Memory forensic tools -volatility, foremost

Others 2019-07-10 12:32:19 views: null

Memory Forensics

1. Memory forensics tools volatility

profile value of guess dump file

root@kali:~/CTF# volatility -f mem.vmem imageinfo
Volatility Foundation Volatility Framework 2.6
INFO    : volatility.debug    : Determining profile based on KDBG search...
          Suggested Profile(s) : WinXPSP2x86, WinXPSP3x86 (Instantiated with WinXPSP2x86)
                     AS Layer1 : IA32PagedMemoryPae (Kernel AS)
                     AS Layer2 : FileAddressSpace (/root/CTF/mem.vmem)
                      PAE type : PAE
                           DTB : 0xb18000L
                          KDBG : 0x80546ae0L
          Number of Processors : 1
     Image Type (Service Pack) : 3
                KPCR for CPU 0 : 0xffdff000L
             KUSER_SHARED_DATA : 0xffdf0000L
           Image date and time : 2016-05-03 04:41:19 UTC+0000
     Image local date and time : 2016-05-03 12:41:19 +0800
root@kali:~/CTF#

See, profile may be WinXPSP2x86

Direct access to volshell

shell command:

dt ( "critical kernel data structures Name" ")

Such as: dt("_PEB")

root@kali:~/CTF# volatility -f mem.vmem --profile=WinXPSP2x86 volshell
Volatility Foundation Volatility Framework 2.6
Current context: System @ 0x821b9830, pid=4, ppid=0 DTB=0xb18000
Welcome to volshell! Current memory image is:
file:///root/CTF/mem.vmem
To get help, type 'hh()'
>>> dt("_PEB")
 '_PEB' (528 bytes)
0x0   : InheritedAddressSpace          ['unsigned char']
0x1   : ReadImageFileExecOptions       ['unsigned char']
0x2   : BeingDebugged                  ['unsigned char']
0x3   : SpareBool                      ['unsigned char']
0x4   : Mutant                         ['pointer', ['void']]
0x8   : ImageBaseAddress               ['pointer', ['void']]
0xc   : Ldr                            ['pointer', ['_PEB_LDR_DATA']]
0x10  : ProcessParameters              ['pointer', ['_RTL_USER_PROCESS_PARAMETERS']]
0x14  : SubSystemData                  ['pointer', ['void']]
0x18  : ProcessHeap                    ['pointer', ['void']]
0x1c  : FastPebLock                    ['pointer', ['_RTL_CRITICAL_SECTION']]
0x20  : FastPebLockRoutine             ['pointer', ['void']]
0x24  : FastPebUnlockRoutine           ['pointer', ['void']]
0x28  : EnvironmentUpdateCount         ['unsigned long']
0x2c  : KernelCallbackTable            ['pointer', ['void']]
0x30  : SystemReserved                 ['array', 1, ['unsigned long']]
0x34  : AtlThunkSListPtr32             ['unsigned long']
0x38  : FreeList                       ['pointer', ['_PEB_FREE_BLOCK']]
0x3c  : TlsExpansionCounter            ['unsigned long']
0x40  : TlsBitmap                      ['pointer', ['void']]
0x44  : TlsBitmapBits                  ['array', 2, ['unsigned long']]
0x4c  : ReadOnlySharedMemoryBase       ['pointer', ['void']]
0x50  : ReadOnlySharedMemoryHeap       ['pointer', ['void']]
0x54  : ReadOnlyStaticServerData       ['pointer', ['pointer', ['void']]]
0x58  : AnsiCodePageData               ['pointer', ['void']]
0x5c  : OemCodePageData                ['pointer', ['void']]
0x60  : UnicodeCaseTableData           ['pointer', ['void']]
0x64  : NumberOfProcessors             ['unsigned long']
0x68  : NtGlobalFlag                   ['unsigned long']
0x70  : CriticalSectionTimeout         ['_LARGE_INTEGER']
0x78  : HeapSegmentReserve             ['unsigned long']
0x7c  : HeapSegmentCommit              ['unsigned long']
0x80  : HeapDeCommitTotalFreeThreshold ['unsigned long']
0x84  : HeapDeCommitFreeBlockThreshold ['unsigned long']
0x88  : NumberOfHeaps                  ['unsigned long']
0x8c  : MaximumNumberOfHeaps           ['unsigned long']
0x90  : ProcessHeaps                   ['pointer', ['array', <function <lambda> at 0x7f88d57decf8>, ['pointer', ['_HEAP']]]]
0x94  : GdiSharedHandleTable           ['pointer', ['void']]
0x98  : ProcessStarterHelper           ['pointer', ['void']]
0x9c  : GdiDCAttributeList             ['unsigned long']
0xa0  : LoaderLock                     ['pointer', ['void']]
0xa4  : OSMajorVersion                 ['unsigned long']
0xa8  : OSMinorVersion                 ['unsigned long']
0xac  : OSBuildNumber                  ['unsigned short']
0xae  : OSCSDVersion                   ['unsigned short']
0xb0  : OSPlatformId                   ['unsigned long']
0xb4  : ImageSubsystem                 ['unsigned long']
0xb8  : ImageSubsystemMajorVersion     ['unsigned long']
0xbc  : ImageSubsystemMinorVersion     ['unsigned long']
0xc0  : ImageProcessAffinityMask       ['unsigned long']
0xc4  : GdiHandleBuffer                ['array', 34, ['unsigned long']]
0x14c : PostProcessInitRoutine         ['pointer', ['void']]
0x150 : TlsExpansionBitmap             ['pointer', ['void']]
0x154 : TlsExpansionBitmapBits         ['array', 32, ['unsigned long']]
0x1d4 : SessionId                      ['unsigned long']
0x1d8 : AppCompatFlags                 ['_ULARGE_INTEGER']
0x1e0 : AppCompatFlagsUser             ['_ULARGE_INTEGER']
0x1e8 : pShimData                      ['pointer', ['void']]
0x1ec : AppCompatInfo                  ['pointer', ['void']]
0x1f0 : CSDVersion                     ['_UNICODE_STRING']
0x1f8 : ActivationContextData          ['pointer', ['void']]
0x1fc : ProcessAssemblyStorageMap      ['pointer', ['void']]
0x200 : SystemDefaultActivationContextData ['pointer', ['void']]
0x204 : SystemAssemblyStorageMap       ['pointer', ['void']]
0x208 : MinimumStackCommit             ['unsigned long']
>>>

