Skip to content

Commit f79b0d9

Browse files
codeyourwebcodeyourweb
authored
Merge pull request #2 from codeyourweb/dev
update to 1.3 cross-platform
2 parents b6e6689 + 9e6a1ff commit f79b0d9

15 files changed

+507
-95
lines changed

‎README.linux-compilation.md‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
# Compiling instruction for _FastFinder_ on Linux
2+
3+
_FastFinder_ was originally designed for Windows platform but it also work perfectly on Linux. Unlike other Go programs, if you want to compile or run it from source, you will need to install some libraries and compilation tools. Indeed, _FastFinder_ is strongly dependent of libyara, go-yara and CGO. Here's a little step by step guide:
4+
5+
## Before installation
6+
7+
Please ensure having:
8+
* Go >= 1.17
9+
* GOPATH / GOOS / GOARCH correctly set
10+
* administrator rights to insall
11+
12+
## Compile YARA
13+
14+
1/ download YARA latest release source tarball (https://github.com/VirusTotal/yara)
15+
2/ Make sure you have `automake`, `libtool`, `make`, `gcc` and `pkg-config` installed in your system.
16+
2/ unzip and compile yara like this:
17+
```
18+
tar -zxf yara-<version>.tar.gz
19+
cd <version>.
20+
./bootstrap.sh
21+
./configure
22+
make
23+
make install
24+
```
25+
3/ Run the test cases to make sure that everything is fine:
26+
```
27+
make check
28+
```
29+
30+
## Configure CGO
31+
CGO will link libyara and compile C instructions used by _Fastfinder_ (through go-yara project). Compiler and linker flags have to be set via the CGO_CFLAGS and CGO_LDFLAGS environment variables like this:
32+
```
33+
export CGO_CFLAGS="-I<YARA_SRC_PATH>/libyara/include"
34+
export CGO_LDFLAGS="-L<YARA_SRC_PATH>/libyara/.libs -lyara"
35+
```
36+
37+
## You're ready to Go!
38+
You can compile _FastFinder_ with the following command:
39+
```
40+
go build -tags yara_static -a -ldflags '-s -w' .
41+
```

‎README.md‎

Lines changed: 19 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,31 +1,38 @@
11
# _FastFinder_ - Incident Response - Fast suspicious file finder
2+
[![Golang](https://img.shields.io/badge/Go-1.17-blue.svg)](https://golang.org)
3+
![Linux](https://img.shields.io/badge/Supports-Linux-green.svg)
4+
![windows](https://img.shields.io/badge/Supports-windows-green.svg)
25

36
## What is this project designed for?
4-
_FastFinder_ is a lightweight tool made for threat hunting, live forensics and triage on Windows Platform. It is
7+
_FastFinder_ is a lightweight tool made for threat hunting, live forensics and triage on both Windows and Linux Platforms. It is
58
focused on enpoint enumeration and suspicious file finding based on various criterias:
69
* file path / name
10+
* md5 / sha1 / sha256 checksum
711
* simple string content match
812
* complex content condition(s) based on YARA
913

1014
### Installation
1115
Compiled release of this software are available. If you want to compile
1216
from sources, it could be a little bit tricky because it strongly depends of
13-
_go-yara_ and CGO compilation. Anyway, you'll find a detailed documentation [here](README.windows-compilation.md)
17+
_go-yara_ and CGO compilation. Anyway, you'll find a detailed documentation [for windows](README.windows-compilation.md) and for [for linux](README.linux-compilation.md)
1418

1519
### Usage
1620
```
17-
fastfinder [-h|--help] -c|--configuration "<value>" [-b|--build
18-
"<value>"] [-o|--output "<value>"] [-n|--nowindow]
21+
usage: fastfinder [-h|--help] [-c|--configuration "configuration.yaml"] [-b|--build
22+
"path_to_package_bin"] [-o|--output "log_file.log"] [-n|--nowindow]
23+
[-p|--showprogress] [-v|--version]
1924
2025
Incident Response - Fast suspicious file finder
2126
2227
Arguments:
2328
2429
-h --help Print help information
25-
-c --configuration Fastfind configuration file
30+
-c --configuration Fastfind configuration file. Default: configuration.yaml
2631
-b --build Output a standalone package with configuration and rules in a single binary
2732
-o --output Save fastfinder logs in the specified file
2833
-n --nowindow Hide fastfinder window
34+
-p --showprogress Display I/O analysis progress
35+
-v --version Display fastfinder version
2936
```
3037

3138
Depending on where you are looking for files, _FastFinder_ could be used with admin OR simple user rights.
@@ -57,8 +64,14 @@ output:
5764
* input content grep strings are always case SENSITIVE
5865
* backslashes haven't to be escaped on simple string pattern (see example)
5966

60-
## About this project and future versions
67+
## About this project
6168
I initially created this project to automate the creation of fastfind on a wide computer network.
6269
It fulfills the needs I have today, nevertheless if you have complementary ideas, do not hesitate
6370
to ask for, I will see to implement them if they can be useful for everyone.
6471
On the other hand, pull request will be studied carefully.
72+
73+
## Future releases
74+
I don't plan to add any additional features right now. The next release will be focused on:
75+
* Stability / performance improvements
76+
* Unit testing / Code testing coverage / CI
77+
* Build more examples based on live malwares tradecraft and threat actor campaigns

