经验首页 前端设计 程序设计 Java相关 移动开发 数据库/运维 软件/图像 大数据/云计算 其他经验
当前位置：技术经验 » 其他 » 网络安全 » 查看文章
内存取证工具-volatility、foremost
来源：cnblogs　　作者：0x4D75　　时间：2019/7/10 11:31:25　　对本文有异议

内存取证

1. 内存取证工具volatility

猜测dump文件的profile值

  1. root@kali:~/CTF# volatility -f mem.vmem imageinfo
  2. Volatility Foundation Volatility Framework 2.6
  3. INFO    : volatility.debug    : Determining profile based on KDBG search...
  4.           Suggested Profile(s) : WinXPSP2x86, WinXPSP3x86 (Instantiated with WinXPSP2x86)
  5.                      AS Layer1 : IA32PagedMemoryPae (Kernel AS)
  6.                      AS Layer2 : FileAddressSpace (/root/CTF/mem.vmem)
  7.                       PAE type : PAE
  8.                            DTB : 0xb18000L
  9.                           KDBG : 0x80546ae0L
  10.           Number of Processors : 1
  11.      Image Type (Service Pack) : 3
  12.                 KPCR for CPU 0 : 0xffdff000L
  13.              KUSER_SHARED_DATA : 0xffdf0000L
  14.            Image date and time : 2016-05-03 04:41:19 UTC+0000
  15.      Image local date and time : 2016-05-03 12:41:19 +0800
  16. root@kali:~/CTF#

看到，profile可能是WinXPSP2x86

直接获取volshell

shell的命令：

dt("内核关键数据结构名称"")

如: dt("_PEB")

