linux-explorer's Introduction

This project is no longer maintained!

Linux Expl0rer

Easy-to-use live forensics toolbox for Linux endpoints written in Python & Flask.

Capabilities

ps

View full process list
Inspect process memory map & fetch memory strings easly
Dump process memory in one click
Automatically search hash in public services

users

users list

find

Search for suspicious files by name/regex

netstat

Whois

logs

syslog
auth.log(user authentication log)
ufw.log(firewall log)
bash history

anti-rootkit

chkrootkit

yara

Scan a file or directory using YARA signatures by @Neo23x0
Scan a running process memory address space
Upload your own YARA signature

Requirements

Python 3.6

Installation

wget https://github.com/intezer/linux-explorer/archive/master.zip -O master.zip
unzip master.zip
cd linux-explorer-master
./deploy.sh

Usage

Start your browser

firefox http://127.0.0.1:8080

Configure API keys (optional)

nano config.py

Edit following lines:

INTEZER_APIKEY = '<key>'
VT_APIKEY = '<key>'
OTX_APIKEY = '<key>'
MALSHARE_APIKEY = '<key>'

Notes

We recommend using NGINX reverse proxy with basic http auth & ssl for secure remote access
Tested with Ubuntu 16.04

Misc

linux-explorer's Issues

Problem with YARA

Hello,

I have some problems with Yara scan. When I run the scan with a ruleset on a path, I only get scan errors in response, including "error 4" or "could not open file". I don't know why
However, I run the 'deploy.sh' file with root rights.
If you can tell me how to fix this problem, that would be very nice.

Thank you in advance.

Loki Intergration

Hello,

This is not so much of an issue but more so of a feature that would be awesome to be added. But is there anyway loki scanner can be integrated with this tool?

error :YARA not installed

hi
I did all what you said to do in Readme
and im stick in the error :YARA not installed
this is what i got [*] starting Linux Expl0rer... Traceback (most recent call last): File "linux_explorer.py", line 23, in <module> toolbox = dict({'yara': tools.YARA(), File "/root/Desktop/linux-explorer-master/tools.py", line 16, in __init__ raise Exception('error: %s not installed' % self.__class__.__name__) Exception: error: YARA not installed
can anyone help me with this issue please

Installation on Solus OS

Trying to see if I can get LEM to run on Solus OS. Think I got everything to install, however, when I run the python script (btw, had no problem getting it installed and running on a Debian system), I get the following error:
Traceback (most recent call last):
File "linux_explorer.py", line 13, in
from flask import Flask, jsonify, send_file, send_from_directory, render_template, request, abort, redirect
ImportError: No module named flask

However, when I did the pip install requirements.txt (something like that) it stated:

Successfully installed Flask-0.12.2 Jinja2-2.10 MarkupSafe-1.0 OTXv2-1.2 Werkzeug-0.12.2 certifi-2017.11.5 chardet-3.0.4 click-6.7 idna-2.6 itsdangerous-0.24 requests-2.18.4 simplejson-3.12.0 urllib3-1.22

So flask is apparently installed, but linux-explorer is not finding it. Any ideas?

Recommend Projects

intezer / linux-explorer Goto Github PK