Skip to content

Commit

Permalink
change readme + list
Browse files Browse the repository at this point in the history
  • Loading branch information
DavidCruciani committed Jul 20, 2021
1 parent 4718019 commit d2890f1
Show file tree
Hide file tree
Showing 3 changed files with 37 additions and 12 deletions.
39 changes: 32 additions & 7 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -7,50 +7,75 @@ Factual-rules-generator is an open source project which aims to generate yara ru
## Python Dependencies

- pefile
- flask
- ast
- psutil
- requests



- pyinstaller (to change client.py to client.exe)



## Windows requirement

If scripts are run under a Windows machine, some tools are required:

- xxd : https://www.vim.org/download.php
- cut : http://unxutils.sourceforge.net/
- `xxd` : https://www.vim.org/download.php
- `cut` : http://unxutils.sourceforge.net/
- `sed` : http://unxutils.sourceforge.net/



These tools are not mandatory but recommended:

- Asa (AttackSurfaceAnalyzer) : https://github.com/microsoft/AttackSurfaceAnalyzer
- Sync : https://docs.microsoft.com/en-us/sysinternals/downloads/sync
- Uninstall : https://tarma.com/tools/uninstall



## Linux requirement

There's two tools necessary on the linux machine:

- `fls` contains in The Sleuth Kit (TSK)
- `strings` unix command

## Install

- Install all python dependencies find in requirements.txt

- Install a Windows VM
- Install chocolatey on Windows VM: https://docs.chocolatey.org/en-us/choco/setup

- A Share Folder is needed

- If use a Linux VM, install it
- put `bin/OnLinux/get_Fls_Strings.py` in Linux VM and the script need to be run on startup

- Complete `etc/allVariables.py`

- Add IP adress of the server and share folder in `bin/OnWindows/client.py` at specific lines
- Compete `bin/OnWindows/VarClient.py`

- Change `bin/OnWindows/client.py` in an exe and put in startup folder



In `test/` some example of software to install is give, it's use a specific format :

- First, there's the name of the packages to install using choclatey (https://community.chocolatey.org/packages) before `:`
- First, there's the name of the packages to install using chocolatey (https://community.chocolatey.org/packages) before `:`
- Or, you have to put the name of the exe or msi (`test/app.txt`)
- Second, after `:` there's the name of the exe to extract and run it (without extension).
- Finally, after `,` you need to specified the installer: (`putty.msi:putty,installer:msiexec`)
- choco
- msiexec
- exe



## Run

`bin/server.py` is the first script to run and `bin/Generator.py` is the second and the last.
`bin/Generator.py` is the only script to run.



Expand Down
2 changes: 1 addition & 1 deletion test/app.txt
Original file line number Diff line number Diff line change
@@ -1 +1 @@
notepadplusplus:notepad++
putty.msi:putty,installer:msiexec
8 changes: 4 additions & 4 deletions test/listapp.txt
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
notepadplusplus:notepad++
putty.install:putty
googlechrome:chrome
winrar:winrar
notepadplusplus:notepad++,installer:choco
putty.msi:putty,installer:msiexec
googlechrome:chrome,installer:choco
winrar:winrar,installer:choco

0 comments on commit d2890f1

Please sign in to comment.