  1. root@kali:~/CTF# volatility -f mem.vmem --profile=WinXPSP2x86 volshell
  2. Volatility Foundation Volatility Framework 2.6
  3. Current context: System @ 0x821b9830, pid=4, ppid=0 DTB=0xb18000
  4. Welcome to volshell! Current memory image is:
  5. file:///root/CTF/mem.vmem
  6. To get help, type 'hh()'
  7. >>> dt("_PEB")
  8.  '_PEB' (528 bytes)
  9. 0x0   : InheritedAddressSpace          ['unsigned char']
  10. 0x1   : ReadImageFileExecOptions       ['unsigned char']
  11. 0x2   : BeingDebugged                  ['unsigned char']
  12. 0x3   : SpareBool                      ['unsigned char']
  13. 0x4   : Mutant                         ['pointer', ['void']]
  14. 0x8   : ImageBaseAddress               ['pointer', ['void']]
  15. 0xc   : Ldr                            ['pointer', ['_PEB_LDR_DATA']]
  16. 0x10  : ProcessParameters              ['pointer', ['_RTL_USER_PROCESS_PARAMETERS']]
  17. 0x14  : SubSystemData                  ['pointer', ['void']]
  18. 0x18  : ProcessHeap                    ['pointer', ['void']]
  19. 0x1c  : FastPebLock                    ['pointer', ['_RTL_CRITICAL_SECTION']]
  20. 0x20  : FastPebLockRoutine             ['pointer', ['void']]
  21. 0x24  : FastPebUnlockRoutine           ['pointer', ['void']]
  22. 0x28  : EnvironmentUpdateCount         ['unsigned long']
  23. 0x2c  : KernelCallbackTable            ['pointer', ['void']]
  24. 0x30  : SystemReserved                 ['array', 1, ['unsigned long']]
  25. 0x34  : AtlThunkSListPtr32             ['unsigned long']
  26. 0x38  : FreeList                       ['pointer', ['_PEB_FREE_BLOCK']]
  27. 0x3c  : TlsExpansionCounter            ['unsigned long']
  28. 0x40  : TlsBitmap                      ['pointer', ['void']]
  29. 0x44  : TlsBitmapBits                  ['array', 2, ['unsigned long']]
  30. 0x4c  : ReadOnlySharedMemoryBase       ['pointer', ['void']]
  31. 0x50  : ReadOnlySharedMemoryHeap       ['pointer', ['void']]
  32. 0x54  : ReadOnlyStaticServerData       ['pointer', ['pointer', ['void']]]
  33. 0x58  : AnsiCodePageData               ['pointer', ['void']]
  34. 0x5c  : OemCodePageData                ['pointer', ['void']]
  35. 0x60  : UnicodeCaseTableData           ['pointer', ['void']]
  36. 0x64  : NumberOfProcessors             ['unsigned long']
  37. 0x68  : NtGlobalFlag                   ['unsigned long']
  38. 0x70  : CriticalSectionTimeout         ['_LARGE_INTEGER']
  39. 0x78  : HeapSegmentReserve             ['unsigned long']
  40. 0x7c  : HeapSegmentCommit              ['unsigned long']
  41. 0x80  : HeapDeCommitTotalFreeThreshold ['unsigned long']
  42. 0x84  : HeapDeCommitFreeBlockThreshold ['unsigned long']
  43. 0x88  : NumberOfHeaps                  ['unsigned long']
  44. 0x8c  : MaximumNumberOfHeaps           ['unsigned long']
  45. 0x90  : ProcessHeaps                   ['pointer', ['array', <function <lambda> at 0x7f88d57decf8>, ['pointer', ['_HEAP']]]]
  46. 0x94  : GdiSharedHandleTable           ['pointer', ['void']]
  47. 0x98  : ProcessStarterHelper           ['pointer', ['void']]
  48. 0x9c  : GdiDCAttributeList             ['unsigned long']
  49. 0xa0  : LoaderLock                     ['pointer', ['void']]
  50. 0xa4  : OSMajorVersion                 ['unsigned long']
  51. 0xa8  : OSMinorVersion                 ['unsigned long']
  52. 0xac  : OSBuildNumber                  ['unsigned short']
  53. 0xae  : OSCSDVersion                   ['unsigned short']
  54. 0xb0  : OSPlatformId                   ['unsigned long']
  55. 0xb4  : ImageSubsystem                 ['unsigned long']
  56. 0xb8  : ImageSubsystemMajorVersion     ['unsigned long']
  57. 0xbc  : ImageSubsystemMinorVersion     ['unsigned long']
  58. 0xc0  : ImageProcessAffinityMask       ['unsigned long']
  59. 0xc4  : GdiHandleBuffer                ['array', 34, ['unsigned long']]
  60. 0x14c : PostProcessInitRoutine         ['pointer', ['void']]
  61. 0x150 : TlsExpansionBitmap             ['pointer', ['void']]
  62. 0x154 : TlsExpansionBitmapBits         ['array', 32, ['unsigned long']]
  63. 0x1d4 : SessionId                      ['unsigned long']
  64. 0x1d8 : AppCompatFlags                 ['_ULARGE_INTEGER']
  65. 0x1e0 : AppCompatFlagsUser             ['_ULARGE_INTEGER']
  66. 0x1e8 : pShimData                      ['pointer', ['void']]
  67. 0x1ec : AppCompatInfo                  ['pointer', ['void']]
  68. 0x1f0 : CSDVersion                     ['_UNICODE_STRING']
  69. 0x1f8 : ActivationContextData          ['pointer', ['void']]
  70. 0x1fc : ProcessAssemblyStorageMap      ['pointer', ['void']]
  71. 0x200 : SystemDefaultActivationContextData ['pointer', ['void']]
  72. 0x204 : SystemAssemblyStorageMap       ['pointer', ['void']]
  73. 0x208 : MinimumStackCommit             ['unsigned long']
  74. >>>

