "
|
||||
fi
|
||||
done <<< $svcscan_scan
|
||||
|
||||
## Dlllist Section
|
||||
EchoStatus "Generating dlllist report"
|
||||
dlllist_scan=$(volatility -f "$1" --profile="$mem_profile" dlllist 2>/dev/null)
|
||||
declare -a dlllist_array=()
|
||||
|
||||
x=0
|
||||
while IFS= read -r line; do
|
||||
if [[ $line == "************************************************************************" ]]; then
|
||||
x=$(( $x + 1 ))
|
||||
else
|
||||
dlllist_array[$x]="${dlllist_array[$x]}$line|"
|
||||
fi
|
||||
done <<< $dlllist_scan
|
||||
|
||||
## Hash Dump Section
|
||||
EchoStatus "Generating hashdump report"
|
||||
hashdump_scan=$(volatility -f "$1" --profile="$mem_profile" hashdump 2>/dev/null)
|
||||
|
||||
## Envars Section
|
||||
EchoStatus "Generating envars report"
|
||||
envars_scan=$(volatility -f "$1" --profile="$mem_profile" envars 2>/dev/null | tail -n +3 | sed -E 's|[ ]{2,}| \& |g;s|(.*)(0x[0-9a-fA-F]{1,})(.*)|\1\2 \&\3|;s|( \& [0-9]{1,})|\1 \&|;s|\\|\\textbackslash{}|g;s/^ \& //g;s/$/ \\\\/g;s|\$|\\\$|g;s|_|\\_|g')
|
||||
|
||||
## Json Report Data
|
||||
EchoStatus "Generating general run information"
|
||||
report_started=$(date -d@$(jq .info.started reports/report.json))
|
||||
run_options=$(jq .info.options reports/report.json)
|
||||
run_score=$(jq .info.score reports/report.json)
|
||||
run_log=$(jq -r .debug.log reports/report.json | tail -n +2 | head -n -1 | sed -E 's/[ ]{1,}"//g;s/\\n"[,]{0,1}$//g')
|
||||
|
||||
# Set file var
|
||||
EchoStatus "Generating /opt/latex-gen/main.tex"
|
||||
tex_file="/opt/latex-gen/main.tex"
|
||||
|
||||
EchoStatus "Generating LaTeX Doc"
|
||||
# Empty Temp File
|
||||
echo "" > $tex_file
|
||||
|
||||
# Generate file header
|
||||
echo "\documentclass[12pt]{article}
|
||||
\usepackage[margin=1in]{geometry} % Set margin to 1in
|
||||
\usepackage{tgtermes} % Times Font
|
||||
\usepackage{setspace} % Set spacing to 1.5
|
||||
\onehalfspacing
|
||||
\usepackage{graphicx} % Include Graphicx
|
||||
\graphicspath{{./images}}
|
||||
\usepackage{hyperref}
|
||||
\usepackage{float}
|
||||
\usepackage{listings}
|
||||
\usepackage{tabularx}
|
||||
\usepackage{ltablex}
|
||||
\usepackage{multicol}
|
||||
\newcolumntype{s}{>{\hsize=.45\hsize}X}
|
||||
\newcolumntype{m}{>{\hsize=.95\hsize}X}
|
||||
\newcolumntype{b}{>{\hsize=1.5\hsize}X}
|
||||
\lstset{
|
||||
basicstyle=\small\ttfamily,
|
||||
columns=flexible,
|
||||
breaklines=true
|
||||
}
|
||||
|
||||
\title{Cuckoo Report for: $(basename $(jq -r .target task.json))}
|
||||
\author{Report generated with analyses.sh}
|
||||
|
||||
|
||||
\date{\today}
|
||||
|
||||
\begin{document}
|
||||
|
||||
\maketitle
|
||||
|
||||
\newpage
|
||||
|
||||
\tableofcontents
|
||||
|
||||
\newpage
|
||||
" >> $tex_file
|
||||
|
||||
# Basic info section
|
||||
|
||||
echo "\section{Basic Information}" >> $tex_file
|
||||
|
||||
