emrekybs · 7h3Pr1es7 · Feb 21, 2024 · Feb 21, 2024 · Feb 21, 2024 · Feb 21, 2024
diff --git a/3.png b/3.png
diff --git a/Bash Sample Report - kali-2024-02-21_17-16-28_UTC.html b/Bash Sample Report - kali-2024-02-21_17-16-28_UTC.html
diff --git a/MrHandler - Direct Terminal.py b/MrHandler - Direct Terminal.py
@@ -0,0 +1,183 @@
+from time import sleep
+from colorama import Fore, init
+
+init(autoreset=True)
+
+class Incresp():
+    def __init__(self):
+        self.__str__()
+        self.RESPONSE = ""
+        self.Run()
+
+    def __str__(self):
+        print(Fore.LIGHTYELLOW_EX + """
+         _nnnn_                      
+        dGGGGMMb     ,''''''''''''''''''''''''';
+       @p~qp~~qMb    | Linux Incident Response! |
+       M|@||@) M|   _;.........................;
+       @,----.JM| -' 
+      JS^\__/  qKL
+     dZP        qKRb
+    dZP          qKKb
+   fZP            SMMb
+   HZM            MMMM
+   FqM            MMMM
+ __| ".        |\dS"qML
+ |    `.       | `' \Zq
+_)      \.___.,|     .'
+\____   )MMMMMM|   .'
+     `-'       `--' Author: By emrekybs 
+     		    https://github.com/emrekybs    
+        """)
+
+    def Run(self):
+        sleep(2)
+        report_saved = False
+
+        html_template = """
+        <!DOCTYPE html>
+        <html>
+        <head>
+            <title>Incident Response Report</title>
+        </head>
+        <body>
+            <!-- Linux Computer Incident Response Reporting Form -->
+            <h1>Linux Computer Incident Reporting Form</h1>
+            <form action="/submit-incident" method="post">
+                <label for="isDrill">Is this a drill?</label>
+                <select id="isDrill" name="isDrill">
+                    <option value="yes">Yes</option>
+                    <option value="no" selected>No</option>
+                </select>
+
+                <!-- General Incident Information -->
+                <fieldset>
+                    <legend>General Incident Information</legend>
+                    <label for="date">Date:</label>
+                    <input type="date" id="date" name="date" required>
+
+                    <label for="time">Time:</label>
+                    <input type="time" id="time" name="time" required>
+
+                    <label for="timezone">Time Zone:</label>
+                    <input type="text" id="timezone" name="timezone" required>
+
+                    <label for="incidentHandlerName">Incident Handler Name:</label>
+                    <input type="text" id="incidentHandlerName" name="incidentHandlerName" required>
+
+                    <label for="incidentHandlerPhone">Incident Handler Phone:</label>
+                    <input type="tel" id="incidentHandlerPhone" name="incidentHandlerPhone" required>
+
+                    <label for="incidentHandlerEmail">Incident Handler Email:</label>
+                    <input type="email" id="incidentHandlerEmail" name="incidentHandlerEmail" required>
+                </fieldset>
+
+                <!-- Initial Detection -->
+                <fieldset>
+                    <legend>Initial Detection</legend>
+                    <label for="typeOfIncident">Type of Incident:</label>
+                    <input type="text" id="typeOfIncident" name="typeOfIncident" required>
+
+                    <label for="detectionDateTime">Date, time, and time zone of first detection:</label>
+                    <input type="text" id="detectionDateTime" name="detectionDateTime" required>
+
+                    <label for="involvedPersons">List names and contact information for all persons involved in detection and initial investigation:</label>
+                    <textarea id="involvedPersons" name="involvedPersons" rows="4" required></textarea>
+
+                    <label for="incidentDetectionMethod">How was incident detected?</label>
+                    <input type="text" id="incidentDetectionMethod" name="incidentDetectionMethod" required>
+
+                    <label for="incidentDescription">What do you think happened?</label>
+                    <textarea id="incidentDescription" name="incidentDescription" rows="4" required></textarea>
+
+                    <label for="systemsInvolved">List of systems involved:</label>
+                    <textarea id="systemsInvolved" name="systemsInvolved" rows="4" required></textarea>
+                </fieldset>
+            </form>
+            <!-- End of the Linux Computer Incident Reporting Form -->
+
+            <!-- Existing template for command execution results -->
+            <table border="1">
+                <tr>
+                    <th style="font-size: 18px;">Checked</th>
+                    <th>INCIDENT RESPONSE RESULT</th>
+                </tr>
+                {}
+            </table>
+        </body>
+        </html>
+        """
+
+
+        html_content = ""
+
+        commands = [
+            ("ifconfig && ip a", "Network Interfaces and IP Addresses."),
+            ("arp -a", "ARP Table."),
+            ("hostname", "Display the system's hostname."),
+            ("uname -a", "Display system information including the kernel version."),
+            ("df -h", "Display disk usage."),
+            ("free -m", "Display memory usage."),
+            ("ps aux", "Display running processes."),