查看进程：

  1. root@kali:~/CTF# 
  2. root@kali:~/CTF# volatility -f mem.vmem --profile=WinXPSP2x86 pslist
  3. Volatility Foundation Volatility Framework 2.6
  4. Offset(V)  Name                    PID   PPID   Thds     Hnds   Sess  Wow64 Start                          Exit                          
  5. ---------- -------------------- ------ ------ ------ -------- ------ ------ ------------------------------ ------------------------------
  6. 0x821b9830 System                    4      0     62      253 ------      0                                                              
  7. 0x81fb9210 smss.exe                552      4      3       19 ------      0 2016-05-03 04:32:10 UTC+0000                                 
  8. 0x81c14da0 csrss.exe               616    552     10      328      0      0 2016-05-03 04:32:12 UTC+0000                                 
  9. 0x81f81880 winlogon.exe            640    552     18      449      0      0 2016-05-03 04:32:12 UTC+0000                                 
  10. 0x8208fda0 services.exe            684    640     16      260      0      0 2016-05-03 04:32:12 UTC+0000                                 
  11. 0x81c32b10 lsass.exe               696    640     18      333      0      0 2016-05-03 04:32:12 UTC+0000                                 
  12. 0x820a19a0 vmacthlp.exe            852    684      1       25      0      0 2016-05-03 04:32:13 UTC+0000                                 
  13. 0x81c30458 svchost.exe             864    684     18      201      0      0 2016-05-03 04:32:13 UTC+0000                                 
  14. 0x81c67020 svchost.exe             948    684     11      238      0      0 2016-05-03 04:32:13 UTC+0000                                 
  15. 0x81ce7da0 svchost.exe            1040    684     55     1103      0      0 2016-05-03 04:32:13 UTC+0000                                 
  16. 0x81c25020 svchost.exe            1096    684      4       66      0      0 2016-05-03 04:32:13 UTC+0000                                 
  17. 0x82002b28 svchost.exe            1256    684     13      194      0      0 2016-05-03 04:32:14 UTC+0000                                 
  18. 0x81f6c988 explorer.exe           1464   1448     12      329      0      0 2016-05-03 04:32:14 UTC+0000                                 
  19. 0x82085550 spoolsv.exe            1576    684     13      140      0      0 2016-05-03 04:32:14 UTC+0000                                 
  20. 0x81f64560 vmtoolsd.exe           1712   1464      5      145      0      0 2016-05-03 04:32:15 UTC+0000                                 
  21. 0x820a3528 ctfmon.exe             1736   1464      1       78      0      0 2016-05-03 04:32:15 UTC+0000                                 
  22. 0x81f7d3c0 vmtoolsd.exe           2020    684      7      273      0      0 2016-05-03 04:32:23 UTC+0000                                 
  23. 0x8207db28 TPAutoConnSvc.e         512    684      5       99      0      0 2016-05-03 04:32:25 UTC+0000                                 
  24. 0x81c26da0 alg.exe                1212    684      6      105      0      0 2016-05-03 04:32:26 UTC+0000                                 
  25. 0x81f715c0 wscntfy.exe            1392   1040      1       39      0      0 2016-05-03 04:32:26 UTC+0000                                 
  26. 0x81e1f520 TPAutoConnect.e        1972    512      1       72      0      0 2016-05-03 04:32:26 UTC+0000                                 
  27. 0x81f9d3e8 TrueCrypt.exe          2012   1464      2      139      0      0 2016-05-03 04:33:36 UTC+0000                                 
  28. root@kali:~/CTF#

查看缓存在内存的注册表

  1. root@kali:~/CTF# volatility -f mem.vmem --profile=WinXPSP2x86 hivelist
  2. Volatility Foundation Volatility Framework 2.6
  3. Virtual    Physical   Name
  4. ---------- ---------- ----
  5. 0xe1e9f9d8 0x0bf169d8 \Device\HarddiskVolume1\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
  6. 0xe1cee5d0 0x0be075d0 \Device\HarddiskVolume1\Documents and Settings\Administrator\NTUSER.DAT
  7. 0xe1b99b60 0x0ae0ab60 \Device\HarddiskVolume1\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
  8. 0xe1b95008 0x0adc6008 \Device\HarddiskVolume1\Documents and Settings\LocalService\NTUSER.DAT
  9. 0xe1a7c2a8 0x0a76b2a8 \Device\HarddiskVolume1\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
  10. 0xe1a72b60 0x0a6e1b60 \Device\HarddiskVolume1\Documents and Settings\NetworkService\NTUSER.DAT
  11. 0xe146c398 0x084a3398 \Device\HarddiskVolume1\WINDOWS\system32\config\software
  12. 0xe1699758 0x08246758 \Device\HarddiskVolume1\WINDOWS\system32\config\default
  13. 0xe166faa8 0x05e7eaa8 \Device\HarddiskVolume1\WINDOWS\system32\config\SECURITY
  14. 0xe16aab60 0x082a6b60 \Device\HarddiskVolume1\WINDOWS\system32\config\SAM
  15. 0xe12e9008 0x02d7f008 [no name]
  16. 0xe1035b60 0x02b08b60 \Device\HarddiskVolume1\WINDOWS\system32\config\system
  17. 0xe102e008 0x02b02008 [no name]
  18. root@kali:~/CTF#

