Getting started with Velociraptor

0D0A
0D0A
Jul 13 · 5 min read

What is it?


Starting Simple

https://github.com/Velocidex/velociraptor/releases broad support on display

Recipe

mkdir ~/home/user/velociraptor
mkdir ~/home/user/velociraptor/tmp
mkdir ~/home/user/velociraptor/bin
mkdir ~/home/user/velociraptor/etc
cd ~/home/user/velociraptor/bin
wget github.com/velocidex/velociraptor/releases/velociraptor-linux-v3.3.zip
unzip velociraptor-linux-v3.3.zip
sudo chmod +x velociraptor-linux-v3.3.zip
./velociraptor-linux-v3.3 config generate > server.config.yaml
mv server.config.yaml ../etc/
Datastore:
implementation: FileBaseDataStore
location: /home/user/velociraptor/tmp/
filestore_directory: /home/user/velociraptor/tmp/
./velociraptor-linux-v3.3 --config ../etc/server.config.yaml user add <username>
./velociraptor-linux-v3.3 --config ../etc/server.config.yaml frontend
https://localhost:8889 Success! Well done, we downloaded and executed a file!
# ./velociraptor --config ../etc/server.config.yaml config client > ../etc/client.config.yaml
Windows-Victim-01: Lessons learned: sudo everything for better security
Success?: velociraptor-v0.3.0-windows-4.0-amd64.exe — config client.config.yaml client -v
SUCCESS!
velociraptor.binary --config /path/to/client.config.yaml client -v
The authoritative and standardised location agreed upon by all sophisticated malware authors for persistence mechanisms.
The authoritative and standardised location agreed upon by all sophisticated malware authors for persistence mechanisms.
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Run

Summary

Manufactured Outrage / To-do

Bloopers

0D0A

Written by

0D0A

Machine Learning | DFIR | Threat Hunting | Blue Team | Malware Analysis | Always learning

Welcome to a place where words matter. On Medium, smart voices and original ideas take center stage - with no ads in sight. Watch
Follow all the topics you care about, and we’ll deliver the best stories for you to your homepage and inbox. Explore
Get unlimited access to the best stories on Medium — and support writers while you’re at it. Just $5/month. Upgrade