Demo files from BlackHat USA 2024 Arsenal

[nightlark]

These are files used for the BlackHat USA 2024 Arsenal demo presentation. They are fairly similar to the ones from the BH Asia version (#187), but with changes including:

• Addition of a JavaScript and saved Docker image tar file to demonstrate new info extraction capabilities and well-known JS library recognition
• Use of pipx to automatically manage a virtual environment
• Using grype plugin to demonstrate plugin functionality (+ CVE scanning plugin for Docker containers)
• Use of VS Code to show contents of config.json file and generated SBOMs
• Installing from offline copies of Surfactant wheel file, and grype source code (to avoid network related issues during a live demo)
• SourceTrail database example project created from HELICS release

demo.sh:

#!/bin/bash

################
# Setup Demo Env
################
# have grype plugin source code checked out into ~/Surfactant/plugins/grype
# copy baseline demo folder and cd into it
# the baseline demo folder should contain the following files:
#  - Helics-3.5.2-Linux-x86_64.tar.gz
#  - config.json
#  - jquery_sample/unknown.min.js (from https://code.jquery.com/jquery-3.7.1.min.js)
#  - docker_img/alpine-3.16.tar (from running docker save alpine:3.16)
#  - Surfactant-0.0.0rc8-py3-none-any.whl (copy of Surfactant whl to avoid network access)
cp -r Demo-Files-Backup demo-working-dir
pushd demo-working-dir

# wipe screen for clean start
clear

#######################
# Installing Surfactant
#######################

# Install Surfactant
echo -n "> "
read -p "pipx install surfactant"
pipx install Surfactant-0.0.0rc8-py3-none-any.whl

echo ""
read -p "Alternative: pipx install git+https://github.com/LLNL/Surfactant"

# Demo running help command
echo -n "> "
read -p "surfactant --help"
surfactant --help
echo ""

# Demo running config command
echo -n "> "
read -p "surfactant config core.recorded_institution BlackHatUSA"
surfactant config core.recorded_institution "BlackHatUSA"
echo ""

# Demo running help generate command
echo -n "> "
read -p "surfactant generate --help"
surfactant generate --help
echo ""

# Demo listing output formats
echo -n "> "
read -p "surfactant generate --list_output_formats"
surfactant generate --list_output_formats
echo ""

# Acquire sample
echo -n "> curl -O https://github.com/GMLC-TDC/HELICS/releases/download/v3.5.2/Helics-3.5.2-Linux-x86_64.tar.gz"
read # Don't actually do this.. just use our already copied version...

# Unpack the sample
echo -n "> "
read -p "tar xvf Helics-3.5.2-Linux-x86_64.tar.gz"
tar xvf Helics-3.5.2-Linux-x86_64.tar.gz
read -p "> "

# Acquire JavaScript sample
echo -n "> curl --create-dirs -o jquery_sample/unknown.min.js https://code.jquery.com/jquery-3.7.1.min.js"
read # Don't actually do this.. just use our already copied version

# Save Docker sample
echo -n "> mkdir docker_img && docker save alpine:3.16 -o docker_img/alpine-3.16.tar"
read # Don't actually do this.. just use our already copied version

# Open config.json file
echo -n "> "
read -p "code config.json"
code config.json
echo -n "> "
read # pause for a bit before the next command

# Run Surfactant generate on it using a config file
echo -n "> "
read -p "surfactant generate config.json sbom.json"
surfactant generate config.json sbom.json

# Open sbom.json file
echo -n "> "
read -p "code sbom.json"
code sbom.json
echo -n "> "
read # pause for a bit before the next command

# Install a plugin...
echo -n "> "
#read -p "pip install git+https://github.com/theStache/Surfactant.git@cvebin2vex-plugin#subdirectory=plugins/cvebin2vex"
#pip install git+https://github.com/theStache/Surfactant.git@cvebin2vex-plugin#subdirectory=plugins/cvebin2vex
read -p "pipx inject surfactant git+https://github.com/LLNL/Surfactant#subdirectory=plugins/grype"
pipx inject surfactant ~/Surfactant/plugins/grype

# Re-run Surfactant generate
echo -n "> "
read -p "surfactant generate config.json sbom.json"
surfactant generate config.json sbom.json

# Open sbom.json file
echo -n "> "
read -p "code sbom.json"
code sbom.json
echo -n "> "
read # pause for a bit before the next command

###############
# Demo Clean-up
###############
popd
rm -rf demo-working-dir
pipx uninstall surfactant

config.json:

[
    {
        "extractPaths": ["Helics-3.5.2-Linux-x86_64"],
        "archive": "Helics-3.5.2-Linux-x86_64.tar.gz",
        "installPrefix": "/usr/"
    },
    {
        "extractPaths": ["jquery_sample"],
        "installPrefix": "/webroot/"
    },
    {
        "extractPaths": ["docker_img"]
    }
]

SourceTrail-Files.zip