View difference between Paste ID: 8NXddejb and je3ZYqWt

                                #############################
 ############################## # Day 1: Linux Fundamentals # ##############################
                                #############################
 
 
 - Here is a good set of slides for getting started with Linux:
 http://www.slideshare.net/olafusimichael/linux-training-24086319
 
 
 - Here is a good tutorial that you should complete before doing the labs below:
 http://linuxsurvival.com/linux-tutorial-introduction/
-#####################################################
+
-# 2020 Digital Forensics & Incident Response        #
+
-# By Joe McCray                                     #
+
-#####################################################
+
 - http://the.earth.li/~sgtatham/putty/latest/x86/putty.exe
 
 Here is the information to put into putty
 
 Host Name:          149.28.201.171
 protocol:           ssh
 port:               22
 username:           casp
 password:           casp!casp123!
 
 
 If you are on a Mac (https://osxdaily.com/2017/04/28/howto-ssh-client-mac/)
 
 Open a terminal, then type:
 -------------------------------
 ssh -l casp 149.28.201.171
 ------------------------------
 
-username:           chfi
+
-password:           chfi!chfi123!
+
 ####################
 
 
 
 - After logging please open a terminal window and type the following commands:
 ---------------------------Type This-----------------------------------
-ssh -l chfi 149.28.201.171
+
 
 cp malware.exe malware.pdf
 
 file malware.pdf
 
-########################
+cp malware.pdf malware.exe
-# Basic Linux Commands #
+
-########################
+
 -----------------------------------------------------------------------
 
-cd ~
+
 ***What is '4d 5a' or 'MZ'***
-pwd
+
 http://www.garykessler.net/library/file_sigs.html
-whereis pwd
+
 
-which pwd
+
 
-sudo find / -name pwd
+
 
-/bin/pwd
+
 
-cd ~/students/
+
 objdump -x malware.exe
-mkdir yourname                  <---- replace 'yourname' with your first name in lowercase with no spaces or special characters please
+
 strings malware.exe
-cd yourname                     <---- replace 'yourname' with your first name in lowercase with no spaces or special characters please
+
 strings --all malware.exe | head -n 6
-touch one two three
+
 strings malware.exe | grep -i dll
-ls -l t                         (without pressing the Enter key, press the Tab key twice. What happens?)
+
 strings malware.exe | grep -i library
-h                               (and again without pressing the Enter key, press the Tab key twice. What happens?)
+
 strings malware.exe | grep -i reg
-Press the 'Up arrow key'        (What happens?)
+
 strings malware.exe | grep -i hkey
-Press 'Ctrl-A'                  (What happens?)
+
 strings malware.exe | grep -i hku
-ls
+
                             - We didn't see anything like HKLM, HKCU or other registry type stuff
-clear                           (What happens?)
+
 
-echo one > one
+
 strings malware.exe | grep -i irc
-cat one                         (What happens?)
+
 strings malware.exe | grep -i join
-man cat                         (What happens?)
+
-    q
+
 
-cat two
+
 -----------------------------------------------------------------------
-cat one > two
+
                             - List of IRC commands: https://en.wikipedia.org/wiki/List_of_Internet_Relay_Chat_commands
-cat two
+
 ---------------------------Type This-----------------------------------
-cat one two > three
+
 
-cat three
+
 -----------------------------------------------------------------------
-echo four >> three
+
 
-cat three                       (What happens?)
+
 
-wc -l three
+
 ---------------------------Type This-----------------------------------
-man wc
+
-    q
+
 objdump -x wannacry.exe | less
-info wc
+
-    q
+
 strings wannacry.exe
-cat three | grep four
+
 strings wannacry.exe | grep -i dll
-cat three | grep one
+
 strings wannacry.exe | grep -i library
-man grep
+
-    q
+
 
 strings wannacry.exe | grep -i key
-man ps
+
-    q
+
 
-ps
+
 
-ps aux
+
 
-ps aux | less
+
 
-Press the 'Up arrow key'        (What happens?)
+
 
-Press the 'Down arrow key'      (What happens?)
+
-    q
+
 strings wannacry.exe | grep -i admin
-top
+
-    q
+
 ----------------------------------------------------------------------
 
 
-#########
+
-# Files #
+
-#########
+
 
-cd ~
+
 
-pwd
+
 Reference
-cd ~/students/yourname/
+
 
-pwd
+
 
-ls
+
 Strings:
-mkdir LinuxBasics
+
 $s2 = “Wanna Decryptor” wide ascii nocase
-cd LinuxBasics
+
 $s4 = “WANNACRY” wide ascii nocase
-pwd
+
 $s7 = “icacls . /grant Everyone:F /T /C /Q” wide ascii nocase
-ls
+
 
-mkdir files
+
 
-touch one two three
+
 
-cp one files/
+
 
-ls files/
+
 
-cd files/
+
 ---------------------------Type This-----------------------------------
-cp ../two .
+
 
-ls
+
 
-cp ../three .
+
 
-ls
+
 
-tar cvf files.tar *
+
  -----------------------------------------------------------------------
-ls
+
 
-gzip files.tar
+
 
-ls
+
 ################################
-rm -rf one two three
+
 ################################
-ls
+
 References:
-tar -zxvf files.tar.gz
+
 https://gist.github.com/rain-1/989428fa5504f378b993ee6efbc0b168
-rm -rf files.tar.gz
+
 https://joesecurity.org/reports/report-db349b97c37d22f5ea1d1841e3c89eb4.html
-zip data *
+
 
-unzip -l data.zip
+
 
-mkdir /tmp/yourname/
+
 
-unzip data.zip -d /tmp/yourname/
+
 
 
 
 ####################################
 # Tired of GREP - let's try Python #
-##############################################
+
-# Log Analysis with Linux command-line tools #
+
-##############################################
+
-- The following command line executables are found in the Mac as well as most Linux Distributions.
+
 https://infosecaddicts-files.s3.amazonaws.com/analyse_malware.py
-cat –  prints the content of a file in the terminal window
+
-grep – searches and filters based on patterns
+
-awk –  can sort each row into fields and display only what is needed
+
-sed –  performs find and replace functions
+
-sort – arranges output in an order
+
-uniq – compares adjacent lines and can report, filter or provide a count of duplicates
+
 
 This is really good for showing some good signatures to add to the Python script
 
 ---------------------------Type This-----------------------------------
 nano am.py
-##############
+
-# Cisco Logs #
+python3 am.py wannacry.exe
-##############
+-----------------------------------------------------------------------