hivedump 打印出注册表中的数据 ：

  1. root@kali:~/CTF# volatility -f mem.vmem --profile=WinXPSP2x86 hivedump -o 0xe16aab60
  2. Volatility Foundation Volatility Framework 2.6
  3. Last Written         Key
  4. 2016-05-03 03:41:48 UTC+0000 \SAM
  5. 2016-05-03 03:41:48 UTC+0000 \SAM\SAM
  6. 2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains
  7. 2016-05-03 03:51:02 UTC+0000 \SAM\SAM\Domains\Account
  8. 2016-05-03 03:50:51 UTC+0000 \SAM\SAM\Domains\Account\Aliases
  9. 2016-05-03 03:51:02 UTC+0000 \SAM\SAM\Domains\Account\Aliases\000003E9
  10. 2016-05-03 03:51:02 UTC+0000 \SAM\SAM\Domains\Account\Aliases\Members
  11. 2016-05-03 03:51:02 UTC+0000 \SAM\SAM\Domains\Account\Aliases\Members\S-1-5-21-1844237615-1677128483-1801674531
  12. 2016-05-03 03:51:02 UTC+0000 \SAM\SAM\Domains\Account\Aliases\Members\S-1-5-21-1844237615-1677128483-1801674531\000003EA
  13. 2016-05-03 03:50:51 UTC+0000 \SAM\SAM\Domains\Account\Aliases\Names
  14. 2016-05-03 03:50:51 UTC+0000 \SAM\SAM\Domains\Account\Aliases\Names\HelpServicesGroup
  15. 2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Account\Groups
  16. 2016-05-03 03:51:02 UTC+0000 \SAM\SAM\Domains\Account\Groups\00000201
  17. 2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Account\Groups\Names
  18. 2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Account\Groups\Names\None
  19. 2016-05-03 03:51:02 UTC+0000 \SAM\SAM\Domains\Account\Users
  20. 2016-05-03 04:32:14 UTC+0000 \SAM\SAM\Domains\Account\Users\000001F4
  21. 2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Account\Users\000001F5
  22. 2016-05-03 03:50:15 UTC+0000 \SAM\SAM\Domains\Account\Users\000003E8
  23. 2016-05-03 03:51:02 UTC+0000 \SAM\SAM\Domains\Account\Users\000003EA
  24. 2016-05-03 03:51:02 UTC+0000 \SAM\SAM\Domains\Account\Users\Names
  25. 2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Account\Users\Names\Administrator
  26. 2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Account\Users\Names\Guest
  27. 2016-05-03 03:50:15 UTC+0000 \SAM\SAM\Domains\Account\Users\Names\HelpAssistant
  28. 2016-05-03 03:51:02 UTC+0000 \SAM\SAM\Domains\Account\Users\Names\SUPPORT_388945a0
  29. 2016-05-03 03:42:51 UTC+0000 \SAM\SAM\Domains\Builtin
  30. 2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases
  31. 2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\00000220
  32. 2016-05-03 03:42:51 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\00000221
  33. 2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\00000222
  34. 2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\00000223
  35. 2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\00000227
  36. 2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\00000228
  37. 2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\0000022B
  38. 2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\0000022C
  39. 2016-05-03 03:42:51 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Members
  40. 2016-05-03 03:42:51 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Members\S-1-5
  41. 2016-05-03 03:42:51 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Members\S-1-5\00000004
  42. 2016-05-03 03:42:51 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Members\S-1-5\0000000B
  43. 2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Members\S-1-5-21-1844237615-1677128483-1801674531
  44. 2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Members\S-1-5-21-1844237615-1677128483-1801674531\000001F4
  45. 2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Members\S-1-5-21-1844237615-1677128483-1801674531\000001F5
  46. 2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Names
  47. 2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Names\Administrators
  48. 2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Names\Backup Operators
  49. 2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Names\Guests
  50. 2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Names\Network Configuration Operators
  51. 2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Names\Power Users
  52. 2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Names\Remote Desktop Users
  53. 2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Names\Replicator
  54. 2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Names\Users
  55. 2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Groups
  56. 2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Groups\Names
  57. 2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Users
  58. 2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Users\Names
  59. 2016-05-03 03:41:48 UTC+0000 \SAM\SAM\RXACT
  60. root@kali:~/CTF#

获取SAM表中的用户

  1. root@kali:~/CTF# volatility -f mem.vmem --profile=WinXPSP2x86 printkey -K "SAM\Domains\Account\Users\Names"
  2. Volatility Foundation Volatility Framework 2.6
  3. Legend: (S) = Stable   (V) = Volatile
  5. ----------------------------
  6. Registry: \Device\HarddiskVolume1\WINDOWS\system32\config\SAM
  7. Key name: Names (S)
  8. Last updated: 2016-05-03 03:51:02 UTC+0000
  10. Subkeys:
  11.   (S) Administrator
  12.   (S) Guest
  13.   (S) HelpAssistant
  14.   (S) SUPPORT_388945a0
  16. Values:
  17. REG_NONE                      : (S) 
  19. root@kali:~/CTF#

