lense 0.1.26 → 0.1.27

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 93081a4dd98c443306c190459fcd3005e51e8c06
-  data.tar.gz: 9ecceca898731f2abcb7d97292dc3e24399fbc29
+  metadata.gz: 54de025704648557ef47653d51dd11713e0858ff
+  data.tar.gz: 209f2ab433994e0f0c980e6a46aa100404e0763f
 SHA512:
-  metadata.gz: 9e71efcc4ad9c150a6095eb554d1dd5a58aa0bcbcb26f4f76f1c2c07264599fcdcad5d3c783361ff0989e1a63f0a75f2cd9661abdc5fb7df0f9a988ae8c11148
-  data.tar.gz: 7eac7d1e887c6c1cbd310ac7a02c88bb1f09aece10096854c79f99ab2ccded0225264b0eb34478d7be433ea3fa7fa300a7377dcff0bcc8135d48d6e17dc6d5ce
+  metadata.gz: ecbbd3c9213572404a875a4e468d135709dc862193ae183d88d0808bfd75b9a8bcb919dca9633a91c97f95820d940b7bfd47ea26fa796eaa5b00d38805f00cc1
+  data.tar.gz: f6bc4e7681f767aea8bf84678f54b693cf9f01d8e6e58cbaa6a51455efc4b9ca5bb10a3f42a318cbe9cd2d2e3f54285f51f20d32e9d788be88c9a89e068163ca

data/data/mfwvl1.yaml

@@ -1,57 +1,52 @@
 ---
-# Name of course. Should match website
-course:
-  title: Memory Forensics With Volatility Lesson 1
-  difficulty: 1
-  authors:
-    - name: Lance Lacoste
-      email: lance.lacoste@gmail.com
-
-  # Items to download. Should be placed in ~/.lense/<folder_name>
-  data:
-    # ~/.lense/courses/llacoste/mfwvl1/data/foo
-    - rel: data
-      url: https://drive.google.com/file/d/0B50xr4dwmqonNmtpa3pycGM4WXM/view?usp=sharing
-      description: "why you need it?"
-    # ~/.lense/courses/llacoste/mfwvl1/data/memdumps/foo
-    - rel: data/memdumps
-      url: https://drive.google.com/file/d/0B50xr4dwmqonNmtpa3pycGM4WXM/view?usp=sharing
-      description: "why you need it?"
-
-  # The final command to open in a new terminal.
-  entry_point: docker run -v ~/.lense/mfwvl1/my_memory_sample.vmem:/data -i -t llacoste/docker_volatility
-
-  # Begin the lesson.
-  lesson_plan:
-    - say: Load up volshell on the windows_xp.vmem image (volatility -f windows_xp.vmem volshell)
-
-    - say: 'We are going to take a look at some TYPEs in volshell. Using the dt command inspect: _EPROCESS _ETHREAD _TOKEN'
-      question:
-        ask: What do you see?
-        hint: 'Enter: dt("<TYPE>")'
-        expect: '*'
-
-    - say: Exit volshell and run pslist
-      question:
-        ask: What process has PID 296?
-        expect: svchost.exe
-
-    - say: Now run psscan
-      question:
-        ask: What is the offset of the explorer.exe process with PID 236
-        expect: '0x0000000005201a08'
-
-    - say: Now run pstree
-      question:
-        ask: What is the name of the first child process of explorer.exe with PID 236
-        expect: vmtoolsd.exe
-
-    - say: Now run psxview
-      question:
-        ask: What process has PID 296?
-        expect: svchost.exe
-
-    - say: You can look at the privileges of a process by using the privs plugin along with the -p flag. Use the -p flag on various plugins to focus on a particular process with the given PID i.e. -p 236 for explorer.exe. Run privs on explorer.exe
-      question:
-        ask: What are the privileges for SeImpersonatePrivilege
-        expect: Present,Enabled,Default
+title: Memory Forensics With Volatility Lesson 1
+difficulty: 1
+authors:
+  - name: Lance Lacoste
+    email: lance.lacoste@gmail.com
+
+dependancies:
+  - data/my_memory_sample.vmem
+
+# The final command to open in a new terminal.
+up:
+  - docker run  --name=%LENSE_NAME%_main -v $PWD/data:/data -i -t llacoste/docker_volatility
+
+down:
+  - docker stop %LENSE_NAME%_main
+  - docker rm %LENSE_NAME%_main
+
+# Begin the lesson.
+lesson_plan:
+  - say: Load up volshell on the windows_xp.vmem image (volatility -f windows_xp.vmem volshell)
+
+  - say: 'We are going to take a look at some TYPEs in volshell. Using the dt command inspect: _EPROCESS _ETHREAD _TOKEN'
+    question:
+      ask: What do you see?
+      hint: 'Enter: dt("<TYPE>")'
+      expect: '*'
+
+  - say: Exit volshell and run pslist
+    question:
+      ask: What process has PID 296?
+      expect: svchost.exe
+
+  - say: Now run psscan
+    question:
+      ask: What is the offset of the explorer.exe process with PID 236
+      expect: '0x0000000005201a08'
+
+  - say: Now run pstree
+    question:
+      ask: What is the name of the first child process of explorer.exe with PID 236
+      expect: vmtoolsd.exe
+
+  - say: Now run psxview
+    question:
+      ask: What process has PID 296?
+      expect: svchost.exe
+
+  - say: You can look at the privileges of a process by using the privs plugin along with the -p flag. Use the -p flag on various plugins to focus on a particular process with the given PID i.e. -p 236 for explorer.exe. Run privs on explorer.exe
+    question:
+      ask: What are the privileges for SeImpersonatePrivilege
+      expect: Present,Enabled,Default

data/lib/lense.rb

@@ -4,7 +4,7 @@ require 'highline/import'
 class LENSE
   attr_reader :config, :current_course
 
-  VERSION             = '0.1.26'
+  VERSION             = '0.1.27'
   LENSE_DIR           = File.join(ENV['HOME'],'.lense')
   COURSES_DIR         = File.join(LENSE_DIR,'courses')
   CURRENT_COURSE_FILE = File.join(LENSE_DIR,'current_course')
@@ -71,7 +71,7 @@ class LENSE
     test_str = File.file?(test_file) ? File.read(test_file) : ''
     lense_file = Psych.load(test_str) || {}
 
-    lense_file['course']['lesson_plan'].each do |lesson|
+    lense_file['lesson_plan'].each do |lesson|
       say question_separator
       say "#{say_prefix} #{lesson['say']}" if lesson['say']
 
@@ -84,7 +84,6 @@ class LENSE
           hint = lesson['question'] && lesson['question']['hint']
 
           show_hint = ''
-
           if hint && asked > hint_limit
             show_hint = "\n#{hint_prefix} #{hint}"
           end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: lense
 version: !ruby/object:Gem::Version
-  version: 0.1.26
+  version: 0.1.27
 platform: ruby
 authors:
 - Manuel Zubieta
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-04-23 00:00:00.000000000 Z
+date: 2015-04-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake