29 03 2012
The Sleuth Kit Part 4 – TSK and netcat
So here we are with Part 4 of The Sleuth Kit (TSK) series of posts I am doing. I hope you have learned something so far, as I know I have. This one will be a bit shorter, but it might come in handy for you sometime.
how we can turn TSK and netcat into an even more powerful tool set.
Let’s get started.
First you will need the latest version of TSK and you will also need a copy of netcat that will run on Windows.
So I went ahead and decided to hop on my Windows 7 machine and run a quick mmls against \\.\PhysicalDrive0.
As you can see we are dealing with an NTFS Partition here with a starting sector of 2048, which will come in handy when we are specifying our offset when we run fls.
Now, let’s say we need to for whatever reason transfer some forensics information over the network real quick and we don’t have time for whatever reason to send the entire disk drive over netcat using dd or another imaging tool.
I’m going to hop on my Macbook Pro and set up a netcat listener, which will allow us to send information to my Macbook from our Windows 7 machine.
So here we are setting up the netcat listener:
What we are saying here is, nc (netcat) -l (listen) on 192.168.1.104 (My Macbook) via port 1234 and output anything that comes across this connection into fls.body.
Now let’s move over to the Windows machine and actually send the body file over the network onto the Macbook Pro (192.168.1.104).
So here we are actually issuing the fls command with the arguments of -r, -p, -o, and -m. -r is for recursive, -p is to specify the file path, -o is the partition offset we discovered above by running the mmls command against \\.\PhysicalDrive0, and -m is to specify the mactime format, which we will use to build our timeline. The nc -w 3 is to specify waiting 3 seconds before timing out.
Then we pipe that command through netcat. As you can see we are connecting to 192.168.1.133 on port 12345, which matches the information we specified on the Macbook when we created the netcat listener.
Ok, now it looks like everything is fine. Let’s take a look at the file we sent over the wire.
As you can see we successfully transfered it over to my Macbook by way of Netcat.
Zeus v2 Malware Analysis – Part I The Sleuth Kit Part 5 – Recover files with tsk_recover and icat
Comments are currently closed.
hey man you might want to use cryptcat when sending a forensic capture over the wire to prevent someone from sniffing and copying the data while its being transferred.
Thanks for your comment. That’s a good point. I was looking at wrapping it up in Openssh or something like that, but didn’t get around to it. Cryptcat looks interesting, and maybe the better/easier alternative. Thanks for sharing. This is one of the main reasons I post. I enjoy getting this kind of great feedback. I wish more people commented.