LiMEaide
v2.0
by Daryl Bennett - kd8bny[at]gmail[dot]com
About
LiMEaide is a python application designed to remotely or locally dump RAM of a Linux client and create a volatility profile for later analysis on your local host. I hope that this will simplify Linux digital forensics in a remote environment. In order to use LiMEaide all you need to do is feed a remote Linux client IP address, sit back, and consume your favorite caffeinated beverage.
LiMEaide has 3 primary modes of operation
- Remote - Initiates connection with SSH and transfers data over SFTP
- Socket - Initiates a connection with SSH but transfers the memory image over a TCP socket. This means that the image is NOT written to disk. Tools are still transfered over SFTP.
- Locally - Have a copy of LiMEiade on a flash drive or other device. Does not transfer any data to the client, maintain execution in its working directory. All transfers are completed with internal methods and no network sockets are opened.
Wiki
For more detailed usage checkout the wiki
How To
TL;DR
Remote
python3 limeaide.py
and magic happens.
Local
python3 limeaide.py local
and local magic happens.
Local transfer requires the machine to have python 3 installed and dependencies. I recommend using python3-virtualenv to provide dependencies without installing on the system.
Detailed usage
limeaide.py [OPTIONS] REMOTE_IP
-h, --help
Shows the help dialog
-u, --user :
Execute memory grab as sudo user. This is useful when root privileges are not granted.
-k, --key :
Use a SSH Key to connect
-s, --socket :
Use a TCP socket instead of a SFTP session to transfer data. Does not write the memory image to disk, but will transfer other needed files.
-o, --output :
Name the output file
-f, --format :
Change the output format. Valid options are raw|lime|padded
-d, --digest :
Use a different digest algorithm. See LiME docs for valid options
Use 'None' to disable.
-C, --compress
Compress transfer over the wire. This will not work with socket or local transfers.
-p, --profile :
Skip the profiler by providing the distribution, kernel version, and architecture of the remote client.
-N, --no-profiler
Do NOT run profiler and force the creation of a new module/profile for the client.
-c, --case :
Append case number to front of output directory.
-v, --verbose
Display verbose output
--force-clean
If previous attempt failed then clean up client