Demo files from BlackHat Asia 2024 Arsenal

[nightlark]

These are files that were used for the BlackHat Asia 2024 Arsenal demo presentation. Linked at the bottom are the Surfactant config JSON file used, and the output SBOMs (CyTRICS JSON format) with and without the fuzzyhashes plugin installed. The bash script given was used to run through a consistent, repeatable set of steps for the demo to avoid having awkward pauses or typos from manually typing in the commands.

#!/bin/bash

################
# Setup Demo Env
################
# copy baseline demo folder and cd into it
# this folder should contain two files:
#  - Helics-3.5.2-Linux-x86_64.tar.gz
#  - config.json
cp -r Demo-Files-Backup demo-working-dir
pushd demo-working-dir

# wipe screen for clean start
clear

#######################
# Installing Surfactant
#######################
# Create venv
echo -n "> "
read -p "python3 -m venv demo-venv"
python3 -m venv demo-venv

# Activate venv
echo -n "> "
read -p "source demo-venv/bin/activate"
source demo-venv/bin/activate

# Install Surfactant
echo -n "(demo-venv) > "
read -p "pip install surfactant"
pip install surfactant

echo ""
read -p "Alternative: pip install git+https://github.com/LLNL/Surfactant"

# Demo running help command
echo -n "(demo-venv) > "
read -p "surfactant --help"
surfactant --help
echo ""

# Demo running help generate command
echo -n "(demo-venv) > "
read -p "surfactant generate --help"
surfactant generate --help
echo ""

# Demo listing output formats
echo -n "(demo-venv) > "
read -p "surfactant generate --list-output-formats"
surfactant generate --list-output-formats
echo ""

# Acquire sample
echo -n "(demo-venv) > curl -O https://github.com/GMLC-TDC/HELICS/releases/download/v3.5.2/Helics-3.5.2-Linux-x86_64.tar.gz"
read # Don't actually do this.. just use our already copied version...

# Unpack the sample
echo -n "(demo-venv) > "
read -p "tar xvf Helics-3.5.2-Linux-x86_64.tar.gz"
tar xvf Helics-3.5.2-Linux-x86_64.tar.gz
read -p "(demo-venv) > "

# Run Surfactant generate on it using a config file
echo -n "(demo-venv) > "
read -p "surfactant generate config.json output_sbom.json"
surfactant generate config.json output_sbom.json
read -p "(demo-venv) > "

# Install a plugin...
echo -n "(demo-venv) > "
#read -p "pip install git+https://github.com/theStache/Surfactant.git@cvebin2vex-plugin#subdirectory=plugins/cvebin2vex"
#pip install git+https://github.com/theStache/Surfactant.git@cvebin2vex-plugin#subdirectory=plugins/cvebin2vex
read -p "pip install git+https://github.com/LLNL/Surfactant#subdirectory=plugins/fuzzyhashes"
pip install git+https://github.com/LLNL/Surfactant#subdirectory=plugins/fuzzyhashes

# Re-run Surfactant generate
echo -n "(demo-venv) > "
read -p "surfactant generate config.json output_sbom.json"
surfactant generate config.json output_sbom.json
read -p "(demo-venv) > "

###############
# Demo Clean-up
###############
popd
rm -rf demo-working-dir

config.json
output_sbom.json
output_sbom_fuzzyhashes.json

[nightlark]

Note: For BlackHat USA 2024 Arsenal, add a javascript library and possibly Docker image for grype to run on as part of the demo... if grype doesn't take too long to run live.

[nightlark]

Terminal settings for recording:
Presentation.terminal.zip