segunda-feira, 25 de abril de 2011

Detect if you are Running a Virtual Machine (para Pentest ou Análise de Malware)

Would you like to know if your server’s OS is running on bare-metal or on a virtual machine. imvirt and virt-what are 2 Linux scripts that allow you to do so easily. Both are open source and can be downloaded from their websites and Ubuntu’s Synaptic Package Manager as well.
virt-what

virt-what is a shell script maintained by Red Hat that does the same thing. It prints more details about the VM than imvirt if a VM was found. Otherwise it exits with code 0 (no error) and does not print anything.

To download it visit virt-what
http://people.redhat.com/~rjones/virt-what/

imvirt

imvirt was developed in Perl by Thomas Liske. It does its job by looking for wellknown boot messages, directories and reading DMI (Desktop Management Interface) data. It prints one line. These are the tool’s outputs and what they mean:

HVM: - signature of an unknown hypervisor
VirtualBox - VirtualBox
Virtual Machine - Microsoft Virtual PC/Virtual Server
VMware - VMware Virtual Platform
VMware (Express|ESX Server|GSX Server|Workstation) - VMware Virtual Platform
OpenVZ - OpenVZ/Virtuosso
Physical - This is a physical machine or a not detected container.
QEMU - QEMU/KVM (based)
UML - User Mode Linux
Xen - Xen hypervisor
Xen 3.x (PV|HVM) - Xen hypervisor

To download it visit imvirt’s SourceForge page.
http://sourceforge.net/projects/imvirt/