Another horribly inelegant script, but one I also definitely don't want to have to rewrite (took a lot more trial and error than it should have.) A little specific to my environment, and I'd like to find a better tool to leverage over Redline for this style of dump, but... For now this works and will save me a fair bit of time =)
#!/bin/bash
set -e
#Script to copy over the necessary files and take a memory dump from a target computer
if [ $# -ne 2 ]
then
echo "Useage: memorydump //host destinationFileName"
else
#This mounts the necessary folders
read -s -p "Please enter your AD password: " pass
echo
echo "Mounting drives..."
if mountpoint -q /mount/cshare
then
umount /mount/cshare
fi
mount -t cifs -o "user=username,password=$pass" "$1/C$" /mount/cshare #hardcoded in my username
#Copy over the necessary files
echo "Copying the Redline folder to target..."
cp -r /root/misc/Redline /mount/cshare/Temp
#Execute the script
echo "Executing script..."
winexe -U "domain/username%$pass" $1 'cmd.exe /c C:\Temp\Redline\RunRedlineAudit.bat' #hardcoded my domain and username in on this one also
sleep 5
#Dynamicallay assign the folder and files created to move once completed
dir=$(ls -A /mount/cshare/Temp/Redline/Sessions/AnalysisSession1/Audits)
dir+="/"$(ls -A /mount/cshare/Temp/Redline/Sessions/AnalysisSession1/Audits/$dir)
file=$(ls -A /mount/cshare/Temp/Redline/Sessions/AnalysisSession1/Audits/$dir | grep w32memory-ac | grep -v issues)
sleep 3m #Was trying to do this dynamically when the file was done, but it appears impossible over a cifs share. 3 minutes is a sufficient sleep time for it to finish.
echo "Copying memory image to /root/ramdumps/$2, this may take a while..."
if [ ! -d /root/randumps/$(echo $2 | awk -F "-" {'print $1'}) ] #This assumes the file names I use, username-mm-dd-yy.memdump
then
mkdir /root/ramdumps/$(echo $2 | awk -F "-" {'print $1'})
fi
cp
/mount/cshare/Temp/Redline/Sessions/AnalysisSession1/Audits/$dir/$file
/root/ramdumps/$(echo $2 | awk -F "-" {'print $1'})/$2
#Unmount the drives now that they're no longer in use
echo "Dismounting the network drives..."
umount /mount/cshare
fi
No comments:
Post a Comment