Avi's blog

 We will see how we can take forensic images in different format of windows and linux system.  The reason of taking image is we cannot work on the system where malicious activity has happened. We may inadvertently spoil the evidence. Also for team distribution work, we need multiple copies of images for collaboration.  One option is if the machine is physical/virtual windows --> We can use Microsoft's Sysinternal's tool Disk2vhd. Using this tool we can take vhd or vhdx format image. We can take C drive or whole drive image.  For Hyper-V VM --> Shutdown the VM then go to the VM folder to collect .vhdx forensic copy of the hard drive. After taking snapshot you can export VHDX.  For VMware VM --> Native disk format is vmdk. You can use StarWind V2V converter to convert vmdk file to vhd/vhdx. You can also use qemu-img tool to convert the same. qemu-img convert -O vpc disk.vmdk disk.vhd VirtualBox --> VBoxManage clonehd disk.vdi disk.vhd --format VHD Fo...

 Making volatility 3 profile - 20/08/2026 Let's assume we are dealing with the compromised system.  We first need to find the debugging kernel. This kernel had must been compiled with debugging symbols (volatility 3 need these to find out info) and after compilation, it should not be stripped. Please note, due to the huge size of this file, these are not generally comes now with the OS. On the compromised system run this command: find / -name vmlinu\* -size +100M 2>/dev/null You may get the following: /usr/lib/debug/boot/vmlinux-5.10.0-21-amd64  --> If you find this then this means it is the debugging version.  /boot/vmlinuz-5.10.0-21-amd64 --> and if you find this then it is kernel version file /usr/lib/debug/boot/vmlinux-5.10.0-21-amd64   /usr/lib/debug/boot/vmlinux-5.10.0-21-amd64: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, BuildID[sha1]=5e5d3209033f927baa64…,  with debug_info, not stripped --> This on...

 Bulk Extractor Using this tool, we will extract data from memory and then analysis during linux or windows IR activities.  As a prerequisite, we need a memory image. For example our memory image name is ubuntu.20211208.mem.gz Someday we will show how to capture memory images using avml or lime tool or other. See my medium writeup. ( https://mahimavi.medium.com/linux-memory-forensics-memory-capture-using-lime-avml-and-analysis-using-volatility-5d46c808158a ) From your linux forensic machine, run following commands: gunzip /images/All-Images/HudaksHoneypot/ ubuntu.20211208.mem.gz   Now you will have this file -  ubuntu.20211208.mem Now we will use bulk extractor tool. This tool available in kali and sans forensics machine as well. bulk_extractor -o be-output /images/All-Images/HudaksHoneypot/ubuntu.20211208.mem (Remember be-output directory should not be created early. This tool will create this directory on its own) You will see various files captured and extracted...

 Linux incident response UAC tool Installation... Download link of uac tool: https://github.com/tclahr/uac https://github.com/tclahr/uac/releases This tool does not need to be installed on the target/compromised system. Just ship the tool there and collect artefacts. Please download the latest release of the tool from the above link. You will get the tool under Assets section for example named as: uac-3.3.0.tar.gz Setting up uac tool: Taking the tool to the victim/compromised machine: scp uac-3.3.0.tar.gz lab@192.168.10.135:/tmp scp uac-3.3.0.tar.gz lab@192.168.10.135: (If you do not give /tmp then the tool will be placed under that lab user home directory. Now provide the password of the target system) ssh lab@192.168.10.135 (Access the target system with creds) cd /tmp tar zxf uac-3.3.0.tar.gz cd uac-3.3.0/ sudo ./uac -p ir_triage /root (Run the tool using root user or with sudo privilege. -p for profile. This is default profile. Later we will see how to make customized prof...

 Turning off windows update that leads windows 11 system auto restart. Open run dialog box in your windows system and type gpedit.msc If nothing comes then you need to enable it. Follow Avi's google blog https://mahimfiroj.blogspot.com/2024/07/how-to-enable-gpeditmsc-on-windows-11.html or follow this link: https://www.thewindowsclub.com/local-security-policy-missing-in-windows#google_vignette Then go to: Computer Configurations > Administrative Templates > Windows Components > Windows Update > Legacy Policies Now open the following policy or setting and Enabled it. No auto-restart with logged on users for scheduled automatic updates installations .  Now open command prompt with admin privilege and type: gpupdate /force Avi

Today we going to learn how to download nessus offline plugins. Before we proceed, we need to activate nessus with pro license key.  I am assuming that the nessus is activated via offline and the license key is not used anywhere else. Remember this offline plugins update will work only those nessus in where the license code is present. A combination of challenge id and license code is used to download the plugins. When you upload the plugins, then it checks whether the same license is present there or not. If not it will allow you to upload the plugins but actually it will not update the plugins .  Lets say, in windows server nessus is installed.  Navigate the below location from command prompt and run below command: C:\Program Files\Tenable\Nessus\nessuscli.exe fetch --challenge You will get the challenge id. Copy that. Now go to the below link: https://plugins.nessus.org/offline.php Provide the challenge id and license code. Once you submit, you will get Custom URL for ...