forensics-documents.cheat

% forensics documents

$ filename: find "$(pwd)" -type f 2>/dev/null | sort -u
$ file: find "$(pwd)" -type f 2>/dev/null | sort -u

# run mailcap (can be used for docx)
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ xdg-utils ]' -c xdg-open <filename> | tee runmailcap-<filename>.out

# install and upgrade oletools
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ python3 ]' -c sudo -H python3 -m pip install -U oletools

# oleid: to analyze OLE files to detect specific characteristics usually found in malicious files.
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ python3Packages.oletools ]' -c oleid <filename> | tee oleid-<filename>.out

# olevba: to extract and analyze VBA Macro source code from MS Office documents (OLE and OpenXML).
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ python3Packages.oletools ]' -c olevba <filename> | tee olevba-<filename>.out

# MacroRaptor: to detect malicious VBA Macros (can be used with zip + password)
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ python3Packages.oletools ]' -c mraptor <filename> | tee mraptor-<filename>.out

# msodde: to detect and extract DDE/DDEAUTO links from MS Office documents, RTF and CSV
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ python3Packages.oletools ]' -c msodde -a <filename> | tee msodde-<filename>.out

# pyxswf: to detect, extract and analyze Flash objects (SWF) that may be embedded in files such as MS Office documents (e.g. Word, Excel) and RTF, which is especially useful for malware analysis.
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ python3Packages.oletools ]' -c pyxswf -o <filename>

# oleobj: to extract embedded objects from OLE files.
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ python3Packages.oletools ]' -c oleobj -s all <filename>

# rtfobj: to extract embedded objects from RTF files.
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ python3Packages.oletools ]' -c rtfobj -s all <filename>

# olebrowse: A simple GUI to browse OLE files (e.g. MS Word, Excel, Powerpoint documents), to view and extract individual data streams.
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ python3Packages.oletools ]' -c olebrowse <filename>

# olemeta: to extract all standard properties (metadata) from OLE files.
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ python3Packages.oletools ]' -c olemeta  <filename> | tee olemeta-<filename>.out

# oletimes: to extract creation and modification timestamps of all streams and storages.
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ python3Packages.oletools ]' -c oletimes  <filename> | tee oletimes-<filename>.out

# oledir: to display all the directory entries of an OLE file, including free and orphaned entries.
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ python3Packages.oletools ]' -c oledir <filename> | tee oledir-<filename>.out

# olemap: to display a map of all the sectors in an OLE file.
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ python3Packages.oletools ]' -c olemap <filename> | tee olemap-<filename>.out

# JPEG Stego
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ steghide ]' -c steghide extract -sf <filename> | tee steghide.out

# PNG Stego
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ zsteg ]' -c zsteg -a <filename> | tee zsteg.out

# Extract all files from a given file
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ binwalk ]' -c binwalk -D='.*' <filename> | tee binwalk.out

# Extract data from PDF document
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ pdf-parser ]' -c pdf-parser.py <filename> | tee pdfparser.out


# default to this for forsics on a file
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ binutils ]' -c strings <file>
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ steghide ]' -c steghide extract -sf <file>
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ stegseek ]' -c stegseek <file>
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ exiftool ]' -c exiftool <file>
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ binwalk ]' -c binwalk <file>
nix shell --impure -I nixpkgs=channel:nixos-unstable --expr 'with import (builtins.findFile builtins.nixPath "nixpkgs") { config.allowUnfree = true; }; [ stegseek ]' -c stegseek <file>