‎README.windows-compilation.md‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
1+
# Compiling instruction for _FastFinder_ on Windows
12

2-
# Installing _FastFinder_ on Windows
3-
4-
_FastFinder_ is design for Windows platform but it's a little bit tricky because it's strongly dependant of go-yara and CGO. Here's a little step by step guide:
3+
_FastFinder_ was originally designed for Windows platform but it's a little bit tricky to compile because it's strongly dependant of go-yara and CGO. Here's a little step by step guide:
54

65
## Before installation
76

‎examples/example_configuration_linux.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
input:
2+
path: []
3+
content:
4+
grep: []
5+
yara:
6+
- './examples/example_rule_linux.yar'
7+
checksum:
8+
- 'bf1cde9c94c301cdc3b5486f2f3fe66b'
9+
- '41ba1bd49cb22466e422098d184bd4267ef9529e'
10+
- 'e875b1185577ff872fbaabde481cc196af03745c530403c8303f00fe35859bf7'
11+
options:
12+
contentMatchDependsOnPathMatch: false
13+
findInHardDrives: true
14+
findInRemovableDrives: false
15+
findInNetworkDrives: false
16+
findInCDRomDrives: false
17+
output:
18+
base64Files: true
19+
filesCopyPath: ''

‎examples/example_rule_linux.yar‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
rule fastfinder_example{
2+
meta:
3+
name = "fastfinder_example"
4+
description = "Example of fastfinder yara match (on legitimate linux 'more' binary)"
5+
reference = "https://github.com/codeyourweb/fastfinder"
6+
strings:
7+
$str1 = "GNU"
8+
$str3 = "--More--"
9+
$str4 = "file perusal filter for CRT viewing"
10+
$str5 = "Press 'h' for instructions"
11+
$op = { ba 05 00 00 00 31 ff 4? 8d 35 ?? ?? ?? ?? e8 ?? ?? ?? ?? 4? 89 ee 4? 89 c7 e8 ?? ?? ?? ?? ba 05 00 00 00 31 ff 4? 8d 35 ?? ?? ?? ?? e8 ?? ?? ?? ??}
12+
condition:
13+
all of them and uint16(0) == 0x457f
14+
}

‎finder.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,9 +14,11 @@ import (
1414

1515
// PathsFinder try to match regular expressions in file paths slice
1616
func PathsFinder(files *[]string, patterns []*regexp2.Regexp) *[]string {
17+
InitProgressbar(int64(len(*files)))
1718
var matchingFiles []string
1819
for _, expression := range patterns {
1920
for _, f := range *files {
21+
ProgressBarStep()
2022
if match, _ := expression.MatchString(f); match {
2123
matchingFiles = append(matchingFiles, f)
2224
}
@@ -29,7 +31,9 @@ func PathsFinder(files *[]string, patterns []*regexp2.Regexp) *[]string {
2931
// FindInFiles check for pattern or checksum match in files slice
3032
func FindInFiles(files *[]string, patterns []string, checksum []string) *[]string {
3133
var matchingFiles []string
34+
InitProgressbar(int64(len(*files)))
3235
for _, f := range *files {
36+
ProgressBarStep()
3337
b, err := ioutil.ReadFile(f)
3438
if err != nil {
3539
LogMessage(LOG_ERROR, "[ERROR]", "Unable to read file", f)

‎go.mod‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,19 @@ require (
77
github.com/gen2brain/go-unarr v0.1.2
88
github.com/h2non/filetype v1.1.3
99
github.com/hillu/go-yara/v4 v4.1.0
10-
golang.org/x/sys v0.0.0-20211124211545-fe61309f8881
10+
golang.org/x/sys v0.0.0-20211205182925-97ca703d548d
1111
gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b
1212
)
1313

14-
require github.com/dlclark/regexp2 v1.4.0
14+
require (
15+
github.com/dlclark/regexp2 v1.4.0
16+
github.com/schollz/progressbar/v3 v3.8.3
17+
)
18+
19+
require (
20+
github.com/mattn/go-runewidth v0.0.13 // indirect
21+
github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db // indirect
22+
github.com/rivo/uniseg v0.2.0 // indirect
23+
golang.org/x/crypto v0.0.0-20211202192323-5770296d904e // indirect
24+
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211 // indirect
25+
)

