search

ThreatResponse / margaritashotgun

Remote Memory Acquisition Tool
https://www.threatresponse.cloud
MIT License
241 stars 50 forks source link

--output-dir not respected #24

Open mgg1776 opened 6 years ago

mgg1776 commented 6 years ago

The memory dump file is output to the current working directory even when a full or relative path is specified with the --output-dir argument. This is not the case with the --log-dir argument, which does output the log file to the specified path.

I'm using Margarita Shotgun v0.4.0 on an Ubuntu Server 16.04 EC2 instance, which is configured as a SIFT v3 workstation.

The following is a sample run, where the directory output_dir already exists in the current working directory. I also tried outputting the memory dump file to a different output directory than the log file, but got the same results.

$ margaritashotgun --username ubuntu --key .ssh/my_private_key.pem --module lime-4.4.0-1049-aws.ko --server 10.0.0.1 --log-dir output_dir --log-prefix case123456 --output-dir output_dir --filename memdump.lime
2018-01-29T19:59:10 - margaritashotgun.memory - INFO - 10.0.0.1: dumping to file://memdump.lime
 10.0.0.1 100% |################################################################################################################| Time: 0:05:46  23.95 MB/s
2018-01-29T20:04:56 - margaritashotgun.memory - INFO - 10.0.0.1: capture complete: memdump.lime
2018-01-29T20:04:57 - margaritashotgun.client - INFO - 1 hosts processed. completed: 1 failed 0
2018-01-29T20:04:57 - margaritashotgun.client - INFO - completed_hosts: ['10.0.0.1']
2018-01-29T20:04:57 - margaritashotgun.client - INFO - failed_hosts: []

$ ls
lime-4.4.0-1049-aws.ko memdump.lime  output

$ ls output/
case123456-memory-capture.log