View process:

root@kali:~/CTF# 
root@kali:~/CTF# volatility -f mem.vmem --profile=WinXPSP2x86 pslist
Volatility Foundation Volatility Framework 2.6
Offset(V)  Name                    PID   PPID   Thds     Hnds   Sess  Wow64 Start                          Exit                          
---------- -------------------- ------ ------ ------ -------- ------ ------ ------------------------------ ------------------------------
0x821b9830 System                    4      0     62      253 ------      0                                                              
0x81fb9210 smss.exe                552      4      3       19 ------      0 2016-05-03 04:32:10 UTC+0000                                 
0x81c14da0 csrss.exe               616    552     10      328      0      0 2016-05-03 04:32:12 UTC+0000                                 
0x81f81880 winlogon.exe            640    552     18      449      0      0 2016-05-03 04:32:12 UTC+0000                                 
0x8208fda0 services.exe            684    640     16      260      0      0 2016-05-03 04:32:12 UTC+0000                                 
0x81c32b10 lsass.exe               696    640     18      333      0      0 2016-05-03 04:32:12 UTC+0000                                 
0x820a19a0 vmacthlp.exe            852    684      1       25      0      0 2016-05-03 04:32:13 UTC+0000                                 
0x81c30458 svchost.exe             864    684     18      201      0      0 2016-05-03 04:32:13 UTC+0000                                 
0x81c67020 svchost.exe             948    684     11      238      0      0 2016-05-03 04:32:13 UTC+0000                                 
0x81ce7da0 svchost.exe            1040    684     55     1103      0      0 2016-05-03 04:32:13 UTC+0000                                 
0x81c25020 svchost.exe            1096    684      4       66      0      0 2016-05-03 04:32:13 UTC+0000                                 
0x82002b28 svchost.exe            1256    684     13      194      0      0 2016-05-03 04:32:14 UTC+0000                                 
0x81f6c988 explorer.exe           1464   1448     12      329      0      0 2016-05-03 04:32:14 UTC+0000                                 
0x82085550 spoolsv.exe            1576    684     13      140      0      0 2016-05-03 04:32:14 UTC+0000                                 
0x81f64560 vmtoolsd.exe           1712   1464      5      145      0      0 2016-05-03 04:32:15 UTC+0000                                 
0x820a3528 ctfmon.exe             1736   1464      1       78      0      0 2016-05-03 04:32:15 UTC+0000                                 
0x81f7d3c0 vmtoolsd.exe           2020    684      7      273      0      0 2016-05-03 04:32:23 UTC+0000                                 
0x8207db28 TPAutoConnSvc.e         512    684      5       99      0      0 2016-05-03 04:32:25 UTC+0000                                 
0x81c26da0 alg.exe                1212    684      6      105      0      0 2016-05-03 04:32:26 UTC+0000                                 
0x81f715c0 wscntfy.exe            1392   1040      1       39      0      0 2016-05-03 04:32:26 UTC+0000                                 
0x81e1f520 TPAutoConnect.e        1972    512      1       72      0      0 2016-05-03 04:32:26 UTC+0000                                 
0x81f9d3e8 TrueCrypt.exe          2012   1464      2      139      0      0 2016-05-03 04:33:36 UTC+0000                                 
root@kali:~/CTF#