echo "\begin{lstlisting}[
|
||||
basicstyle=\small
|
||||
]
|
||||
Run Started: $report_started
|
||||
Memory Profile Used: $mem_profile
|
||||
Run Options: $run_options
|
||||
Run Score: $run_score
|
||||
Executable Name: $(basename $(jq -r .target task.json))
|
||||
Cuckoo Run ID: $(jq -r .id task.json)
|
||||
\end{lstlisting}
|
||||
" >> $tex_file
|
||||
|
||||
# Generate psxview section
|
||||
echo "
|
||||
\section{Psxview Log}
|
||||
\tiny
|
||||
\begin{tabularx}{\linewidth}{ |b|m|s|s|s|s|s|s|s|s|s|s|s| }
|
||||
\hline
|
||||
Offset & Name & PID & pslist & psscan & thrdproc & pspcid & csrss & session & deskthrd & Exit Date & Exit Time & Exit Zone \\\\
|
||||
\hline" >> $tex_file
|
||||
|
||||
echo "$psxview_report" >> $tex_file
|
||||
|
||||
echo " \hline
|
||||
\end{tabularx}
|
||||
" >> $tex_file
|
||||
|
||||
# Svcscan Section
|
||||
|
||||
echo "\section{Svcscan Section}" >> $tex_file
|
||||
|
||||
echo "\begin{multicols}{2}
|
||||
\begin{lstlisting}[
|
||||
basicstyle=\tiny
|
||||
]
|
||||
" >> $tex_file
|
||||
|
||||
echo "$svcscan_scan" >> $tex_file
|
||||
|
||||
echo "\end{lstlisting}
|
||||
\end{multicols}" >> $tex_file
|
||||
|
||||
# Generate run log section
|
||||
echo "\section{Run Log}
|
||||
" >> $tex_file
|
||||
|
||||
echo "\begin{lstlisting}[
|
||||
basicstyle=\tiny
|
||||
]
|
||||
" >> $tex_file
|
||||
|
||||
echo "$run_log" >> $tex_file
|
||||
|
||||
echo "\end{lstlisting}
|
||||
" >> $tex_file
|
||||
|
||||
# User HashDump Section
|
||||
|
||||
echo "\section{Hash Dump}
|
||||
\begin{lstlisting}[
|
||||
basicstyle=\small
|
||||
]
|
||||
" >> $tex_file
|
||||
|
||||
echo "$hashdump_scan" >> $tex_file
|
||||
|
||||
echo "\end{lstlisting}
|
||||
" >> $tex_file
|
||||
|
||||
# Envar Section
|
||||
echo "
|
||||
\section{Envars}
|
||||
\tiny
|
||||
\begin{tabularx}{\linewidth}{ |s|s|m|m|b| }
|
||||
\hline
|
||||
Pid & Process Name & Offset & Var & Value \\\\
|
||||
\hline" >> $tex_file
|
||||
|
||||
echo "$envars_scan" >> $tex_file
|
||||
|
||||
echo " \hline
|
||||
\end{tabularx}
|
||||
" >> $tex_file
|
||||
|
||||
# Dlllist Section
|
||||
|
||||
echo "\section{Dlllist}
|
||||
\begin{lstlisting}[
|
||||
basicstyle=\tiny
|
||||
]
|
||||
" >> $tex_file
|
||||
|
||||
echo "$dlllist_scan" >> $tex_file
|
||||
|
||||
echo "\end{lstlisting}
|
||||
" >> $tex_file
|
||||
|
||||
# Generate file end
|
||||
|
||||
echo "\end{document}
|
||||
" >> $tex_file
|
||||
|
||||
## Docker Setup
|
||||
|
||||
EchoStatus "Ensureing docker image is present"
|
||||
docker pull blang/latex >/dev/null
|
||||
EchoStatus "Typesetting LaTeX Doc"
|
||||
docker run -it --rm -v /opt/latex-gen:/mnt blang/latex pdflatex -halt-on-error -output-directory=/mnt /mnt/main.tex >/dev/null && EchoStatus "/opt/latex-gen/main.pdf has been created" || EchoWarn "There was an issue generating main.pdf"
|
||||
Reference in New Issue
Block a user