da667

#!/bin/bash
#updater.sh - Weekly update script
#checks for updates, downloads them, then reboots the system.
#place this script in /etc/cron.weekly, ensure it is owned by root (chown root:root /etc/cron.weekly/updater)
#ensure the script execute permissions (chmod 700 /etc/cron.weekly/updater)
#if you want updates to run once daily or monthly, you could also place this script into cron.daily, or cron.weekly.
#alternatively, edit /etc/crontab to create a crontab entry.
export DEBIAN_FRONTEND=noninteractive
apt-get -q update
apt-get -y -q dist-upgrade

da667

#!/bin/bash
#This script is meant for VMware Workstation Professional, or Oracle Virtualbox users on most modern Linux Distributions.
#Ensure that the Linux distro you will be running this on has the ip [addr/route] command available.
#This script checks for the existence of the interface vmnet1 (vmware workstation) or vboxnet0 (virtualbox)
#and will assign the IP address 172.16.1.2 to the first interface it finds. The script will check to see if vmnet1 exists, then check for vboxnet0
#if neither interface exists, the script will fail.
#after setting the IP address, the script attempts to add a static route to the 172.16.2.0 network via 172.16.1.1 (LAN interface of the pfSense VM)

#Note: If you are using alternative networks for your lab other than 172.16.1.0/24, and 172.16.2.0/24, you will have to modify the ip route and ip addr add statements on lines 42, 55, and 75 on your own to reflect your lab network properly. You may also want to change the echo statements on lines 41, 44, 56, 58, 73, and 80 if you c

da667

#!/bin/bash
#This script is meant for VMware Fusion Professional, or Oracle Virtualbox users on OSX
#This script checks for the existence of the interface vmnet2 (vmware fusion) or vboxnet0 (virtualbox)
#and will assign the IP address 172.16.1.2 to the first interface it finds. The script will check to see if vmnet2 exists, then check for vboxnet0
#if neither interface exists, the script will fail.
#after setting the IP address, the script attempts to add a static route to the 172.16.2.0 network via 172.16.1.1 (LAN interface of the pfSense VM)

#Note: If you are using alternative networks for your lab other than 172.16.1.0/24, and 172.16.2.0/24, you will have to modify the route, and ifconfig statements on lines 38, 50, and 69 on your own to reflect your "Management" and "IPS" networks.

### Notifying users to have VMs up and running ###

da667

#!/bin/bash
#analysis script
#goal: for each file that isn't a rar, tar, gz, txt, reg, bat or sh:
#make a directory, copy the malware into the directory, cd into the directory, run hashing tools, file, strings dump into file (separate file for strings output, because its obnoxiously long in most cases) go back to parent directory, rinse, repeat until done.
#also stores a hash file for each hash type done in one single master file in the parent directory (e.g. all_md5.txt, all_ssdeep.txt, etc.)
for i in `ls -1 | egrep -v "sh|bat|rar|tar|gz|txt|reg"`; do
        filedir=`echo $i`_analysis
        filetxt=`echo $i`_analysis.txt
        filestr=`echo $i`_strings.txt
        mkdir -p $filedir