View the registry in memory cache

root@kali:~/CTF# volatility -f mem.vmem --profile=WinXPSP2x86 hivelist
Volatility Foundation Volatility Framework 2.6
Virtual    Physical   Name
---------- ---------- ----
0xe1e9f9d8 0x0bf169d8 \Device\HarddiskVolume1\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
0xe1cee5d0 0x0be075d0 \Device\HarddiskVolume1\Documents and Settings\Administrator\NTUSER.DAT
0xe1b99b60 0x0ae0ab60 \Device\HarddiskVolume1\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
0xe1b95008 0x0adc6008 \Device\HarddiskVolume1\Documents and Settings\LocalService\NTUSER.DAT
0xe1a7c2a8 0x0a76b2a8 \Device\HarddiskVolume1\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
0xe1a72b60 0x0a6e1b60 \Device\HarddiskVolume1\Documents and Settings\NetworkService\NTUSER.DAT
0xe146c398 0x084a3398 \Device\HarddiskVolume1\WINDOWS\system32\config\software
0xe1699758 0x08246758 \Device\HarddiskVolume1\WINDOWS\system32\config\default
0xe166faa8 0x05e7eaa8 \Device\HarddiskVolume1\WINDOWS\system32\config\SECURITY
0xe16aab60 0x082a6b60 \Device\HarddiskVolume1\WINDOWS\system32\config\SAM
0xe12e9008 0x02d7f008 [no name]
0xe1035b60 0x02b08b60 \Device\HarddiskVolume1\WINDOWS\system32\config\system
0xe102e008 0x02b02008 [no name]
root@kali:~/CTF#

hivedump print out the data in the registry:

root@kali:~/CTF# volatility -f mem.vmem --profile=WinXPSP2x86 hivedump -o 0xe16aab60
Volatility Foundation Volatility Framework 2.6
Last Written         Key
2016-05-03 03:41:48 UTC+0000 \SAM
2016-05-03 03:41:48 UTC+0000 \SAM\SAM
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains
2016-05-03 03:51:02 UTC+0000 \SAM\SAM\Domains\Account
2016-05-03 03:50:51 UTC+0000 \SAM\SAM\Domains\Account\Aliases
2016-05-03 03:51:02 UTC+0000 \SAM\SAM\Domains\Account\Aliases\000003E9
2016-05-03 03:51:02 UTC+0000 \SAM\SAM\Domains\Account\Aliases\Members
2016-05-03 03:51:02 UTC+0000 \SAM\SAM\Domains\Account\Aliases\Members\S-1-5-21-1844237615-1677128483-1801674531
2016-05-03 03:51:02 UTC+0000 \SAM\SAM\Domains\Account\Aliases\Members\S-1-5-21-1844237615-1677128483-1801674531\000003EA
2016-05-03 03:50:51 UTC+0000 \SAM\SAM\Domains\Account\Aliases\Names
2016-05-03 03:50:51 UTC+0000 \SAM\SAM\Domains\Account\Aliases\Names\HelpServicesGroup
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Account\Groups
2016-05-03 03:51:02 UTC+0000 \SAM\SAM\Domains\Account\Groups\00000201
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Account\Groups\Names
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Account\Groups\Names\None
2016-05-03 03:51:02 UTC+0000 \SAM\SAM\Domains\Account\Users
2016-05-03 04:32:14 UTC+0000 \SAM\SAM\Domains\Account\Users\000001F4
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Account\Users\000001F5
2016-05-03 03:50:15 UTC+0000 \SAM\SAM\Domains\Account\Users\000003E8
2016-05-03 03:51:02 UTC+0000 \SAM\SAM\Domains\Account\Users\000003EA
2016-05-03 03:51:02 UTC+0000 \SAM\SAM\Domains\Account\Users\Names
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Account\Users\Names\Administrator
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Account\Users\Names\Guest
2016-05-03 03:50:15 UTC+0000 \SAM\SAM\Domains\Account\Users\Names\HelpAssistant
2016-05-03 03:51:02 UTC+0000 \SAM\SAM\Domains\Account\Users\Names\SUPPORT_388945a0
2016-05-03 03:42:51 UTC+0000 \SAM\SAM\Domains\Builtin
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\00000220
2016-05-03 03:42:51 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\00000221
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\00000222
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\00000223
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\00000227
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\00000228
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\0000022B
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\0000022C
2016-05-03 03:42:51 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Members
2016-05-03 03:42:51 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Members\S-1-5
2016-05-03 03:42:51 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Members\S-1-5\00000004
2016-05-03 03:42:51 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Members\S-1-5\0000000B
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Members\S-1-5-21-1844237615-1677128483-1801674531
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Members\S-1-5-21-1844237615-1677128483-1801674531\000001F4
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Members\S-1-5-21-1844237615-1677128483-1801674531\000001F5
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Names
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Names\Administrators
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Names\Backup Operators
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Names\Guests
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Names\Network Configuration Operators
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Names\Power Users
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Names\Remote Desktop Users
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Names\Replicator
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Names\Users
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Groups
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Groups\Names
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Users
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Users\Names
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\RXACT
root@kali:~/CTF#

Users get SAM table

root@kali:~/CTF# volatility -f mem.vmem --profile=WinXPSP2x86 printkey -K "SAM\Domains\Account\Users\Names"
Volatility Foundation Volatility Framework 2.6
Legend: (S) = Stable   (V) = Volatile

----------------------------
Registry: \Device\HarddiskVolume1\WINDOWS\system32\config\SAM
Key name: Names (S)
Last updated: 2016-05-03 03:51:02 UTC+0000

Subkeys:
  (S) Administrator
  (S) Guest
  (S) HelpAssistant
  (S) SUPPORT_388945a0

Values:
REG_NONE                      : (S) 

root@kali:~/CTF#

Gets the last login account system

volatility -f mem.vmem –profile=WinXPSP2x86 printkey -K "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"

Extract the program was being run out of memory recorded in which to run how many times, the last time running information

root@kali:~/CTF# volatility -f mem.vmem --profile=WinXPSP2x86 userassist
Volatility Foundation Volatility Framework 2.6
----------------------------
Registry: \Device\HarddiskVolume1\Documents and Settings\Administrator\NTUSER.DAT 
Path: Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count
Last updated: 2016-05-03 04:31:34 UTC+0000

Subkeys:

Values:

REG_BINARY    UEME_CTLSESSION : Raw Data:
0x00000000  9c 27 8d 0e 01 00 00 00                           .'......

REG_BINARY    UEME_CTLCUACount:ctor : 
ID:             1
Count:          2
Last updated:   1970-01-01 00:00:00 UTC+0000
Raw Data:
0x00000000  01 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00   ................

REG_BINARY    UEME_UITOOLBAR  : 
ID:             1
Count:          5
Last updated:   2016-05-03 04:31:34 UTC+0000
Raw Data:
0x00000000  01 00 00 00 0a 00 00 00 50 d4 8a ac f4 a4 d1 01   ........P.......

REG_BINARY    UEME_UITOOLBAR:0x4,7031 : 
ID:             1
Count:          3
Last updated:   2016-05-03 04:30:11 UTC+0000
Raw Data:
0x00000000  01 00 00 00 08 00 00 00 30 de 54 7b f4 a4 d1 01   ........0.T{....

