lense 0.1.20 → 0.1.22

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: e2912fe447a26bd1b7c26ccb9c2dd38a1dbed0e5
-  data.tar.gz: a9f65b082695991d3b62623a28127a77762aee77
+  metadata.gz: e0a7ee6941c8b35eb8bcf4e4e0c6fc73aa1b3e48
+  data.tar.gz: 29f9d6f898f4d3fa101374f34de654de2d692366
 SHA512:
-  metadata.gz: 01146da48f9b4a16ebc8ff92cc54e8d45b8195e777493383b967ec7957dcac697e493b050bf882d33b687f3e7a4d0e76a2544572796defe959c3e63b79d00474
-  data.tar.gz: 73b5ba662dffc0f6262f0ae3d9cf68cd8e688516a5e079b3a08ee31a88c69cefe0612224a8989f6a4f902b852cb46ad70551946353e6945f041d09bf21ac3512
+  metadata.gz: 795bc589851d6630bcfe27ce3806474a192276620aa31ec8046b55920b6777983eef4ee179d1cd8bba32aef80f27df02229be56d42cc822fe68505711124b7cd
+  data.tar.gz: 2604c7aebd3db4caf242dbb220bef70e5800ceaf589a8f8aa6ce8bdb97806d5911060a12112f11b04832ca091180ee2c5e0b44dcb77cd016c61b5b8e35024031

data/Gemfile

@@ -4,3 +4,4 @@ gemspec
 gem "gli", ">= 2.13.0"
 gem "psych", ">= 2.0.13"
 gem "rest-client", ">= 1.8.0"
+gem "highline", ">= 1.7.2"

data/bin/lense

@@ -45,8 +45,7 @@ command :search do |c|
 end
 
 command :up do |c|
-  c.action do
-    puts 'TODO implement starting of current course'
+  c.action do |global_options,options,args|
   end
 end
 

data/data/mfwvl1.yaml

@@ -0,0 +1,54 @@
+---
+# Name of course. Should match website
+course_name: Memory Forensics With Volatility Lesson 1
+
+# Folder in ~/.lense directory
+folder_name: mfwvl1
+
+# Eh why not?
+course_difficulty: 1
+
+# Items to download. Should be placed in ~/.lense/<folder_name>
+downloads:
+  - https://drive.google.com/file/d/0B50xr4dwmqonNmtpa3pycGM4WXM/view?usp=sharing
+
+# Any docker containers to pull.
+docker: llacoste/docker_volatility
+
+# The final command to open in a new terminal.
+entry_point: docker run -v ~/.lense/mfwvl1/my_memory_sample.vmem:/data -i -t
+
+# Begin the lesson.
+lesson_plan:
+  - say: Load up volshell on the windows_xp.vmem image (volatility -f windows_xp.vmem volshell)
+
+  - say: 'We are going to take a look at some TYPEs in volshell. Using the dt command inspect: _EPROCESS _ETHREAD _TOKEN'
+    question:
+      ask: What do you see?
+      hint: 'Enter: dt("<TYPE>")'
+      expect: '*'
+
+  - say: Exit volshell and run pslist
+    question:
+      ask: What process has PID 296?
+      expect: svchost.exe
+
+  - say: Now run psscan
+    question:
+      ask: What is the offset of the explorer.exe process with PID 236
+      expect: '0x0000000005201a08'
+
+  - say: Now run pstree
+    question:
+      ask: What is the name of the first child process of explorer.exe with PID 236
+      expect: vmtoolsd.ex
+
+  - say: Now run psxview
+    question:
+      ask: What process has PID 296?
+      expect: svchost.exe
+
+  - say: You can look at the privileges of a process by using the privs plugin along with the -p flag. Use the -p flag on various plugins to focus on a particular process with the given PID i.e. -p 236 for explorer.exe. Run privs on explorer.exe
+    question:
+      ask: What are the privileges for SeImpersonatePrivilege
+      expect: Present,Enabled,Default

data/lib/lense.rb

@@ -1,8 +1,10 @@
 require 'rest-client'
+require 'highline/import'
+
 class LENSE
   attr_reader :config, :current_course
 
-  VERSION             = '0.1.20'
+  VERSION             = '0.1.22'
   LENSE_DIR           = File.join(ENV['HOME'],'.lense')
   COURSES_DIR         = File.join(LENSE_DIR,'courses')
   CURRENT_COURSE_FILE = File.join(LENSE_DIR,'current_course')
@@ -57,4 +59,46 @@ class LENSE
       puts ""
     end
   end
+
+  def run()
+    q_prefix = '<%= color("Q? ",:red) %>'
+    hint_prefix = '<%= color("Hint: ",:yellow) %>'
+    say_prefix = '<%= color("% ",:blue) %>'
+    answer_prefix = '<%= color("Ans: ",:red) %>'
+    question_separator = '<%= color("---",:green) %>'
+
+    test_file = 'data/mfwvl1.yaml'
+    test_str = File.file?(test_file) ? File.read(test_file) : ''
+    lense_file = Psych.load(test_str) || {}
+
+    lense_file['lesson_plan'].each do |lesson|
+      say question_separator
+      say "#{say_prefix} #{lesson['say']}" if lesson['say']
+
+      if lesson['question'] && lesson['question']['ask']
+        asked, hint_limit, max_asked, correct  = 0, 3, 5, false
+
+        until correct || asked >= max_asked do
+          asked += 1
+          question = lesson['question']['ask']
+          hint = lesson['question'] && lesson['question']['hint']
+
+          show_hint = ''
+
+          if hint && asked > hint_limit
+            show_hint = "\n#{hint_prefix} #{hint}"
+          end
+
+          response = ask "#{q_prefix} #{question}#{show_hint}"
+          correct = response == lesson['question']['expect']
+        end
+
+        if correct
+          say "<%= color('Correct!',:green) %>"
+        else
+          say "#{answer_prefix} #{lesson['question']['expect']}"
+        end
+      end
+    end
+  end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: lense
 version: !ruby/object:Gem::Version
-  version: 0.1.20
+  version: 0.1.22
 platform: ruby
 authors:
 - Manuel Zubieta
@@ -54,6 +54,7 @@ files:
 - README.md
 - Rakefile
 - bin/lense
+- data/mfwvl1.yaml
 - lense.gemspec
 - lib/lense.rb
 - lib/lense/helpers.rb