获取最后登录系统的账户

  1. volatility -f mem.vmem –profile=WinXPSP2x86 printkey -K "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"

提取出内存中记录的 当时正在运行的程序有哪些，运行过多少次，最后一次运行的时间等信息

  1. root@kali:~/CTF# volatility -f mem.vmem --profile=WinXPSP2x86 userassist
  2. Volatility Foundation Volatility Framework 2.6
  3. ----------------------------
  4. Registry: \Device\HarddiskVolume1\Documents and Settings\Administrator\NTUSER.DAT 
  5. Path: Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count
  6. Last updated: 2016-05-03 04:31:34 UTC+0000
  8. Subkeys:
  10. Values:
  12. REG_BINARY    UEME_CTLSESSION : Raw Data:
  13. 0x00000000  9c 27 8d 0e 01 00 00 00                           .'......
  15. REG_BINARY    UEME_CTLCUACount:ctor : 
  16. ID:             1
  17. Count:          2
  18. Last updated:   1970-01-01 00:00:00 UTC+0000
  19. Raw Data:
  20. 0x00000000  01 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00   ................
  22. REG_BINARY    UEME_UITOOLBAR  : 
  23. ID:             1
  24. Count:          5
  25. Last updated:   2016-05-03 04:31:34 UTC+0000
  26. Raw Data:
  27. 0x00000000  01 00 00 00 0a 00 00 00 50 d4 8a ac f4 a4 d1 01   ........P.......
  29. REG_BINARY    UEME_UITOOLBAR:0x4,7031 : 
  30. ID:             1
  31. Count:          3
  32. Last updated:   2016-05-03 04:30:11 UTC+0000
  33. Raw Data:
  34. 0x00000000  01 00 00 00 08 00 00 00 30 de 54 7b f4 a4 d1 01   ........0.T{....
  36. REG_BINARY    UEME_UITOOLBAR:0x1,120 : 
  37. ID:             1
  38. Count:          2
  39. Last updated:   2016-05-03 04:31:34 UTC+0000
  40. Raw Data:
  41. 0x00000000  01 00 00 00 07 00 00 00 50 d4 8a ac f4 a4 d1 01   ........P.......
  42. ----------------------------
  43. Registry: \Device\HarddiskVolume1\Documents and Settings\Administrator\NTUSER.DAT 
  44. Path: Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count
  45. Last updated: 2016-05-03 04:33:36 UTC+0000
  47. Subkeys:
  49. Values:
  51. REG_BINARY    UEME_CTLSESSION : Raw Data:
  52. 0x00000000  7b 27 8d 0e 01 00 00 00                           {'......
  54. REG_BINARY    UEME_RUNPIDL:%csidl2%\Windows Media Player.lnk : 
  55. ID:             1
  56. Count:          14
  57. Last updated:   2016-05-03 03:52:39 UTC+0000
  58. Raw Data:
  59. 0x00000000  01 00 00 00 13 00 00 00 f0 b1 09 3d ef a4 d1 01   ...........=....
  61. REG_BINARY    UEME_RUNPIDL:%csidl2%\Windows Messenger.lnk : 
  62. ID:             1
  63. Count:          13
  64. Last updated:   2016-05-03 03:52:39 UTC+0000
  65. Raw Data:
  66. 0x00000000  01 00 00 00 12 00 00 00 f0 b1 09 3d ef a4 d1 01   ...........=....
  68. REG_BINARY    U               : 
  69. ID:             1
  70. Count:          12
  71. Last updated:   2016-05-03 03:52:39 UTC+0000
  72. Raw Data:
  73. 0x00000000  01 00 00 00 11 00 00 00 f0 b1 09 3d ef a4 d1 01   ...........=....
  75. REG_BINARY    U               : 
  76. ID:             1
  77. Count:          11
  78. Last updated:   2016-05-03 03:52:39 UTC+0000
  79. Raw Data:
  80. 0x00000000  01 00 00 00 10 00 00 00 f0 b1 09 3d ef a4 d1 01   ...........=....
  82. REG_BINARY    UEME_CTLCUACount:ctor : 
  83. ID:             1
  84. Count:          2
  85. Last updated:   1970-01-01 00:00:00 UTC+0000
  86. Raw Data:
  87. 0x00000000  01 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00   ................
  89. REG_BINARY    UEME_RUNCPL     : 
  90. ID:             1
  91. Count:          1
  92. Last updated:   2016-05-03 04:09:17 UTC+0000
  93. Raw Data:
  94. 0x00000000  01 00 00 00 06 00 00 00 f0 cc 99 8f f1 a4 d1 01   ................
  96. REG_BINARY    UEME_RUNCPL:desk.cpl : 
  97. ID:             1
  98. Count:          1
  99. Last updated:   2016-05-03 04:09:17 UTC+0000
  100. Raw Data:
  101. 0x00000000  01 00 00 00 06 00 00 00 f0 cc 99 8f f1 a4 d1 01   ................
  103. REG_BINARY    UEME_UISCUT     : 
  104. ID:             1
  105. Count:          8
  106. Last updated:   2016-05-03 04:33:35 UTC+0000
  107. Raw Data:
  108. 0x00000000  01 00 00 00 0d 00 00 00 20 a5 ec f4 f4 a4 d1 01   ................
  110. REG_BINARY    UEME_RUNPATH    : 
  111. ID:             1
  112. Count:          13
  113. Last updated:   2016-05-03 04:33:36 UTC+0000
  114. Raw Data:
  115. 0x00000000  01 00 00 00 12 00 00 00 70 53 2f f5 f4 a4 d1 01   ........pS/.....
  117. REG_BINARY    U               : 
  118. ID:             1
  119. Count:          1
  120. Last updated:   2016-05-03 04:21:44 UTC+0000
  121. Raw Data:
  122. 0x00000000  01 00 00 00 06 00 00 00 c0 18 b5 4c f3 a4 d1 01   ...........L....
  124. REG_BINARY    UEME_RUNPATH:TrueCrypt.lnk : 
  125. ID:             1
  126. Count:          3
  127. Last updated:   2016-05-03 04:33:35 UTC+0000
  128. Raw Data:
  129. 0x00000000  01 00 00 00 08 00 00 00 10 ef ee f4 f4 a4 d1 01   ................
  131. REG_BINARY    UEME_RUNPATH:C:\Program Files\TrueCrypt\TrueCrypt.exe : 
  132. ID:             1
  133. Count:          3
  134. Last updated:   2016-05-03 04:33:36 UTC+0000
  135. Raw Data:
  136. 0x00000000  01 00 00 00 08 00 00 00 70 53 2f f5 f4 a4 d1 01   ........pS/.....
  138. REG_BINARY    U               : 
  139. ID:             1
  140. Count:          1
  141. Last updated:   2016-05-03 04:24:19 UTC+0000
  142. Raw Data:
  143. 0x00000000  01 00 00 00 06 00 00 00 b0 70 51 a9 f3 a4 d1 01   .........pQ.....
  145. REG_BINARY    UEME_RUNPATH:C:\WINDOWS\system32\NOTEPAD.EXE : 
  146. ID:             1
  147. Count:          5
  148. Last updated:   2016-05-03 04:29:24 UTC+0000
  149. Raw Data:
  150. 0x00000000  01 00 00 00 0a 00 00 00 b0 cb 4e 5f f4 a4 d1 01   ..........N_....
  151. root@kali:~/CTF#

