It's quick and dirty, like most of my scripts, but I'm dumping it here so that I can easily drop it onto a new computer/build/VM/whatever...
#!/bin/bash
#Simply runs a bunch of my most commonly used volatility plugins
if [ $# -lt 2 ]
then
#I added the script to /usr/bin/memscan and gave it execute
echo "Useage: memscan imagename profile"
else
if [ ! -d dump ];
then
#The script doesn't use this folder, but I do ;)
mkdir dump
fi
for plugin in pslist pstree psxview malfind hivelist dlllist
do
echo "Running $plugin"
python /usr/share/volatility/vol.py -f $1 --profile=$2 $plugin > $plugin.txt
done
echo "Running autoruns"
python /usr/share/volatility/vol.py --plugins=/usr/share/
echo "Running mimikatz"
python /usr/share/volatility/vol.py --plugins=/usr/share/
echo "Creating timeline"
python /usr/share/volatility/vol.py -f $1 --profile=$2 mftparser --output=body --output-file=mftparser.txt
mactime -b mftparser.txt -d -z UTC-6 > timeline.txt
fi
No comments:
Post a Comment