Package: grrshell
GRR ShellTL;DRGRRShell is an interactive command line utility used for navigating a remote
client's Emulated Filesystem (EFS)[0], collecting files and launching artefact
collection flows.[0] So named to disambiguate with the Virtual File System (VFS) in the GRR Web UI.UsageImportant: Using GRRShell requires that you already have been granted access to
a client to launch flows. GRRShell does not have functionality to request access
to a remote client, you will need to do this through the GRR web UI.Rungrrshellas follows:grrshell command [options]Ifcommandis not provided,shellis assumed.Commands SupportedshellThe primary function of GRRShell is the interactive shell, launched by this
command. The shell uses the results of a TimelineFlow to populate an in-memory
representation of the remote filesystem, referred to as the EFS. When launching,
a Timeline is selected in the following precedence:A Timeline flow ID that is specified by the operator with the--initial-timlineflagA Timeline flow which completed successfully on the client within the last 3 hoursA new Timeline flow is launchedNote: Windows machines only haveC:/collected by default. To collect other
volumes, userefresh D:/(for example.)Based on the need for a Timeline flowit can take a few minutes for the shell
to become usable, and #3 will only work if the client is online.Command options:--usernameGRR username--passwordGRR password--grr-serverGRR HTTP Endpoint--client- The remote client. Supports FQDNs (eg.ramoj.domain.com) or GRR Client IDs (C.abcdef0123456789)--initial-timeline- [Optional] Specify an existing timeline flow ID forthe host (eg,A1B2C3D4E5F6A1B2).--max-file-size- [Optional] Specify a max file size for file collections. If not specified, the GRR default of500MBis used.--no-initial-timelineStart without collecting a timeline from the client. Mostly used for debugging.Once launched, a prompt similar to the below will be presented:The prompt displays the Client ID followed by the current working directory.
Shell mode supports autocomplete of shell commands, and where appropriate,
remote paths (shown here) and artefact names.Visible in the status bar of the display is theLast seentime for the client
(helpfully green if seen in the last 10 minutes, yellow up to a half hour, red
for longer.) Additionally, an indicator of how many flows are running in the
background, as well as the total count of flows launched is shown. Finally, the
freshness of the timeline used for the Emulated FS is also displayed (coloured
similarly toLast Seen).[1][1] As therefreshcommand allows for partial Timeline updates, this
timestamp is the freshness of the EFS at the current working directory.The following shell commands are supported.[]params are optional,<>are
required.help- Display help text (alsohand?.) Display extended help for a
command withhelp <command>.pwd- Print the current working directory.ls [path]- List entries in the current working directory.[path]is
optional,./is assumed if not specified. Wildcards*are supported in
the final path component. Default sort order is alphabetical with
directories first. Flags:-SSort by file size-tSort by modification time-rReverse sort ordercd <path>- Change working directory.info <path>- Collect information for a file (alsohash <path>). This is
performed by a synchronousClientFileFinderflow with theHASHoption.
Will display MAC times, permission info, and hashes, among other things.
SupportsClientFileFinderwildcards. Optional flags:--ads- AttemptZone.Identifieralternate data stream collection
(not supported with wildcards; Windows only).--offline- Use the cached TimelineFlow info rather than launching a
flow.*collect <path>- Collect remote files. This is performed in the background
by an asynchronousClientFileFinderflow, and so supportsClientFileFinderpath wildcards. Files are downloaded to the local current
working directory, named for the client ID, and remote directory structure
is preserved.artefact <artefact_name>(alt spellingartifact) Collect an artefact viaArtifactCollectorFlow. This is performed asynchronously in the background.
Similar tocollect, files are downloaded to the local current working
directory, and remote directory structure is preserved.flows- Fetch current state of any background flows for display. Ifall [count]is specified, then all flows launched on the client are listed, not
just flows from this GRR Shell session.detail <flow id>- Fetch and display more detailed information on a flow.resume <flow id>- (Re)attach a flow to this shell session.ClientFileFinder,ArtifactCollectorFlow, andGetFile(Zone.Identifier
ADS only) are supported. Resuming an asynchronous flow will download the
flow results in the background. Synchronous flows will display the flow
result.refresh [path]- Update the emulated filesystem with a freshTimelineFlow(synchronous). Giving an optional path sets that path as the
Timeline root, which can speed up flow collection. Useful if the entire
filesystem is not required to be refreshed.find [dir] <regex>- Search for files matching a regex pattern.
Functionally similar to bash'sfind <dir> | grep -P <regex>. If<dir>is
not specified,./is assumed.clearClear the terminal screen.exitExit shell (alsoquitand<CTRL+D>)Additionally,setcan be used to set shell runtime values. Currently, only one
such value is used:max-file-sizeSpecify a max file size for file collections. If not
specified, the GRR default of500MBis used.collectUse to collect a set of files from the remote client. This uses the GRRClientFileFinderflow, and so path wildcards available toClientFileFinderare supported.Command options:--usernameGRR username--passwordGRR password--grr-serverGRR HTTP Endpoint--client- The remote client. Supports FQDNs (eg.ramoj.domain.com) or GRR Client IDs (C.abcdef0123456789)--remote-path-ClientFileFinderexpression for files to collect--local_path- Location to store the retrieved filesRemote file path structures are preserved on collection, so a command with--remote-path /home/ramoj/tmp/file --local-path /tmpwill result in the
collected file being available at/tmp/home/ramoj/tmp/file.artefactAlt spellingartifact.Collect an artefact from the client.--usernameGRR username--passwordGRR password--grr-serverGRR HTTP Endpoint--client- The remote client. Supports FQDNs (eg.ramoj.domain.com) or GRR Client IDs (C.abcdef0123456789)--artefact- Artefact definition to collect, eg,BrowserHistory.--local_path- Location to store the retrieved files