将内存中的某个进程数据以 dmp 的格式保存出来

  1. root@kali:~/CTF# mkdir ctfmon
  2. root@kali:~/CTF# volatility -f mem.vmem --profile=WinXPSP2x86 memdump -p 1736 -D ctfmon/
  3. Volatility Foundation Volatility Framework 2.6
  4. ************************************************************************
  5. Writing ctfmon.exe [  1736] to 1736.dmp
  6. root@kali:~/CTF# ls
  7. ctfmon  mem.vmem  suspicion
  8. root@kali:~/CTF# cd ctfmon/
  9. root@kali:~/CTF/ctfmon# ls
  10. 1736.dmp
  11. root@kali:~/CTF/ctfmon#

后续可以使用16进制编辑器分析，或使用strings提取其中的字符串分析。

提取内存中保留的 cmd 命令使用情况 。

  1. root@kali:~/CTF# volatility -f mem.vmem --profile=WinXPSP2x86 cmdscan
  2. Volatility Foundation Volatility Framework 2.6
  3. **************************************************
  4. CommandProcess: csrss.exe Pid: 616
  5. CommandHistory: 0x55cc00 Application: TPAutoConnect.exe Flags: Allocated
  6. CommandCount: 0 LastAdded: -1 LastDisplayed: -1
  7. FirstCommand: 0 CommandCountMax: 50
  8. ProcessHandle: 0x628
  9. Cmd #19 @ 0xe300f7: ?????????????????????????????????????????????????????????????? 
  10. ????'+7;GKW|??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
  11. root@kali:~/CTF#

