Linux Expl0rer

A Python 2.x tool for memory analysis on Mac OS X systems with support for various OS versions and memory image export capabilities.

This is a user-friendly live forensics toolbox designed for Linux endpoints, developed using Python and Flask. Capabilities: - View the complete list of running processes. - Inspect the memory map of processes and easily retrieve memory strings. - Dump the memory of a process with a single click. - Automatically search for hashes in public services such as VirusTotal, Intezer, Analyze AlienVault OTX, and MalShare. - Find the list of users. - Search for suspicious files using name or regex patterns. - Execute netstat commands. - Perform Whois lookups. - Access logs including syslog, auth.log (user authentication log), ufw.log (firewall log), and bash history. - Use chkrootkit for anti-rootkit measures. - Utilize YARA to scan a file or directory with YARA signatures by @Neo23x0, scan the memory address space of a running process, and upload your own YARA signature.

Python version 3.6 is required for this application.

To install the software, follow these steps: 1. Download the master zip file using the command: wget https://github.com/intezer/linux-explorer/archive/master.zip -O master.zip 2. Unzip the downloaded file: unzip master.zip 3. Change into the directory: cd linux-explorer-master 4. Execute the deployment script: ./deploy.sh Usage: To start using the application, open your browser and navigate to: http://127.0.0.1:8080 Configure API keys (optional): - Open the configuration file with nano: nano config.py - Update the following lines with your API keys: INTEZER_APIKEY = '', VT_APIKEY = '', OTX_APIKEY = '', MALSHARE_APIKEY = '' Notes: For secure remote access, we recommend using an NGINX reverse proxy with basic HTTP authentication and SSL. This setup has been tested on Ubuntu 16.04. Misc: For additional guidance, refer to the "How to" section.