Linux Expl0rer - Forensics Toolbox - Installation & Configuration

Key Takeaways

[Music] hey guys hackersploit here back again with another video and in this video we're going to be looking at linux explorer and you might be asking yourself well what is linux explorer well linux explorer is a forensics toolbox for linux operating systems so in reality what they give you or what this script is is essentially is giving you an advanced process manager and a forensic toolbox that will allow you to analyze anything on the linux on a linux client all right so some of the functionality that it does offer is it will give you a full process list it will allow you to inspect the memory map and you can you know also fetch memory strings so it's fantastic for forensics for those of you interested in forensics this is a fantastic tool that can allow you to perform uh some forensic analysis on a client or on a target computer it allows you to dump the you know process memory again uh very very useful for forensics it allows you to view the user list on that system it allows you to search for files you can look at the system log the firewall log bash history so really really useful stuff it allows you to have an anti-root kit uh software or framework so one of the the supported one here is ch rootkit and yeah so let's look at how to get it installed and some of the requirements that you need to install before you move on so uh it does require python uh more specifically python 2.7 right and uh it needs requires url y-a-r-a uh it requires ch root kit if you are planning on using it i'm not gonna use it right now but i'll show you how to install it all right so uh let me just open up the link here i have it open up on my browser as you can see it's on github and i will be leaving the link in the description so you can check it out so i'm just going to clone the repository like so so i'm just going to copy the link there and what i'm gonna do is open up my terminal which is right here already have it opened up let me just zoom in so you guys have a better idea of what's going on all right so i'm on my desktop and that's probably where i want to store it if you're on your computer i recommend that you keep it in your optional folder so that is you know your opt folder where you keep all programs that are not installed with the system because these tools are may have some bugs and you know mixing it up with your system isn't the best of things to do so yeah let's clone it so git clone git clone by the way this does work on any linux distribution so you know you can use it on ubuntu fedora whatever you feel is comfortable for you so i'm just going to paste the link there we are and i'm just going to hit enter and depending on your internet speed it will get the file downloaded uh so yeah for please forgive my slow internet right now it isn't the best of connection speeds but it should get it downloaded immediately so uh just give it a few seconds to start up and get all the files downloaded and we should be good to go all right so uh let it just finish up there we are it's getting all the files that we need uh there are quite a lot of files actually all right so we've got it on my desktop for some reason um i can't seem to get it in my desktop oh it's probably on my root directory so what i'm going to do is go to my desktop sorry there we are because i am in my user sorry oh i am on my desktop sorry so let me just list that out there we are so it is the linux explorer file so let me just enter there all right so let me clear the terminal now and uh to list the files there are a few things that you have to do and one of them is to look at the requirements all right so all the ins the required packages for that matter so what i'm going to do is i'm just going to display the requirements that are you know given to us in the requirements.txt file all right so i'm going to hit enter and it's going to tell you need these packages to be installed so you need flask psu tools just some libraries and utilities that you need so what you can do is you can install it using the pip install the ap install r and use the requirements the requirements.txt so you'll automatically get the packages for you so you can just do that i probably have them already installed so it shouldn't take too much time as well and once you have the requirements installed there we are so i already have them installed as you can see a requirement already satisfied so i know i have them but for you in your case you can go ahead and get it done right uh so um another thing you have to make sure that you need to do is we need to configure the um we need to configure the python file so let me just clear this up and if i list the files we have the python uh the config.python so python config.python and oops let me use the nanoeditor mybad config config.python there we are so in here if you wanted to use the uh the vto otx apis uh that's a special tool sorry about that notification that's um that's essentially an api that allows you to or that gives you root kick root kit detection all right so you if you want to use the api you can go ahead and just google it and you can get the api and that will allow you to use their um their rootkit detector all right so but i'm not going to use that because it's really not necessary at the moment so i'm just going to exit the that i'm just going to exit that and we can move on to uh you know installing our other required uh packages or the requirements basically so you make sure you have python i'm sure the distro you're on already has python installed so no need for that uh you can then just install yara or y-a-r-a so apt get install yara there we are and i probably already have it installed there we are okay and then you can choose to install your ch root kit which is also optional get install a ch root kit like so and it should install it ch root kit for some reason i'm not getting it ch yeah chk rootkit sorry about that my spelling was wrong uh so chk rootkit there we are already have it installed and once you're done that should be good to go now and what you have to do now is start the the file explorer server the linux explorer server for that matter so the way to do that is to use the python so python uh linux explorer if you're using the linux explorer.py or python and it's going to start it and it's going to say running on that link so let's open that link all right and it's going to open up on firefox there we are so uh the link is 127. uh the port is 8080 all right so it's going to open up and it's going to give you this fantastic web interface and it's going to start loading these services and there you have it it gives you these services pretty pretty awesome and you can see all what's running and their process ids their process uh their usernames under which they are running uh if you have multiple accounts all right so you then have your users tab right up here that gives you your users and what they're using so as you can see i have my user the app to the package manager that's running we have bef uh we have um iodine mail so these are all user services that are being run and you can look at their user id uh their username of course you have their home directory what what their directory they are from so it's really really a fantastic tool for forensic analysis and finding out you know what processes are running uh and i really really see this uh you know to be useful for servers of course most servers will run the command line interface but you know if you install a gui and a desktop environment this can be fantastic as well you then have your find which allows you to search for you know files or if you're searching for a specific uh you're searching for specific uh you know hidden files or malware and stuff like that you know for suspicious files uh stuff like that you then have your netstat that allows you to check your your incoming and outgoing connections as you can see so you know we have the um the uh the process manager that is currently working and as you can see it is um it does have connections in incoming and not going through the different ports we then have some other traffic coming and going so yeah pretty pretty awesome let me just zoom back in there we are all right so you can view nut stack you can also view your locks right so i'm gonna just try and uh keep my logs uh to myself but let's look at my ufw uh firewall yeah so i don't have you you have w5 all installed again that's really really another cool tool if you want a video on that please let me know looking at the authorities log as you can see uh yeah the power button yeah and i guess you can see how awesome this can really be so yeah you then have your anti-root kit section which is again for checking for rootkits and you can start the service when you're in so what's gonna happen now is let me just open up the browser is when you get the survey started it will uh obviously give you the functionality of checking whether you have any rootkits installed so really really helpful as well all right you then have yara which again is for setting rule sets and for file directories and you know process id is just scanning your files on your file structure for anything uh for anything that you specify or with the path all right you then have your tick adapters here i mean your rule set which is set to default uh the tick adapter uh and you can see you have your up to ghost dragon ghost right and you can upload your different year rules files so pretty pretty awesome functionality it does give you and if you go back to the processes you can see that again it gives you a lot of information about the services that are running does take a while to start up but um overall pretty pretty awesome then have the ability to perform a search for the processes that are running so that's also pretty pretty cool as well like you can run processes that are running under my username and as you can see it's going to tell you what's running so for example i have the system library running we have the uh we have some the you know the dynamic config service running just really really just normal stuff regarding the system that's running anyway guys that was it for this video linux explorer is quite an awesome tool for forensic analysis and for system management linux system management that is i hope you guys found value in this video if you did please leave a like down below it would really i would really appreciate it if you have any questions or suggestions please let me know in the comment section or you can hit me up on uh the on my social networks or on kik for the latest hacking news and resources please check out my website hsplurge.com the link will be in the description and yeah thank you so much for watching guys have a fantastic day you