Honeynet Forensic Challenge - Analyzing Malicious Portable Destructive Files
For those of you who are fans of the various challenges, the Honeynet Project has released challenge 6 in their 2010 forensics series.
"PDF format is the de-facto standard in exchanging documents online. Such popularity, however, has also attracted cyber criminals in spreading malware to unsuspecting users. The ability to generate malicious pdf files to distribute malware is functionality that has been built into many exploit kits. As users are less cautious opening PDF files, the malicious PDF file has become quite a successful attack vector. [1]"
[1] http://honeynet.org/challenges/2010_6_malicious_pdf
-----------
Guy Bruneau IPSS Inc. gbruneau at isc dot sans dot org
Scripting with Unix Date
I have been "playing" with the date command for a while in various Unix shell scripts and found the following date options quite useful.
Setting Unix system date and time
- November 13, 06:30 a.m., 2010 do the following: date 111306302010
Unix epoch time to regular time
- date –d @1289524456 will provide a result of "Thu Nov 11 20:14:16 EST 2010"
Unix date to epoch time
- date +%s -d “2010-11-03” will provide a result of 1288756800
Unix epoch time to print only the time Fri Sep 10 10:00:01 EDT 2010
- date -d @1288310401 +%k:%M will provide a result of 20:00 hours
Print yesterday's date (today - 1) in the Year-Month-Day format
- date --date "-1 days" +"%Y-%m-%d" will produce a result of 2010-11-10
Print last month's date (today - 1 month) in the Year-Month-Day format
- date --date "-1 month" +"%Y-%m-%d" will produce a result of 2010-10-11
You can also check the Unix man pages to display other time/date combination. If you know other date "tricks" you would like to share, you can send them via our contact page and I will added them to this diary.
-----------
Guy Bruneau IPSS Inc. gbruneau at isc dot sans dot org
Comments