RhinoSecurityLabs/dsnap

Offline Mode for exploring snapshots

RyanJarv opened this issue · 0 comments

Is your feature request related to a problem? Please describe.

Currently the vagrant VM has access to the internet, while the box doesn't have access to the vagrant config to escape to the host (https://blog.ryanjarv.sh/2019/06/08/malicious-vagrant-boxes.html) it still has access to the hosts loopback adapter due to how virtualbox NAT works (https://blog.ryanjarv.sh/2020/11/13/virtual-box-networking.html).

This, or having network access in general, is not ideal for forensics.

Describe the solution you'd like

Add an offline mode that disables networking on vagrant up.

This can be done by editing the vagrant file but would be nice to expose in dsnap as well.

Describe alternatives you've considered

Using something other then the default NAT may take care of the loopback issue, would need to do more research on a config that would work here.