 gleeda
|
8a82587819
|
adding back pretty printing
unified output still intact for other renderings
|
2015-03-18 11:01:00 +00:00 |
|
|
gleeda
|
b875b2693a
|
converted linux_bash
|
2014-11-28 15:35:12 -05:00 |
|
|
Andrew Case
|
ec57367da4
|
Linux - update bash to use overlay
|
2014-07-25 16:13:21 -05:00 |
|
|
Andrew C
|
33f6bf2c33
|
Linux - update bash recovery to be much faster
|
2014-06-26 02:41:47 -05:00 |
|
|
iMHLv2
|
e6ed7078f9
|
sync with r3581 of trunk
|
2014-01-17 14:21:55 -06:00 |
|
|
iMHLv2
|
f699e93a4f
|
sync with r3514
|
2013-10-08 01:04:26 -04:00 |
|
|
iMHLv2
|
d242168adb
|
initial commit of r3513 branch
|
2013-10-07 11:55:04 -04:00 |
|
|
awalters
|
4c7cc26502
|
Standardization of file headers. License clarification. Dumpfiles committed to trunk.
|
2013-10-08 04:16:13 +00:00 |
|
|
iMHLv2
|
2c14edefe7
|
add a condition to the BashTypes profile modification to prevent it from being applied when windows profiles are in use
|
2013-04-09 19:11:15 +00:00 |
|
|
iMHLv2
|
c3789edaa8
|
indicate the process ID and name in which bash history was found (it may not always be a process named bash, or there may be multiple bash processes running)
|
2013-04-02 04:00:53 +00:00 |
|
|
iMHLv2
|
8109e57928
|
when brute force scanning for linux bash history, we find objects in an unordered fashion. use timestamps to sort them, so the output resembles the actual order in which commands were typed. this cannot show order if more than one command was typed in the same second.
|
2013-04-02 03:57:35 +00:00 |
|
|
iMHLv2
|
22d51ddc18
|
add an option --scan-all/-A to linux_bash. by default when brute forcing, we only look in processes named bash. this new option overrides and scans everything - useful if you have a backdoor bash shell copied to /tmp/abc and you want to recover history from it
|
2013-04-02 03:38:24 +00:00 |
|
|
iMHLv2
|
d5a920dab7
|
complete the series of patches that will allow us to find bash history on linux without manually supplying the offset to history_list_pointer symbol
|
2013-04-02 02:33:49 +00:00 |
|
|
iMHLv2
|
dffa85d9e9
|
make the _hist_entry.is_valid() check more aggressive. this will assist in brute force scanning and allow us to remove the required --history address parameter (i.e. the plugin can work without previous reverse engineering for each system)
|
2013-04-02 02:21:16 +00:00 |
|
|
iMHLv2
|
50b816b2e4
|
patch linux_bash to show human-readable timestamps instead of integers like 1345254942 and allow the --tz command-line option to switch the timestamp time zones
|
2013-04-01 21:16:03 +00:00 |
|
|
iMHLv2
|
e8569a92d6
|
add **kwargs for all linux plugins
|
2013-03-07 15:28:36 +00:00 |
|
|
iMHLv2
|
dd682fa319
|
Linux - dont try to extract bash history from processes whose mm pointer is invalid (i.e. no way to get process AS)
|
2012-09-10 16:34:14 +00:00 |
|
|
iMHLv2
|
9015d18aab
|
Linux - remove FIXME from bash, its already been fixed
|
2012-09-10 16:28:35 +00:00 |
|
|
iMHLv2
|
6353f251a4
|
Linux - add a description to the bash plugin
|
2012-09-10 15:43:59 +00:00 |
|
|
atcuno
|
3b48439cc8
|
Linux - cleanups in bash from mhl
|
2012-09-10 06:36:32 +00:00 |
|
|
atcuno
|
a3eede517f
|
Linux - add bash plugin
|
2012-09-09 22:02:42 +00:00 |
|