Home

Awesome

LiMEaide

v2.0

by Daryl Bennett - kd8bny[at]gmail[dot]com

About

LiMEaide is a python application designed to remotely or locally dump RAM of a Linux client and create a volatility profile for later analysis on your local host. I hope that this will simplify Linux digital forensics in a remote environment. In order to use LiMEaide all you need to do is feed a remote Linux client IP address, sit back, and consume your favorite caffeinated beverage.

LiMEaide has 3 primary modes of operation

  1. Remote - Initiates connection with SSH and transfers data over SFTP
  2. Socket - Initiates a connection with SSH but transfers the memory image over a TCP socket. This means that the image is NOT written to disk. Tools are still transfered over SFTP.
  3. Locally - Have a copy of LiMEiade on a flash drive or other device. Does not transfer any data to the client, maintain execution in its working directory. All transfers are completed with internal methods and no network sockets are opened.

Wiki

For more detailed usage checkout the wiki

How To

TL;DR

Remote

python3 limeaide.py <IP>

and magic happens.

Local

python3 limeaide.py local

and local magic happens.

Local transfer requires the machine to have python 3 installed and dependencies. I recommend using python3-virtualenv to provide dependencies without installing on the system.

Detailed usage

limeaide.py [OPTIONS] REMOTE_IP
-h, --help
    Shows the help dialog

-u, --user : <user>
    Execute memory grab as sudo user. This is useful when root privileges are not granted.

-k, --key : <path to key> 
    Use a SSH Key to connect

-s, --socket : <port> 
    Use a TCP socket instead of a SFTP session to transfer data. Does not write the memory image to disk, but will transfer other needed files.

-o, --output : <Name desired for output> 
    Name the output file

-f, --format : <Format for LiME>
    Change the output format. Valid options are raw|lime|padded

-d, --digest : <digest>
    Use a different digest algorithm. See LiME docs for valid options
    Use 'None' to disable. 

-C, --compress
    Compress transfer over the wire. This will not work with socket or local transfers.

-p, --profile : <distro> <kernel version> <arch>
    Skip the profiler by providing the distribution, kernel version, and architecture of the remote client.

-N, --no-profiler
    Do NOT run profiler and force the creation of a new module/profile for the client.

-c, --case : <case num>
    Append case number to front of output directory.

-v, --verbose
    Display verbose output

--force-clean
    If previous attempt failed then clean up client

./profiles/

Set-up

Dependencies

python

sudo apt-get install python3-paramiko python3-termcolor

sudo yum install python3-paramiko python3-termcolor

sudo pip3 install paramiko termcolor

Installing dwarfdump

In order to build a volatility profile we need to be able to read the debugging symbols in the LKM. For this we need to install dwarfdump. If you encounter any issues finding/installing dwarfdump see the volatility page here

sudo apt-get install dwarfdump

sudo yum install libdwarf-tools

LiME

Auto-Install

By default LiMEaide will automatically download and place LiME in the correct directory. However, if you are disconnected from a network proceed with manual installation method in the section below.

Manually install LiME

In order to use LiME you must download and move the source into the LiMEaide/tools directory. Make sure the the LiME folder is named LiME. The full path should be as follows:

LiMEaide/tools/LiME/

How to...

  1. Download LiME v1.8.1
  2. Extract into LiMEaide/tools/
  3. Rename folder to LiME

Limits at this time

Special Thanks and Notes