‎go.sum‎

Lines changed: 37 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
github.com/akamensky/argparse v1.3.1 h1:kP6+OyvR0fuBH6UhbE6yh/nskrDEIQgEA1SUXDPjx4g=
22
github.com/akamensky/argparse v1.3.1/go.mod h1:S5kwC7IuDcEr5VeXtGPRVZ5o/FdhcMlQz4IZQuw64xA=
3+
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
4+
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
5+
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
36
github.com/dlclark/regexp2 v1.4.0 h1:F1rxgk7p4uKjwIQxBs9oAXe5CqrXlCduYEJvrF4u93E=
47
github.com/dlclark/regexp2 v1.4.0/go.mod h1:2pZnwuY/m+8K6iRw6wQdMtk+rH5tNGR1i55kozfMjCc=
58
github.com/gen2brain/go-unarr v0.1.2 h1:17kYZ2WMCVFrnmU4A+7BeFXblIOyE8weqggjay+kVIU=
@@ -8,8 +11,40 @@ github.com/h2non/filetype v1.1.3 h1:FKkx9QbD7HR/zjK1Ia5XiBsq9zdLi5Kf3zGyFTAFkGg=
811
github.com/h2non/filetype v1.1.3/go.mod h1:319b3zT68BvV+WRj7cwy856M2ehB3HqNOt6sy1HndBY=
912
github.com/hillu/go-yara/v4 v4.1.0 h1:ZLT9ar+g5r1IgEp1QVYpdqYCgKMNm7DuZYUJpHZ3yUI=
1013
github.com/hillu/go-yara/v4 v4.1.0/go.mod h1:rkb/gSAoO8qcmj+pv6fDZN4tOa3N7R+qqGlEkzT4iys=
11-
golang.org/x/sys v0.0.0-20211124211545-fe61309f8881 h1:TyHqChC80pFkXWraUUf6RuB5IqFdQieMLwwCJokV2pc=
12-
golang.org/x/sys v0.0.0-20211124211545-fe61309f8881/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
14+
github.com/k0kubun/go-ansi v0.0.0-20180517002512-3bf9e2903213/go.mod h1:vNUNkEQ1e29fT/6vq2aBdFsgNPmy8qMdSay1npru+Sw=
15+
github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
16+
github.com/mattn/go-runewidth v0.0.13 h1:lTGmDsbAYt5DmK6OnoV7EuIF1wEIFAcxld6ypU4OSgU=
17+
github.com/mattn/go-runewidth v0.0.13/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
18+
github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db h1:62I3jR2EmQ4l5rM/4FEfDWcRD+abF5XlKShorW5LRoQ=
19+
github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db/go.mod h1:l0dey0ia/Uv7NcFFVbCLtqEBQbrT4OCwCSKTEv6enCw=
20+
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
21+
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
22+
github.com/rivo/uniseg v0.2.0 h1:S1pD9weZBuJdFmowNwbpi7BJ8TNftyUImj/0WQi72jY=
23+
github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
24+
github.com/schollz/progressbar/v3 v3.8.3 h1:FnLGl3ewlDUP+YdSwveXBaXs053Mem/du+wr7XSYKl8=
25+
github.com/schollz/progressbar/v3 v3.8.3/go.mod h1:pWnVCjSBZsT2X3nx9HfRdnCDrpbevliMeoEVhStwHko=
26+
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
27+
github.com/stretchr/testify v1.3.0 h1:TivCn/peBQ7UY8ooIcPgZFpTNSz0Q2U6UrFlUfqbe0Q=
28+
github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
29+
golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
30+
golang.org/x/crypto v0.0.0-20211202192323-5770296d904e h1:MUP6MR3rJ7Gk9LEia0LP2ytiH6MuCfs7qYz+47jGdD8=
31+
golang.org/x/crypto v0.0.0-20211202192323-5770296d904e/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
32+
golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
33+
golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
34+
golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
35+
golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
36+
golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
37+
golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
38+
golang.org/x/sys v0.0.0-20210910150752-751e447fb3d0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
39+
golang.org/x/sys v0.0.0-20211205182925-97ca703d548d h1:FjkYO/PPp4Wi0EAUOVLxePm7qVW4r4ctbWpURyuOD0E=
40+
golang.org/x/sys v0.0.0-20211205182925-97ca703d548d/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
41+
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
42+
golang.org/x/term v0.0.0-20210615171337-6886f2dfbf5b/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
43+
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211 h1:JGgROgKl9N8DuW20oFS5gxc+lE67/N3FcwmBPMe7ArY=
44+
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
45+
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
46+
golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
47+
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
1348
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
1449
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
1550
gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b h1:h8qDotaEPuJATrMmW04NCwg7v22aHH28wwpauUhK9Oo=

‎logger.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ func StdoutToLogFile(outLogPath string) {
4343
scanner := bufio.NewScanner(rd)
4444
for scanner.Scan() {
4545
stdoutLine := scanner.Text()
46-
multiWriter.Write([]byte(stdoutLine + "\r\n"))
46+
multiWriter.Write([]byte(stdoutLine + LineBreak))
4747
}
4848
}()
4949
}
@@ -68,7 +68,7 @@ func StderrToLogFile(outLogPath string) {
6868
scanner := bufio.NewScanner(rd)
6969
for scanner.Scan() {
7070
stdoutLine := scanner.Text()
71-
multiWriter.Write([]byte(stdoutLine + "\r\n"))
71+
multiWriter.Write([]byte(stdoutLine + LineBreak))
7272
}
7373
}()
7474
}

0 commit comments

Comments
 (0)