查看当时网络连接情况

  1. root@kali:~/CTF# volatility -f mem.vmem --profile=WinXPSP2x86 netscan
  2. Volatility Foundation Volatility Framework 2.6
  3. ERROR   : volatility.debug    : This command does not support the profile WinXPSP2x86
  4. root@kali:~/CTF#

获取 IE 浏览器的使用情况

  1. volatility -f mem.vmem --profile=WinXPSP2x86 iehistory

获取内存中的系统密码

获取内存中的系统密码，我们可以使用 hashdump 将它提取出来 。

  1. ubuntu@DESKTOP-RO316QM:/mnt/d$ volatility -f easy_dump.img --profile=Win7SP1x64 hashdump
  2. Volatility Foundation Volatility Framework 2.6
  3. Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
  4. Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
  5. n3k0:1000:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
  6. ubuntu@DESKTOP-RO316QM:/mnt/d$

或者：

  1. volatility -f mem.vmem –profile=WinXPSP2x86 hashdump -y （注册表 system 的 virtual 地址 ）-s （SAM 的 virtual 地址）
  3. root@kali:~/CTF# volatility -f mem.vmem --profile=WinXPSP2x86 hivelist
  4. Volatility Foundation Volatility Framework 2.6
  5. Virtual    Physical   Name
  6. ---------- ---------- ----
  7. 0xe1e9f9d8 0x0bf169d8 \Device\HarddiskVolume1\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
  8. 0xe1cee5d0 0x0be075d0 \Device\HarddiskVolume1\Documents and Settings\Administrator\NTUSER.DAT
  9. 0xe1b99b60 0x0ae0ab60 \Device\HarddiskVolume1\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
  10. 0xe1b95008 0x0adc6008 \Device\HarddiskVolume1\Documents and Settings\LocalService\NTUSER.DAT
  11. 0xe1a7c2a8 0x0a76b2a8 \Device\HarddiskVolume1\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
  12. 0xe1a72b60 0x0a6e1b60 \Device\HarddiskVolume1\Documents and Settings\NetworkService\NTUSER.DAT
  13. 0xe146c398 0x084a3398 \Device\HarddiskVolume1\WINDOWS\system32\config\software
  14. 0xe1699758 0x08246758 \Device\HarddiskVolume1\WINDOWS\system32\config\default
  15. 0xe166faa8 0x05e7eaa8 \Device\HarddiskVolume1\WINDOWS\system32\config\SECURITY
  16. 0xe16aab60 0x082a6b60 \Device\HarddiskVolume1\WINDOWS\system32\config\SAM
  17. 0xe12e9008 0x02d7f008 [no name]
  18. 0xe1035b60 0x02b08b60 \Device\HarddiskVolume1\WINDOWS\system32\config\system
  19. 0xe102e008 0x02b02008 [no name]
  20. root@kali:~/CTF# 
  21. root@kali:~/CTF# volatility -f mem.vmem --profile=WinXPSP2x86 hashdump -y 0xe1035b60 -s 0xe16aab60
  22. Volatility Foundation Volatility Framework 2.6

timeliner

最大程度上将内存中的信息提取出来，那么你可以使用 timeliner 这个插件。它会从多个位置来收集系统的活动信息

volatility -f mem.vmem –profile=WinXPSP2x86 timeliner

查找镜像中的文件

  1. ubuntu@DESKTOP-RO316QM:/mnt/d$ volatility -f easy_dump.img --profile=Win7SP1x64 filescan | grep  -E 'jpg|png|jpeg|bmp|gif'
  2. Volatility Foundation Volatility Framework 2.6
  3. 0x000000002408c460     32      0 RW---- \Device\HarddiskVolume1\phos.jpg
  4. ubuntu@DESKTOP-RO316QM:/mnt/d$

Linux下命令

可以通过linux_route_cache参数查看路由表情况
使用linux_lsof命令查看1517和27157进程相关的文件
使用linux_netstat查看网络链接情况。
使用linux_psaux检查进程详细信息
使用linux_proc_maps参数，可以查看进程细节包括共享库、开始和结束的位置等信息
使用linux_find_file查看可疑文件的位置

