- Smartscope labnation wiki how to#
- Smartscope labnation wiki install#
- Smartscope labnation wiki windows#
I have been talking with quite a few people lately tasked with "security" inside their organizations and couldn't help but notice their lack of understanding when it came to Windows process information. Props to RJHansen for writing this tool! Thanks. Organizations that use a standard baseline should be able automate and leverage this pretty easily within their environment. t : stop after TIMEOUT seconds of inactivity (default: disabled) p : listen on PORT, between 105 (default: 9120) o : only support old (1.0) nsrlsvr protocol S : run as a normal process (do not run as a daemon) s : allow clients to query server status (default: disabled) f : specify an alternate RDS (default: /usr/local/share/nsrlsvr/NSRLFile.txt) Here are the options from nsrlsvr nsrlsvr -h I use a combination of NSRL and custom hashes. If anyone knows of a more up-to-date or better list of hashes put it in the comments so everyone can use it.
I used NSRL because everyone knows about them. You can customize your list of hashes if you want and pass the -f location toyour_set when starting up nsrlsvr. u is default so you don't have to specify it. If you wanted to filter by -k (known) you could use nsrllookup.exe -k -s _ip_. By default nsrllokup.exe will use the -u (unknown) flag, which is most likely what you're going to be using. NOTE I only hashed executable files (-o e). Note that most of those are VMWare Workstation related, which is newer version from when the last time the NSRL hashes were posted.
Smartscope labnation wiki install#
On a pretty much fresh install of Windows XP SP3 and filtering by "unknown" only you should get something like this. It should be quite large as it will load all of the hashes into memory for better performance. I’m sure you can use another Linux distro, but I already had REMnux installed and configured.
Smartscope labnation wiki how to#
This post will cover how to get your own NSRL server running so you can perform hash checks while you are out on IR engagements, or whatever the "case" may be. I promise 2014 will be better as I actually missed blogging this year. I couldn't let the year end without getting at least a few posts up. I moved to Singapore and started a new job and I simply lost track of time. It's been a long time since I wrote a blog post.
0 kommentar(er)
