parsing output from tools

From: H C (keydet89@yahoo.com)
Date: 05/29/02 

Date: Tue, 28 May 2002 18:35:05 -0700 (PDT)
From: H C <keydet89@yahoo.com>
To: incidents@securityfocus.com

I recently had the opportunity to review some data
from a supposedly "hacked" box. One of the things I
ran into was the difficulty of parsing through data
from various tools. For example, to get a good
picture of what's going on on an NT/2K system, I'd run
handle.exe, pslist.exe, listdlls.exe, fport.exe and
'netstat -an'. But how to parse through all that? I
found that printing it out and going back and forth
between pages could be tedious.

What I did was write a script called 'procdmp.pl'.
It's located here:

http://patriot.net/~carvdawg/perl.html

You use it like this...you run each tool, redirecting
the output to a file. When you run handle.exe, the
command looks like this:

handle > handle.log

(NOTE: In this iteration of the script, file names are
hard coded.)

When you launch the script, it will parse through the
data and return an HTML file containing tables for
each process. The tables contain the process name and
PID, the commandline for the process, the user
context, and (if any) open ports and connections.

I'm providing for those who want to use it. I thought
that after reading many of the posts here that it
might be useful.

__________________________________________________
Do You Yahoo!?
Yahoo! - Official partner of 2002 FIFA World Cup
http://fifaworldcup.yahoo.com

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com

Relevant Pages

  • re: What is TWS_32?
    ... I wrote a script ... available as standalone executables on the CD I ... command line is all in one place for each process. ... Do You Yahoo!? ...
    (Security-Basics)
  • Re: Find problem
    ... I suggest use the find command to make a list of .ra files ... then use a "for" loop in the script to parse the list of .ra files into ... mp3 files. ... I have this script: ...
    (alt.linux)
  • [HPADM] Scripting Question
    ... I am trying to write a script that will take output from a command or ... parse a file to get certain information from within the output or file. ... ends when it matches another given string. ...
    (HP-UX-Admin)
  • Re: script that parses command line, and execfile()
    ... I have a script that uses the "optparse" package to parse the command line. ... I get errors because there is no argv dictionary when used with execfile. ...
    (comp.lang.python)
  • HList - is parameter formal?
    ... I have the simple script below. ... You can select any of them, this value is passed to hideor showcommand but the result is the same. ... (My server rejects all messages from Yahoo and Hotmail. ...
    (comp.lang.perl.tk)