+            ("top -n 1 -o %CPU", "Display real-time system statistics."),
+            ("cat /etc/passwd", "User Accounts."),
+            ("cat /etc/shadow", "Password Information."),
+            ("cat /etc/group", "Information about user groups."),
+            ("cat /etc/sudoers", "sudoers file content."),
+            ("lastlog", "Last Login Information."),
+            ("tail /var/log/auth.log", "Authentication logs."),
+            ("tail /var/log/syslog.log", "System logs."),
+            ("tail /var/log/demon.log", "Demon logs."),
+            ("tail /var/log/apache/access.log", "Apache Access Logs."),
+            ("tail /var/log/nginx/access.log", "Nginx Access Logs."),
+            ("tail /var/log/mysqld.log", "MySQL Server Logs."),
+            ("ps -aux", "Detailed Process Information."),
+            ("uptime", "System Uptime."),
+            ("cat /proc/meminfo", "Memory Information."),
+            ("ps aux", "Currently Running Processes."),
+            ("last -f /var/log/wtmp", "Login History."),
+            ("cat /etc/resolv.conf", "DNS Resolver Configuration."),
+            ("cat /etc/hosts", "Display Hosts File Content."),
+            ("ls -alR /proc/*/cwd", "List current working directories of processes."),
+            ("iptables -L -v -n", "Display Firewall Rules."),
+            ("service --status-all", "List All Available Services."),
+            ("find / -type f -size +512k -exec ls -lh {{}};", "Find and list large files on the system."),
+            ("netstat -punta", "Network Statistics."),
+            ("echo $PATH", "Display the system's PATH environment variable.")
+        ]
+
+        try:
+            for command, description in commands:
+                print(Fore.LIGHTGREEN_EX + description)
+                output = self.execute_command(command)
+
+                html_content += f"<tr><td><div style='font-size: 18px;'>{description}</div></td><td><pre>{output}</pre></td></tr>"
+
+                self.RESPONSE += f"{command}:\n{output}"
+        except Exception as e:
+            print(e)
+        finally:
+            report_saved = self.save_report(html_template, html_content)
+
+        if report_saved:
+            print("Report saved.")
+
+    def execute_command(self, command):
+        import subprocess
+        try:
+            output = subprocess.check_output(command, shell=True, stderr=subprocess.STDOUT, universal_newlines=True)
+            return output
+        except subprocess.CalledProcessError as e:
+            return e.output
+
+    def save_report(self, html_template, html_content):
+        try:
+            with open("report.html", "w") as html_file:
+                html_output = html_template.format(html_content)
+                html_file.write(html_output)
+            return True
+        except Exception as e:
+            print("Error occurred while saving report:", e)
+            return False
+
+incresp = Incresp()
diff --git a/MrHandler - Direct Terminal.sh b/MrHandler - Direct Terminal.sh
@@ -0,0 +1,120 @@
+#!/bin/bash
+
+# Function to execute a command and capture its output and errors
+execute_command() {
+    local command=$1
+    local output=$(eval "$command" 2>&1)
+    echo "$output"
+}
+
+# Function to generate HTML report
+generate_html_report() {
+    local hostname=$(hostname)
+    local date_time=$(date -u '+%Y-%m-%d_%H-%M-%S_%Z')
+    local report_name="${hostname}-${date_time}.html"
+
+    cat <<EOF >"$report_name"
+<!DOCTYPE html>
+<html lang="en">
+
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
+    <title>Linux Incident Response Diagnosis Report</title>
+    <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/4.5.2/css/bootstrap.min.css">
+    <script src="https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js"></script>
+    <script src="https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.16.0/umd/popper.min.js"></script>
+    <script src="https://maxcdn.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js"></script>
+</head>
+
+<body>
+    <div class="container">
+        <h1 class="mt-3">Linux - IR Computer Diagnosis Report</h1>
+        <form action="/submit-incident" method="post">
+            <fieldset class="form-group">
+                <legend>Analyst Notes</legend>
+                <textarea class="form-control" rows="5"></textarea>
+            </fieldset>
+            <fieldset class="form-group">
+                <legend>Meta Information</legend>
+                <div class="form-group">
+                    <label for="reportGenerationDate" class="col-form-label">Report Generation Date (UTC):</label>
+                    <input type="text" id="reportGenerationDate" name="reportGenerationDate" class="form-control"
+                        value="$(date -u '+%Y-%m-%d %H:%M:%S %Z')" disabled>
+                </div>
+                <div class="form-group">
+                    <label for="incidentHandlerName">Report Generated By:</label>
+                    <input type="text" id="incidentHandlerName" name="incidentHandlerName" class="form-control">
+                </div>
+            </fieldset>
+        </form>
+    </div>
+
+    <div class="container mt-4">
+EOF
+
+    # Loop through the provided commands and add sections to the HTML report
+    commands=(
+        "ifconfig && ip a|Network Interfaces and IP Addresses."