  1. Processes
  2. linux_pslist
  3. linux_psaux
  4. linux_pstree
  5. linux_pslist_cache
  6. linux_pidhashtable
  7. linux_psxview
  8. linux_lsof
  9. Process Memory
  10. linux_memmap
  11. linux_proc_maps
  12. linux_dump_map
  13. linux_bash
  14. Kernel Memory and Objects
  15. linux_lsmod
  16. linux_moddump
  17. linux_tmpfs
  18. Rootkit Detection
  19. linux_check_afinfo
  20. linux_check_tty
  21. linux_keyboard_notifier
  22. linux_check_creds
  23. linux_check_fop
  24. linux_check_idt
  25. linux_check_syscall
  26. linux_check_modules
  27. linux_check_creds
  28. Networking
  29. linux_arp
  30. linux_ifconfig
  31. linux_route_cache
  32. linux_netstat
  33. linux_pkt_queues
  34. linux_sk_buff_cache
  35. System Information
  36. linux_cpuinfo
  37. linux_dmesg
  38. linux_iomem
  39. linux_slabinfo
  40. linux_mount
  41. linux_mount_cache
  42. linux_dentry_cache
  43. linux_find_file
  44. linux_vma_cache
  45. Miscellaneous
  46. linux_volshell
  47. linux_yarascan

2. foremost

Foremost是基于文件开始格式，文件结束标志和内部数据结构进行恢复文件的程序。

foremost命令参数英文中文说明：

$ foremost [-v|-V|-h|-T|-Q|-q|-a|-w-d] [-t ] [-s ] [-k ]
[-b ] [-c ] [-o

] [-i <file]

-V - 显示版权信息并退出
-t - 指定文件类型. (-t jpeg,pdf ...)
-d -打开间接块检测 (针对UNIX文件系统)
-i - 指定输入文件 (默认为标准输入)
-a - 写入所有的文件头部, 不执行错误检测(损坏文件)
-w - 向磁盘写入审计文件，不写入任何检测到的文件
-o - 设置输出目录 (默认为为输出)
-c - 设置配置文件 (默认为 foremost.conf)
-q - 启用快速模式. 在512字节边界执行搜索.
-Q - 启用安静模式. 禁用输出消息.
-v - 详细模式. 向屏幕上记录所有消息。

foremost 扫描误删文件

如果误删一个png文件，可以 foremost -t png -i /dev/sda1

恢复内存中dump出的文件

先用volatility提取出对应pid的进程的数据，然后foremost 2616.dump

3. binwalk

递归提取 binwalk -Me firmware.bin
自动化（自动）提取 binwalk -e firmware.bin

https://www.freebuf.com/column/152545.html

https://www.freebuf.com/articles/system/26763.html

https://www.freebuf.com/articles/rookie/145262.html

https://bbs.ichunqiu.com/thread-46827-1-1.html

原文链接：http://www.cnblogs.com/0x4D75/p/11161822.html

 友情链接：直通硅谷 　点职佳 　北美留学生论坛

网络安全热门文章

  • AI: Web: 2 Vulnhub Walkthrough - APT-101
  • 各类黑客大马默认密码后门
  • 蓝凌OA前台任意文件读取漏洞利用
  • 银河麒麟SP2 auditd服务内存泄露问题
  • confluence 挖矿木马应急响应 - APT-101
  • 信息安全题目整理（1）
  • 时间同步（NTP/PTP）技术原理介绍
  • apache log4j2 漏洞复现linux【纯详版】
  • Kali proxychains
  • 使用tor实现对网络的匿名访问

    • 网络安全推荐文章

  • 异构数据源数据同步 → 从源码分析 DataX 敏感信息的加解密
  • FFmpeg开发笔记（三十八）APP如何访问SRS推流的RTMP直播地址
  • Vulnhub-ICA01
  • 劫持TLS绕过canary && 堆和栈的灵活转换
  • 第二届黄河流域网络安全技能挑战赛Web_wirteup
  • 深入理解高级加密标准（Advanced Encryption Standard）
  • 渗透测试-信息收集
  • RC4Drop加密技术：原理、实践与安全性探究
  • 知名压缩软件 xz 被植入后门，黑客究竟是如何做到的？
  • 《熬夜整理》保姆级系列教程-玩转Wireshark抓包神器教程(1)-初识Wireshark - 北京-宏哥

    • 本站QQ群：前端 618073944 | Java 606181507 | Python 626812652 | C/C++ 612253063 | 微信 634508462 | 苹果 692586424 | C#/.net 182808419 | PHP 305140648 | 运维 608723728

    W3xue 的所有内容仅供测试，对任何法律问题及风险不承担任何责任。通过使用本站内容随之而来的风险与本站无关。
    关于我们  |  意见建议  |  捐助我们  |  报错有奖  |  广告合作、友情链接（目前9元/月）请联系QQ：27243702 沸活量
    皖ICP备17017327号-2　皖公网安备34020702000426号