Kana iri sisitimu maneja kazhinji mukati me lmabasa ezuva nezuva avanowanzoita (pamusoro pekugadzira uye kudzoreredza email mapassword) pane kugadziriswa uye kutarisirwa kwemidziyo.
Iko kazhinji kuti udzivise matambudziko mazhinji, mashandiro emidziyo maererano nekumisikidza mafomu anowanzo kuve mashoma uye kuwedzera pakuita zvimwe zvinorambidzwa mukati mekambani network. Mune aya mabasa akajairika, vazhinji vanowanzo tarisira pasi vashandi uyo anoshandisa iyo michina, nekungoita zvakapusa zvisingakwanisike
Vashoma maneja yemasisitimu ndivo vane basa reLinux makomputa ekunyora kernel yavo vega kukwanisa kuita zvinorambidzwa, izvo zvinowanzo pfuura madoko e USB.
Apa ndipo panouya chishandiso chikuru. kuti ini ndawana pane mambure kufambisa. Anonzi usbrip, iyo mumashoko emusiki wayo
"Iri rakavhurika sosi yekuongorora forensiki ine CLI interface iyo inokutendera kuti uchengete zvigadzirwa zve USB mudziyo (kureva nhoroondo yechiitiko che USB) pamichina yeLinux"
USBRip inokutendera kuti uone nekukurumidza zvakanyanya nekuongorora matanda eLinux. Iyi diki software yakanyorwa yakachena Python 3 (uchishandisa mamwe ekunze mamodule) ayo anodarika Linux log mafaera ( / var / log / syslog * uye / var / log / meseji * zvinoenderana nekuparadzirwa) kuvaka tafura yenhoroondo yechiitiko che USB.
Mukati meruzivo iwe rwaunopa, zvinotevera zvinoratidzwa: Zuva uye nguva yekupinda, mushandisi, ID yemupi, ID yechigadzirwa, mugadziri, serial nhamba, chiteshi uye zuva uye nguva yekubuda.
Uye zvakare, iwe unogona zvakare:
- Export yakaunganidza ruzivo seJSON dump (uye vhura marara akadaro, ehe saizvozvo);
- gadzira rondedzero yeanotenderwa (akavimbika) madivhidhi e USB seJSON (idane kuti auth.json).
- Tsvaga zviitiko zve "kutyorwa" zvichibva pana auth.json: ratidza (kana gadzira imwe neJSON) zvishandiso zve USB zvinoonekwa munhoroondo uye zvisingaoneke muauth.json.
- Kana yaiswa ne -s * inogadzira zvakachengetedzwa zvakachengetedzwa (7zip mafaera) kutsigira uye kuunganidza zviitiko zve USB otomatiki nerubatsiro rwe crontab. Pamusoro pekukwanisa kutsvaga zvimwe zvinowedzerwa nezve yakatarwa USB chishandiso zvichienderana neVID yayo uye / kana PID.
Maitiro ekuisa Usbrip paLinux?
Kune avo vanofarira kugona kuisa chishandiso ichi, inofanirwa kunge iine Python 3 yakaiswa pane yako system pamwe nepip (Python's package management system)
Kuisa Usbrip ingovhura terminal uye nyora unotevera kuraira mairi:
pip3 install usbrip
pip install terminaltables termcolor
pip install tqdm
Zvino nenzira imwecheteyo vanogona kurodha kodhi yeprojekiti uye voshandisa chishandiso kubva ipapo. Kuti vaite izvi, ivo vanongofanira kutaipa kubva kuchiteshi.
git clone https://github.com/snovvcrash/usbrip.git usbrip
Uye ivo zvino vanopinda dhairekitori ne:
cd usbrip
Uye isu tinogadzirisa kutsamira ne:
python3 -m venv venv && source venv/bin/activate
Usbrip kushandiswa
Kushandisa chishandiso ichi kuri nyore. Kuti kuti uone nhoroondo yezviitiko isu tinongoteedzera inotevera kuraira:
usbrip events history
O
python3 usbrip.py events history
Iko kucharatidzwa zviitiko. Nenzira imwecheteyo, dzinogona kusefetwa nemazuva kana huwandu hwakakosha.
Somuenzaniso
usbrip events history -e -d "Oct 10" "Oct 11" "Oct 12" "Oct 13" “Oct 14" "Oct 15"
O
python3 usbrip.py events history -e -d "Oct 10" "Oct 11" "Oct 12" "Oct 13" “Oct 14" "Oct 15"
Nechiito ichi, ruzivo rweese ekunze USB zvishandiso zvakabatana nemidziyo panguva kubva Gumiguru kusvika 10 zvicharatidzwa.
Kushanda nemafirita. Kune mana marudzi ekusefa anowanikwa: zviitiko zvekunze zve USB chete (zvishandiso zvinogona kubviswa zviri nyore -e); nezuva (-d); neminda (-user, -vid, -pid, -chigadzirwa, -magadzirirwo, -siri, -port) uye nenhamba yezvipimo zvakawanikwa sekuburitsa (-n).
Kugadzira iyo JSON faira ine zviitiko:
usbrip events gen_auth /ruta/para/el/archivo.json -a vid pid -n 10 -d '2019-10-30'
O
python3 usbrip.py events gen_auth /ruta/para/el/archivo.json -a vid pid -n 10 -d '2019-10-30'
Izvo zvichave zvine ruzivo pane yekutanga gumi zvishandiso zvakabatana muna Gumiguru 10, 30.
Kana iwe uchida kuziva zvakawanda nezvekushandiswa kwechishandiso ichi iwe unogona tarisa chinotevera chinongedzo.