-
Notifications
You must be signed in to change notification settings - Fork 10
/
MrHandler - Direct Terminal.sh
120 lines (108 loc) · 4.83 KB
/
MrHandler - Direct Terminal.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
#!/bin/bash
# Function to execute a command and capture its output and errors
execute_command() {
local command=$1
local output=$(eval "$command" 2>&1)
echo "$output"
}
# Function to generate HTML report
generate_html_report() {
local hostname=$(hostname)
local date_time=$(date -u '+%Y-%m-%d_%H-%M-%S_%Z')
local report_name="${hostname}-${date_time}.html"
cat <<EOF >"$report_name"
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
<title>Linux Incident Response Diagnosis Report</title>
<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/4.5.2/css/bootstrap.min.css">
<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.16.0/umd/popper.min.js"></script>
<script src="https://maxcdn.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js"></script>
</head>
<body>
<div class="container">
<h1 class="mt-3">Linux - IR Computer Diagnosis Report</h1>
<form action="/submit-incident" method="post">
<fieldset class="form-group">
<legend>Analyst Notes</legend>
<textarea class="form-control" rows="5"></textarea>
</fieldset>
<fieldset class="form-group">
<legend>Meta Information</legend>
<div class="form-group">
<label for="reportGenerationDate" class="col-form-label">Report Generation Date (UTC):</label>
<input type="text" id="reportGenerationDate" name="reportGenerationDate" class="form-control"
value="$(date -u '+%Y-%m-%d %H:%M:%S %Z')" disabled>
</div>
<div class="form-group">
<label for="incidentHandlerName">Report Generated By:</label>
<input type="text" id="incidentHandlerName" name="incidentHandlerName" class="form-control">
</div>
</fieldset>
</form>
</div>
<div class="container mt-4">
EOF
# Loop through the provided commands and add sections to the HTML report
commands=(
"ifconfig && ip a|Network Interfaces and IP Addresses."
"arp -a|ARP Table."
"hostname|Display the system's hostname."
"uname -a|Display system information including the kernel version."
"df -h|Display disk usage."
"free -m|Display memory usage."
"ps aux|Display running processes."
"top -n 1 -o %CPU|Display real-time system statistics."
"cat /etc/passwd|User Accounts."
"cat /etc/shadow|Password Information."
"cat /etc/group|Information about user groups."
"cat /etc/sudoers|sudoers file content."
"lastlog|Last Login Information."
"tail /var/log/auth.log|Authentication logs."
"tail /var/log/syslog.log|System logs."
"tail /var/log/demon.log|Demon logs."
"tail /var/log/apache/access.log|Apache Access Logs."
"tail /var/log/nginx/access.log|Nginx Access Logs."
"tail /var/log/mysqld.log|MySQL Server Logs."
"ps -aux|Detailed Process Information."
"uptime|System Uptime."
"cat /proc/meminfo|Memory Information."
"ps aux|Currently Running Processes."
"last -f /var/log/wtmp|Login History."
"cat /etc/resolv.conf|DNS Resolver Configuration."
"cat /etc/hosts|Display Hosts File Content."
"ls -alR /proc/*/cwd|List current working directories of processes."
"iptables -L -v -n|Display Firewall Rules."
"service --status-all|List All Available Services."
"find / -type f -size +512k -exec ls -lh {} \;|Find and list large files on the system."
"netstat -punta|Network Statistics."
"echo \$PATH|Display the system's PATH environment variable."
)
for command_info in "${commands[@]}"; do
IFS="|" read -r command description <<<"$command_info"
echo "<div class=\"card mt-3\">" >>"$report_name"
echo " <div class=\"card-header bg-dark text-white\">" >>"$report_name"
echo " <h5 class=\"mb-0\">$description - $command</h5>" >>"$report_name"
echo " </div>" >>"$report_name"
echo " <div class=\"card-body\">" >>"$report_name"
output=$(execute_command "$command")
echo " <pre>" >>"$report_name"
echo "$output" >>"$report_name"
echo " </pre>" >>"$report_name"
echo " </div>" >>"$report_name"
echo "</div>" >>"$report_name"
echo "Command Completed: $command_info" # Verbose output
done
# Closing HTML
cat <<EOF >>"$report_name"
</div>
</body>
</html>
EOF
echo "HTML report generated: $report_name"
}
# Run checks and generate the report
generate_html_report