+        "arp -a|ARP Table."
+        "hostname|Display the system's hostname."
+        "uname -a|Display system information including the kernel version."
+        "df -h|Display disk usage."
+        "free -m|Display memory usage."
+        "ps aux|Display running processes."
+        "top -n 1 -o %CPU|Display real-time system statistics."
+        "cat /etc/passwd|User Accounts."
+        "cat /etc/shadow|Password Information."
+        "cat /etc/group|Information about user groups."
+        "cat /etc/sudoers|sudoers file content."
+        "lastlog|Last Login Information."
+        "tail /var/log/auth.log|Authentication logs."
+        "tail /var/log/syslog.log|System logs."
+        "tail /var/log/demon.log|Demon logs."
+        "tail /var/log/apache/access.log|Apache Access Logs."
+        "tail /var/log/nginx/access.log|Nginx Access Logs."
+        "tail /var/log/mysqld.log|MySQL Server Logs."
+        "ps -aux|Detailed Process Information."
+        "uptime|System Uptime."
+        "cat /proc/meminfo|Memory Information."
+        "ps aux|Currently Running Processes."
+        "last -f /var/log/wtmp|Login History."
+        "cat /etc/resolv.conf|DNS Resolver Configuration."
+        "cat /etc/hosts|Display Hosts File Content."
+        "ls -alR /proc/*/cwd|List current working directories of processes."
+        "iptables -L -v -n|Display Firewall Rules."
+        "service --status-all|List All Available Services."
+        "find / -type f -size +512k -exec ls -lh {} \;|Find and list large files on the system."
+        "netstat -punta|Network Statistics."
+        "echo \$PATH|Display the system's PATH environment variable."
+    )
+
+    for command_info in "${commands[@]}"; do
+        IFS="|" read -r command description <<<"$command_info"
+        echo "<div class=\"card mt-3\">" >>"$report_name"
+        echo "    <div class=\"card-header bg-dark text-white\">" >>"$report_name"
+        echo "        <h5 class=\"mb-0\">$description - $command</h5>" >>"$report_name"
+        echo "    </div>" >>"$report_name"
+        echo "    <div class=\"card-body\">" >>"$report_name"
+        output=$(execute_command "$command")
+        echo "        <pre>" >>"$report_name"
+        echo "$output" >>"$report_name"
+        echo "        </pre>" >>"$report_name"
+        echo "    </div>" >>"$report_name"
+        echo "</div>" >>"$report_name"
+        echo "Command Completed: $command_info"  # Verbose output
+    done
+
+    # Closing HTML
+    cat <<EOF >>"$report_name"
+    </div>
+</body>
+
+</html>
+EOF
+
+    echo "HTML report generated: $report_name"
+}
+
+# Run checks and generate the report
+generate_html_report
diff --git a/MrHandler.py → MrHandler - Over SSH.py b/MrHandler.py → MrHandler - Over SSH.py
diff --git a/README.md b/README.md
@@ -10,12 +10,13 @@ This report details both the specifics of the incident response process and the
 # 𝗜𝗡𝗦𝗧𝗔𝗟𝗟𝗔𝗧𝗜𝗢𝗡 𝗜𝗡𝗦𝗧𝗥𝗨𝗖𝗧𝗜𝗢𝗡𝗦
       $ pip3 install colorama
       $ pip3 install paramiko
-      $ git clone https://github.com/emrekybs/BlueFish.git
+      $ git clone https://github.com/emrekybs/MrHandler.git
       $ cd MrHandler
       $ chmod +x MrHandler.py 
       $ python3 MrHandler.py 
 
 <img src="https://github.com/emrekybs/MrHandler/blob/main/1.png">
+<img src="https://github.com/7h3pr1es7/MrHandler/blob/main/3.png">
 
 # Report 
 <img src="https://github.com/emrekybs/MrHandler/blob/main/2.png">