Avi's blog

 Bulk Extractor Using this tool, we will extract data from memory and then analysis during linux or windows IR activities.  As a prerequisite, we need a memory image. For example our memory image name is ubuntu.20211208.mem.gz Someday we will show how to capture memory images using avml or lime tool or other. See my medium writeup. ( https://mahimavi.medium.com/linux-memory-forensics-memory-capture-using-lime-avml-and-analysis-using-volatility-5d46c808158a ) From your linux forensic machine, run following commands: gunzip /images/All-Images/HudaksHoneypot/ ubuntu.20211208.mem.gz   Now you will have this file -  ubuntu.20211208.mem Now we will use bulk extractor tool. This tool available in kali and sans forensics machine as well. bulk_extractor -o be-output /images/All-Images/HudaksHoneypot/ubuntu.20211208.mem (Remember be-output directory should not be created early. This tool will create this directory on its own) You will see various files captured and extracted...

 Linux incident response UAC tool Installation... Download link of uac tool: https://github.com/tclahr/uac https://github.com/tclahr/uac/releases This tool does not need to be installed on the target/compromised system. Just ship the tool there and collect artefacts. Please download the latest release of the tool from the above link. You will get the tool under Assets section for example named as: uac-3.3.0.tar.gz Setting up uac tool: Taking the tool to the victim/compromised machine: scp uac-3.3.0.tar.gz lab@192.168.10.135:/tmp scp uac-3.3.0.tar.gz lab@192.168.10.135: (If you do not give /tmp then the tool will be placed under that lab user home directory. Now provide the password of the target system) ssh lab@192.168.10.135 (Access the target system with creds) cd /tmp tar zxf uac-3.3.0.tar.gz cd uac-3.3.0/ sudo ./uac -p ir_triage /root (Run the tool using root user or with sudo privilege. -p for profile. This is default profile. Later we will see how to make customized prof...

 Turning off windows update that leads windows 11 system auto restart. Open run dialog box in your windows system and type gpedit.msc If nothing comes then you need to enable it. Follow Avi's google blog https://mahimfiroj.blogspot.com/2024/07/how-to-enable-gpeditmsc-on-windows-11.html or follow this link: https://www.thewindowsclub.com/local-security-policy-missing-in-windows#google_vignette Then go to: Computer Configurations > Administrative Templates > Windows Components > Windows Update > Legacy Policies Now open the following policy or setting and Enabled it. No auto-restart with logged on users for scheduled automatic updates installations .  Now open command prompt with admin privilege and type: gpupdate /force Avi

Today we going to learn how to download nessus offline plugins. Before we proceed, we need to activate nessus with pro license key.  I am assuming that the nessus is activated via offline and the license key is not used anywhere else. Remember this offline plugins update will work only those nessus in where the license code is present. A combination of challenge id and license code is used to download the plugins. When you upload the plugins, then it checks whether the same license is present there or not. If not it will allow you to upload the plugins but actually it will not update the plugins .  Lets say, in windows server nessus is installed.  Navigate the below location from command prompt and run below command: C:\Program Files\Tenable\Nessus\nessuscli.exe fetch --challenge You will get the challenge id. Copy that. Now go to the below link: https://plugins.nessus.org/offline.php Provide the challenge id and license code. Once you submit, you will get Custom URL for ...

  Cloning is a nice feature of VMware Workstation Pro. Just right click of your vm > Manage > Clone > Then specify in which folder you want save the new cloned vm. Then start cloning. Use case: Say you need 4 windows 10 machines. Just setup one and then clone it to make it 4 Avi

 Probably the target host that you are scanning do not respond to icmp echo ping request. It may think that someone launch an attack against itself. So the host firewall on the target system may blocking what Nessus wants to do.  So here are the steps you can do: Go to nessus > select the host and choose configure. Select the scan type as custom instead of port scan (common or all ports). Now go to host discovery and turn off the ping the remote host. Hopefully your scan should work now. Thanks Mahim Avi.