REG_BINARY    UEME_UITOOLBAR:0x1,120 : 
ID:             1
Count:          2
Last updated:   2016-05-03 04:31:34 UTC+0000
Raw Data:
0x00000000  01 00 00 00 07 00 00 00 50 d4 8a ac f4 a4 d1 01   ........P.......
----------------------------
Registry: \Device\HarddiskVolume1\Documents and Settings\Administrator\NTUSER.DAT 
Path: Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count
Last updated: 2016-05-03 04:33:36 UTC+0000

Subkeys:

Values:

REG_BINARY    UEME_CTLSESSION : Raw Data:
0x00000000  7b 27 8d 0e 01 00 00 00                           {'......

REG_BINARY    UEME_RUNPIDL:%csidl2%\Windows Media Player.lnk : 
ID:             1
Count:          14
Last updated:   2016-05-03 03:52:39 UTC+0000
Raw Data:
0x00000000  01 00 00 00 13 00 00 00 f0 b1 09 3d ef a4 d1 01   ...........=....

REG_BINARY    UEME_RUNPIDL:%csidl2%\Windows Messenger.lnk : 
ID:             1
Count:          13
Last updated:   2016-05-03 03:52:39 UTC+0000
Raw Data:
0x00000000  01 00 00 00 12 00 00 00 f0 b1 09 3d ef a4 d1 01   ...........=....

REG_BINARY    U               : 
ID:             1
Count:          12
Last updated:   2016-05-03 03:52:39 UTC+0000
Raw Data:
0x00000000  01 00 00 00 11 00 00 00 f0 b1 09 3d ef a4 d1 01   ...........=....

REG_BINARY    U               : 
ID:             1
Count:          11
Last updated:   2016-05-03 03:52:39 UTC+0000
Raw Data:
0x00000000  01 00 00 00 10 00 00 00 f0 b1 09 3d ef a4 d1 01   ...........=....

REG_BINARY    UEME_CTLCUACount:ctor : 
ID:             1
Count:          2
Last updated:   1970-01-01 00:00:00 UTC+0000
Raw Data:
0x00000000  01 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00   ................

REG_BINARY    UEME_RUNCPL     : 
ID:             1
Count:          1
Last updated:   2016-05-03 04:09:17 UTC+0000
Raw Data:
0x00000000  01 00 00 00 06 00 00 00 f0 cc 99 8f f1 a4 d1 01   ................

REG_BINARY    UEME_RUNCPL:desk.cpl : 
ID:             1
Count:          1
Last updated:   2016-05-03 04:09:17 UTC+0000
Raw Data:
0x00000000  01 00 00 00 06 00 00 00 f0 cc 99 8f f1 a4 d1 01   ................

REG_BINARY    UEME_UISCUT     : 
ID:             1
Count:          8
Last updated:   2016-05-03 04:33:35 UTC+0000
Raw Data:
0x00000000  01 00 00 00 0d 00 00 00 20 a5 ec f4 f4 a4 d1 01   ................

REG_BINARY    UEME_RUNPATH    : 
ID:             1
Count:          13
Last updated:   2016-05-03 04:33:36 UTC+0000
Raw Data:
0x00000000  01 00 00 00 12 00 00 00 70 53 2f f5 f4 a4 d1 01   ........pS/.....

REG_BINARY    U               : 
ID:             1
Count:          1
Last updated:   2016-05-03 04:21:44 UTC+0000
Raw Data:
0x00000000  01 00 00 00 06 00 00 00 c0 18 b5 4c f3 a4 d1 01   ...........L....

REG_BINARY    UEME_RUNPATH:TrueCrypt.lnk : 
ID:             1
Count:          3
Last updated:   2016-05-03 04:33:35 UTC+0000
Raw Data:
0x00000000  01 00 00 00 08 00 00 00 10 ef ee f4 f4 a4 d1 01   ................

REG_BINARY    UEME_RUNPATH:C:\Program Files\TrueCrypt\TrueCrypt.exe : 
ID:             1
Count:          3
Last updated:   2016-05-03 04:33:36 UTC+0000
Raw Data:
0x00000000  01 00 00 00 08 00 00 00 70 53 2f f5 f4 a4 d1 01   ........pS/.....

REG_BINARY    U               : 
ID:             1
Count:          1
Last updated:   2016-05-03 04:24:19 UTC+0000
Raw Data:
0x00000000  01 00 00 00 06 00 00 00 b0 70 51 a9 f3 a4 d1 01   .........pQ.....

