Pssst... stuff happening over here... #DFIR #Volatility #Linux github.com/halpomeranz/lmg
3
19
10
@hal_pomeranz nice work! Also, with 2.,3 by default if you don't give a bash history address it will bruteforce all "bash" processes
1
Replying to @attrc
@attrc Thanks! I'll play around with the 2.3 linux_bash some more. Questions may follow... ;-)

Mar 29, 2014 · 9:53 PM UTC

1
Replying to @hal_pomeranz
@hal_pomeranz its definitely slower since its bruteforcing, but it removes the need to find the structure offset