Demo files from SecTor 2024 Arsenal

[nightlark]

These are files used for the SecTor 2024 Arsenal demo presentation. They are fairly similar to the ones from the BH USA version (#248), with the following changes:

• Commented out plugin installation portion of the demo (grype downloading 100+ MB CVE database wasn't working on the slow WiFi)
• Moved sample JavaScript file and Docker image tarball outside of the nested subfolders

demo.sh:

#!/bin/bash

################
# Setup Demo Env
################
# have grype plugin source code checked out into ~/Surfactant/plugins/grype
# copy baseline demo folder and cd into it
# the baseline demo folder should contain the following files:
#  - Helics-3.5.2-Linux-x86_64.tar.gz
#  - config.json
#  - jquery_sample/unknown.min.js (from https://code.jquery.com/jquery-3.7.1.min.js)
#  - docker_img/alpine-3.16.tar (from running docker save alpine:3.16)
#  - Surfactant-0.0.0rc10-py3-none-any.whl (copy of Surfactant whl to avoid network access)
cp -r Demo-Files-Backup demo-working-dir
pushd demo-working-dir

# wipe screen for clean start
clear

#######################
# Installing Surfactant
#######################

# Install Surfactant
echo -n "> "
read -p "pipx install surfactant"
pipx install Surfactant-0.0.0rc10-py3-none-any.whl

echo ""
read -p "Alternative: pipx install git+https://github.com/LLNL/Surfactant"

# Demo running help command
echo -n "> "
read -p "surfactant --help"
surfactant --help
echo ""

# Demo running config command
echo -n "> "
read -p "surfactant config core.recorded_institution SecTor2024"
surfactant config core.recorded_institution "SecTor2024"
echo ""

# Demo running help generate command
echo -n "> "
read -p "surfactant generate --help"
surfactant generate --help
echo ""

# Demo listing output formats
echo -n "> "
read -p "surfactant generate --list_output_formats"
surfactant generate --list_output_formats
echo ""

# Acquire sample
read -p "> "
echo -n "> curl -O https://github.com/GMLC-TDC/HELICS/releases/download/v3.5.2/Helics-3.5.2-Linux-x86_64.tar.gz"
read # Don't actually do this.. just use our already copied version...

# Unpack the sample
echo -n "> "
read -p "tar xvf Helics-3.5.2-Linux-x86_64.tar.gz"
tar xvf Helics-3.5.2-Linux-x86_64.tar.gz
read -p "> "

# Acquire JavaScript sample
echo -n "> "
read -p "curl -o unknown.min.js https://code.jquery.com/jquery-3.7.1.min.js"
#read # Don't actually do this.. just use our already copied version

# Save Docker sample
read -p "> docker pull alpine:3.16"
echo -n "> docker save alpine:3.16 -o alpine-3.16.tar"
read # Don't actually do this.. just use our already copied version

# Open config.json file
echo -n "> "
read -p "code config.json"
code config.json
echo -n "> "
read # pause for a bit before the next command

# Run Surfactant generate on it using a config file
echo -n "> "
read -p "surfactant generate config.json sbom.json"
surfactant generate config.json sbom.json

# Open sbom.json file
echo -n "> "
read -p "code sbom.json"
code sbom.json
echo -n "> "
read # pause for a bit before the next command

# Install a plugin...
#echo -n "> "
#read -p "pip install git+https://github.com/theStache/Surfactant.git@cvebin2vex-plugin#subdirectory=plugins/cvebin2vex"
#pip install git+https://github.com/theStache/Surfactant.git@cvebin2vex-plugin#subdirectory=plugins/cvebin2vex
#read -p "pipx inject surfactant git+https://github.com/LLNL/Surfactant#subdirectory=plugins/grype"
#pipx inject surfactant ~/Surfactant/plugins/grype

# Re-run Surfactant generate
#echo -n "> "
#read -p "surfactant generate config.json sbom.json"
#surfactant generate config.json sbom.json

# Open sbom.json file
#echo -n "> "
#read -p "code sbom.json"
#code sbom.json
#echo -n "> "
#read # pause for a bit before the next command

###############
# Demo Clean-up
###############
popd
rm -rf demo-working-dir
pipx uninstall surfactant

config.json:

[
    {
        "extractPaths": ["Helics-3.5.2-Linux-x86_64"],
        "archive": "Helics-3.5.2-Linux-x86_64.tar.gz",
        "installPrefix": "/usr/"
    },
    {
        "extractPaths": ["unknown.min.js"],
        "installPrefix": "/webroot/"
    },
    {
        "extractPaths": ["docker_img/alpine-3.16.tar"]
    }
]

The SourceTrail files used were the same as from the BlackHat USA demo files linked above.