REG_BINARY    UEME_RUNPATH:C:\WINDOWS\system32\NOTEPAD.EXE : 
ID:             1
Count:          5
Last updated:   2016-05-03 04:29:24 UTC+0000
Raw Data:
0x00000000  01 00 00 00 0a 00 00 00 b0 cb 4e 5f f4 a4 d1 01   ..........N_....
root@kali:~/CTF#

To a process data in memory to save up to dmp format

root@kali:~/CTF# mkdir ctfmon
root@kali:~/CTF# volatility -f mem.vmem --profile=WinXPSP2x86 memdump -p 1736 -D ctfmon/
Volatility Foundation Volatility Framework 2.6
************************************************************************
Writing ctfmon.exe [  1736] to 1736.dmp
root@kali:~/CTF# ls
ctfmon  mem.vmem  suspicion
root@kali:~/CTF# cd ctfmon/
root@kali:~/CTF/ctfmon# ls
1736.dmp
root@kali:~/CTF/ctfmon#

May be used subsequent analysis hex editor, string or strings analyzed for the extraction.

cmd command to extract held in memory usage.

root@kali:~/CTF# volatility -f mem.vmem --profile=WinXPSP2x86 cmdscan
Volatility Foundation Volatility Framework 2.6
**************************************************
CommandProcess: csrss.exe Pid: 616
CommandHistory: 0x55cc00 Application: TPAutoConnect.exe Flags: Allocated
CommandCount: 0 LastAdded: -1 LastDisplayed: -1
FirstCommand: 0 CommandCountMax: 50
ProcessHandle: 0x628
Cmd #19 @ 0xe300f7: ?????????????????????????????????????????????????????????????? 
????'+7;GKW|??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
root@kali:~/CTF#

Check the network connection time

root@kali:~/CTF# volatility -f mem.vmem --profile=WinXPSP2x86 netscan
Volatility Foundation Volatility Framework 2.6
ERROR   : volatility.debug    : This command does not support the profile WinXPSP2x86
root@kali:~/CTF#

With usage IE browser

volatility -f mem.vmem --profile=WinXPSP2x86 iehistory

Acquisition system password memory

Acquisition system password memory, we can use hashdump to extract it out.

ubuntu@DESKTOP-RO316QM:/mnt/d$ volatility -f easy_dump.img --profile=Win7SP1x64 hashdump
Volatility Foundation Volatility Framework 2.6
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
n3k0:1000:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
ubuntu@DESKTOP-RO316QM:/mnt/d$

or:

volatility -f mem.vmem –profile=WinXPSP2x86 hashdump -y （注册表 system 的 virtual 地址 ）-s （SAM 的 virtual 地址）

root@kali:~/CTF# volatility -f mem.vmem --profile=WinXPSP2x86 hivelist
Volatility Foundation Volatility Framework 2.6
Virtual    Physical   Name
---------- ---------- ----
0xe1e9f9d8 0x0bf169d8 \Device\HarddiskVolume1\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
0xe1cee5d0 0x0be075d0 \Device\HarddiskVolume1\Documents and Settings\Administrator\NTUSER.DAT
0xe1b99b60 0x0ae0ab60 \Device\HarddiskVolume1\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
0xe1b95008 0x0adc6008 \Device\HarddiskVolume1\Documents and Settings\LocalService\NTUSER.DAT
0xe1a7c2a8 0x0a76b2a8 \Device\HarddiskVolume1\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
0xe1a72b60 0x0a6e1b60 \Device\HarddiskVolume1\Documents and Settings\NetworkService\NTUSER.DAT
0xe146c398 0x084a3398 \Device\HarddiskVolume1\WINDOWS\system32\config\software
0xe1699758 0x08246758 \Device\HarddiskVolume1\WINDOWS\system32\config\default
0xe166faa8 0x05e7eaa8 \Device\HarddiskVolume1\WINDOWS\system32\config\SECURITY
0xe16aab60 0x082a6b60 \Device\HarddiskVolume1\WINDOWS\system32\config\SAM
0xe12e9008 0x02d7f008 [no name]
0xe1035b60 0x02b08b60 \Device\HarddiskVolume1\WINDOWS\system32\config\system
0xe102e008 0x02b02008 [no name]
root@kali:~/CTF# 
root@kali:~/CTF# volatility -f mem.vmem --profile=WinXPSP2x86 hashdump -y 0xe1035b60 -s 0xe16aab60
Volatility Foundation Volatility Framework 2.6

timeliner

Extracted information will maximize memory, then you can use this plugin timeliner. It will come to collect system information from multiple locations Events

volatility -f mem.vmem –profile=WinXPSP2x86 timeliner

Find the file in the mirror

ubuntu@DESKTOP-RO316QM:/mnt/d$ volatility -f easy_dump.img --profile=Win7SP1x64 filescan | grep  -E 'jpg|png|jpeg|bmp|gif'
Volatility Foundation Volatility Framework 2.6
0x000000002408c460     32      0 RW---- \Device\HarddiskVolume1\phos.jpg
ubuntu@DESKTOP-RO316QM:/mnt/d$

