ThreatResponse/margaritashotgun

--output-dir not respected

Opened this issue · 0 comments

The memory dump file is output to the current working directory even when a full or relative path is specified with the --output-dir argument. This is not the case with the --log-dir argument, which does output the log file to the specified path.

I'm using Margarita Shotgun v0.4.0 on an Ubuntu Server 16.04 EC2 instance, which is configured as a SIFT v3 workstation.

The following is a sample run, where the directory output_dir already exists in the current working directory. I also tried outputting the memory dump file to a different output directory than the log file, but got the same results.

$ margaritashotgun --username ubuntu --key .ssh/my_private_key.pem --module lime-4.4.0-1049-aws.ko --server 10.0.0.1 --log-dir output_dir --log-prefix case123456 --output-dir output_dir --filename memdump.lime
2018-01-29T19:59:10 - margaritashotgun.memory - INFO - 10.0.0.1: dumping to file://memdump.lime
 10.0.0.1 100% |################################################################################################################| Time: 0:05:46  23.95 MB/s
2018-01-29T20:04:56 - margaritashotgun.memory - INFO - 10.0.0.1: capture complete: memdump.lime
2018-01-29T20:04:57 - margaritashotgun.client - INFO - 1 hosts processed. completed: 1 failed 0
2018-01-29T20:04:57 - margaritashotgun.client - INFO - completed_hosts: ['10.0.0.1']
2018-01-29T20:04:57 - margaritashotgun.client - INFO - failed_hosts: []

$ ls
lime-4.4.0-1049-aws.ko memdump.lime  output

$ ls output/
case123456-memory-capture.log