Ultimate-Forensics-VM - GitLite

KO | EN

gitlite — search

#javascript #ai #typescript #llm #go #golang #machine-learning #rust #deep-learning #nodejs #awesome #kubernetes #ios #open-source

Ultimate-Forensics-VM

(★ 162)

Evolving directions on building the best Open Source Forensics VM

파일 탐색기

최종 버전 다운로드 (.zip)

- - Dockerfile
- - Dockerfile
- - Dockerfile
- - Dockerfile
- jsdetox.sh
- README.md
- start-remnux.sh
- start-sift.sh
- start-sonion.sh
jsdetox.sh
new-investigation.sh
README.md
yara.sh

# 설치 가이드

1. 코드 내려받기

git clone https://github.com/theflakes/Ultimate-Forensics-VM

깃허브에서 프로젝트 코드 전체를 내 컴퓨터로 내려받습니다.

cd Ultimate-Forensics-VM

방금 내려받은 프로젝트 폴더 안으로 이동합니다.

2. Docker

쉬움 추천

사전 준비물

Git GitHub에서 프로젝트 코드를 내려받으려면 필요합니다.
Docker Desktop 컨테이너를 빌드하고 실행하려면 필요합니다. 설치 후 실행해서 백그라운드에 켜두세요.

⚠️ 이 프로젝트는 규모가 큰 저장소라, 이 방법이 실제 핵심 제품이 아니라 내부 하위 패키지를 가리키는 것일 수 있습니다. README 전체를 함께 확인해보세요.

docker build -f docker/powershell/Dockerfile -t ultimate-forensics-vm .

Dockerfile을 기반으로 실행 가능한 이미지를 빌드합니다.

docker run -p 8080:80 ultimate-forensics-vm

빌드된 이미지를 실제 컨테이너로 실행합니다.

✅ 터미널에 docker compose ps 를 입력해 컨테이너들이 Up 상태인지 확인하세요. README에 포트 번호가 적혀있다면 브라우저에서 http://localhost:포트번호 로 접속해보세요.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

***Had issues with APT updates breaking and I don't feel like messing with APT problems.  Therefore I am attempting to move to a Docker based forensics VM.  See the docker directory for more information.***  
The below may still work but I don't feel like troubleshooting the APT conflicts.

# Ultimate-Forensics-VM
Evolving directions on building the best Open Source Forensics VM

**VM minimum config recommendations:**  
- 2 procs  
- 4GB RAM  
- 30GB disk space  
- 2 NICs  
  - One shared or direct connect  
  - One host only  
      - Use this NIC for the SO monitor interface  
      - Replay your PCAPs on this interface

**Install Ubuntu 14.04 LTS and run:**  
sudo apt-get update  
sudo apt-get upgrade  
sudo apt-get update  
sudo apt-get dist-upgrade  
sudo reboot

**Install SIFT Workstation:**  
wget --quiet -O - https://raw.github.com/sans-dfir/sift-bootstrap/master/bootstrap.sh | sudo bash -s -- -i  
sudo apt-get update  
sudo apt-get upgrade  
sudo reboot

**Install Remnux Tools:**  
wget --quiet -O - https://remnux.org/get-remnux.sh | sudo bash  
sudo apt-get update  
sudo apt-get upgrade  
sudo reboot

(above three steps sourced from: https://digital-forensics.sans.org/blog/2015/06/13/how-to-install-sift-workstation-and-remnux-on-the-same-forensics-system)

**Install JSDetox Docker:**  
	- Awesome JavaScript forensic tool: http://www.relentless-coding.com/projects/jsdetox/  
sudo apt-get install docker  
sudo apt-get update  
sudo apt-get upgrade  
***Run JSDetox:***  
docker run  
sudo docker run --rm -p 3000:3000 remnux/jsdetox  
To stop JSDetox --> use "sudo docker ps -l" to obtain the container ID, then use the "sudo docker stop *container-id*" and wait about a minute.  
Source: https://hub.docker.com/r/remnux/jsdetox/

**Install SecurityOnion:**  
echo "debconf debconf/frontend select noninteractive" | sudo debconf-set-selections  
sudo apt-get -y install software-properties-common  
sudo add-apt-repository -y ppa:securityonion/stable  
sudo apt-get update  
sudo apt-get -y install securityonion-all syslog-ng-core  
Now setup SecurityOnion as a standalone server.  
	- You can now run PCAPs against the monitor interface and have Bro and Suricata run against them.  
	- Install all of your custom Bro scripts  
	- View the results of the PCAP replay in Sguil and ELSA.  
Source: https://github.com/Security-Onion-Solutions/security-onion/wiki/InstallingOnUbuntu

**Install Libemu:**  
sudo apt-get install python-libemu

**Install YARA rules:** 
https://github.com/Yara-Rules/rules  
mkdir yara  
cd yara  
git clone https://github.com/Yara-Rules/rules.git  
**Update to latest YARA version and enable various support:**  
Download latest version of Yara  
tar -xzf yara-3.X.0.tar.gz   
cd yara-3.4.0/  
./bootstrap.sh  
sudo apt-get install libjansson-dev  
./configure --with-crypto --enable-cuckoo --enable-magic  
make  
sudo make install  
cd yara-python/  
python setup.py build  
sudo python setup.py install  
yara -v  
**more work to do here, not sure if this is the best way forward

**Update SIFT and Remnux:**  
update-sift  
update-remnux

**If you have any APT keys that need added run the below command.**  
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys KEY

**Reset ELSA DB**  
(good to do before starting a new investigation)  
securityonion-elsa-reset