Linux command

You can view the routing table by linux_route_cache case parameters
using the View command linux_lsof 1517 and 27157 documents related to the process
using linux_netstat View Web Links situation.
For more information check process using linux_psaux
use linux_proc_maps parameters, you can view the details of the process including shared libraries, such as the start and end position information
using linux_find_file to view the location of suspicious files

Processes
linux_pslist
linux_psaux
linux_pstree
linux_pslist_cache
linux_pidhashtable
linux_psxview
linux_lsof
Process Memory
linux_memmap
linux_proc_maps
linux_dump_map
linux_bash
Kernel Memory and Objects
linux_lsmod
linux_moddump
linux_tmpfs
Rootkit Detection
linux_check_afinfo
linux_check_tty
linux_keyboard_notifier
linux_check_creds
linux_check_fop
linux_check_idt
linux_check_syscall
linux_check_modules
linux_check_creds
Networking
linux_arp
linux_ifconfig
linux_route_cache
linux_netstat
linux_pkt_queues
linux_sk_buff_cache
System Information
linux_cpuinfo
linux_dmesg
linux_iomem
linux_slabinfo
linux_mount
linux_mount_cache
linux_dentry_cache
linux_find_file
linux_vma_cache
Miscellaneous
linux_volshell
linux_yarascan

2. foremost

Foremost is based on the beginning of the file format, file marks the end of the internal data structures and file recovery program.

foremost command parameters English Chinese Description:

$ foremost [-v|-V|-h|-T|-Q|-q|-a|-w-d] [-t ] [-s ] [-k ]
[-b ] [-c ] [-O

] [-i <file]

-V - Displays copyright information and exit
-t -. The specified file type (-t jpeg, pdf ...)
-d - Open an indirect block detection (for UNIX File System)
-i - specify the input file (default is standard input)
-a - write all the file header, error detection (corrupted file) does not perform
-w - audit file is written to disk, do not write any detected files
-o - set the output directory (default output)
- c - set the configuration file (the default is foremost.conf)
-q - enable fast mode search is performed in 512-byte boundary..
-Q -. enable quiet mode disables the output messages.
-v -. verbose mode to record all the messages on the screen .

foremost scanning accidentally deleted files

If you accidentally deleted a png file, foremost -t png -i /dev/sda1

Restore a memory dump file

First extract the data corresponding with the volatility process pid, andforemost 2616.dump

3. binwalk

Recursive extraction binwalk -Me firmware.bin
automation (automatic) extractionbinwalk -e firmware.bin

https://www.freebuf.com/column/152545.html

https://www.freebuf.com/articles/system/26763.html

https://www.freebuf.com/articles/rookie/145262.html

https://bbs.ichunqiu.com/thread-46827-1-1.html

Guess you like

Origin www.cnblogs.com/0x4D75/p/11161822.html
Recommended
Ranking
#2019110700005
What materials and procedures are required for patent transfer
What is the blockchain Ethereum triplet state root transaction root receipt root
Front-end study notes 04 --- About the insertion of html pictures and videos
Documents required for the filing of WeChat Mini Programs in special industries, the filing process of WeChat Mini Programs in special industries, how to file WeChat Mini Programs in special industries
2017 Qingdao-site tournament I The Squared Mosquito Coil
[BZOJ3165][HEOI2013]Segment (line segment tree without marking)
Kettle series: KettleEasyExpand, an open source Kettle universal plugin by Ma Jinju
The latest tutorial on making framework for iOS
DAX Section 6: Statistical Functions
Daily
More
2024-05-14(9)
2024-05-13(8)
2024-05-12(28)
2024-05-11(32)
2024-05-10(34)
2024-05-09(32)
2024-05-08(18)
2024-05-07(34)
2024-05-06(6)
2024-05-05(0)

Code World

© 2018 codetd.com