# Scenario

## Dokumentasi Simulasi Forensik OS - Simplified

### 1. SETUP ENVIRONMENT

* \[ x ] **Screenshot**: `wsl --list` showing Kali & Ubuntu
* \[ x ] **Screenshot**: SSH service running di Ubuntu (`systemctl status ssh`)
* \[ x ] **Screenshot**: Network IP kedua WSL (`ip addr`)
* \[ x ] **Penjelasan**: WSL networking dan SSH setup

### 2. BACKDOOR DEPLOYMENT

* \[ x ] **Screenshot**: File monitor script (`file_monitor.sh`)
* \[ x ] **Screenshot**: Script running in background (`ps aux | grep monitor`)
* \[ x ] **Screenshot**: Log directory created (`ls -la /tmp/.logs/`)
* \[ ] **Penjelasan**: Teknik monitoring filesystem events secara stealth

### 3. VICTIM ACTIVITIES

* \[ ] **Screenshot**: ZIP creation dengan password (`zip -P "password" file.zip`)
* \[ ] **Screenshot**: Environment variable dengan password (`echo $ARCHIVE_PASSWORD`)
* \[ ] **Screenshot**: Bash history showing sensitive commands
* \[ ] **Penjelasan**: Password leakage melalui environment variables

### 4. LOG CAPTURE & ANALYSIS

* \[ ] **Screenshot**: Real-time log file (`tail -f /tmp/.system_activity.log`)
* \[ ] **Screenshot**: Base64 decoded log entries
* \[ ] **Screenshot**: Password extraction dari logs
* \[ ] **Penjelasan**: Log analysis untuk credential harvesting

### 5. ATTACK EXECUTION

* \[ ] **Screenshot**: SSH connection dari Kali ke Ubuntu
* \[ ] **Screenshot**: Remote log access (`cat /tmp/.system_activity.log`)
* \[ ] **Screenshot**: Password testing (`unzip -t secret.zip`)
* \[ ] **Penjelasan**: Remote access dan credential validation

### 6. ZIP COMPROMISE

* \[ ] **Screenshot**: Successful ZIP extraction dengan stolen password
* \[ ] **Screenshot**: Sensitive file contents revealed
* \[ ] **Penjelasan**: Impact dari credential theft

### 7. FORENSIC EVIDENCE

* \[ ] **Screenshot**: Timeline reconstruction dari logs
* \[ ] **Screenshot**: Attack chain visualization
* \[ ] **Screenshot**: Security gaps identified
* \[ ] **Penjelasan**: Forensic analysis methodology dan findings

**Total: \~20 screenshots + 7 technical explanations**

### KEY FOCUS AREAS:

1. **Password Leakage** - Environment variables & bash history
2. **Log Monitoring** - Stealth file system monitoring
3. **Remote Access** - SSH exploitation
4. **Credential Harvesting** - Extract passwords dari logs
5. **Impact Demonstration** - Sensitive data access

## Dokumentasi

Dokumentasi simulasi dan explanationnya akan gw masukin di sini

{% content-ref url="simulasi-sisop" %}
[simulasi-sisop](https://zencipher.gitbook.io/home/blogs/final-research-operating-system/simulasi-sisop)
{% endcontent-ref %}

{% content-ref url="os-forensic-explanation" %}
[os-forensic-explanation](https://zencipher.gitbook.io/home/blogs/final-research-operating-system/os-forensic-explanation)
{% endcontent-ref %}

<table data-view="cards"><thead><tr><th></th></tr></thead><tbody><tr><td></td></tr></tbody></table>
