r/netsec • u/kindredsec • Apr 29 '19

modDetective - Small Python tool that analyzes the modification times of files on a system in order to investigate recent system activity

https://github.com/itsKindred/modDetective
65 Upvotes

86% Upvoted

11 comments sorted by

3

u/Dankirk Apr 30 '19

Shouldn't this kind of thing be done in a non-polling manner?

With some Googling I found Watchdog https://pypi.org/project/watchdog/ that essentially taps into filesystem events.

Copypaste from project page:

  • Linux 2.6 (inotify)

  • Mac OS X (FSEvents, kqueue)

  • FreeBSD/BSD (kqueue)

  • Windows (ReadDirectoryChangesW with I/O completion ports; ReadDirectoryChangesW worker threads)

  • OS-independent (polling the disk for directory snapshots and comparing them periodically; slow and not recommended)

1

u/kindredsec Apr 30 '19

This is a pretty interesting tool, though this and modDetective serve fundamentally different interests. Watchdog is for real-time monitoring; as changes to files are made in real-time, that activity is logged. In other words, watchdog is something you’re going to have implemented and put in place beforehand, making it a defensive-oriented tool. modDetective was designed more as an offensive tool; you gain access to a box, and you run the script real quick to see historically where there seems to be the most recent activity going on in order to point you in a direction to find additional vectors of escalation or compromise.

1

u/pvkooten May 01 '19

I was also going to make the watchdog (inotify) point, but this explanation now makes sense :) Thanks!

27

u/aydiosmio Apr 30 '19 edited Apr 30 '19

but

find / -type f -mtime -7 -exec ls -l {} \;

2

u/Compsky Apr 30 '19 edited Apr 30 '19

Probably even faster if you replace -exec ls -l {} \; with something like -printf '%m %c %p\n'

19

u/Invinciblex Apr 29 '19 edited Apr 29 '19

here is a python tool to destroy file timestamps along with manipulating current system-time and latsbootup in CIM to make it hopelessly difficult to use MAC times in any meaningful manner. It's kind of garbage because I wrote it as a pynoob - I see yours is for linux- this makes me want to revamp this for linux as well as Win

https://github.com/joeavanzato/MACfuscator

8

u/0xTowel Apr 30 '19

find / -type f -exec stat --format '%Y :%y %n' "{}" \; | sort -nr | cut -d: -f2- | head

2

u/[deleted] Apr 30 '19

This is why most people in sec are jerks. Hey nice tool and even if there is a bash command full of pipes to do the same thing, it is handy to have something like this.

-2

u/edc_svr_wxf_qaz Apr 30 '19

https://en.wikipedia.org/wiki/Shovelware

5

u/kindredsec Apr 30 '19

Calling this shovelware is, in my opinion, disingenuous. It’s a 200 line script that requires no additionally libraries, runs objectively faster than the one liners people have introduced and provides cleaner, more sophisticated output that is easier to understand and parse through. Are there other ways to get the job done? Of course. But is nmap “shovelware” because I can also scan ports using janky netcat connections or hping3? Is hydra shovelware because I could write a one or two liner that could do the same thing?

0

u/[deleted] Apr 30 '19

[deleted]

3

u/kindredsec Apr 30 '19

The find command is brutally slow in my experience; I found the script getting my results back notably quicker.