内存取证

1. 内存取证工具volatility

猜测dump文件的profile值

root@kali:~/CTF# volatility -f mem.vmem imageinfo

Volatility Foundation Volatility Framework 2.6

INFO    : volatility.debug    : Determining profile based on KDBG search...

          Suggested Profile(s) : WinXPSP2x86, WinXPSP3x86 (Instantiated with WinXPSP2x86)

                     AS Layer1 : IA32PagedMemoryPae (Kernel AS)

                     AS Layer2 : FileAddressSpace (/root/CTF/mem.vmem)

                      PAE type : PAE

                           DTB : 0xb18000L

                          KDBG : 0x80546ae0L

          Number of Processors : 1

     Image Type (Service Pack) : 3

                KPCR for CPU 0 : 0xffdff000L

             KUSER_SHARED_DATA : 0xffdf0000L

           Image date and time : 2016-05-03 04:41:19 UTC+0000

     Image local date and time : 2016-05-03 12:41:19 +0800

root@kali:~/CTF#

看到，profile可能是WinXPSP2x86

直接获取volshell

shell的命令：

dt("内核关键数据结构名称"")

如: dt("_PEB")

root@kali:~/CTF# volatility -f mem.vmem --profile=WinXPSP2x86 volshell

Volatility Foundation Volatility Framework 2.6

Current context: System @ 0x821b9830, pid=4, ppid=0 DTB=0xb18000

Welcome to volshell! Current memory image is:

file:///root/CTF/mem.vmem

To get help, type 'hh()'

>>> dt("_PEB")

 '_PEB' (528 bytes)

0x0   : InheritedAddressSpace          ['unsigned char']

0x1   : ReadImageFileExecOptions       ['unsigned char']

0x2   : BeingDebugged                  ['unsigned char']

0x3   : SpareBool                      ['unsigned char']

0x4   : Mutant                         ['pointer', ['void']]

0x8   : ImageBaseAddress               ['pointer', ['void']]

0xc   : Ldr                            ['pointer', ['_PEB_LDR_DATA']]

0x10  : ProcessParameters              ['pointer', ['_RTL_USER_PROCESS_PARAMETERS']]

0x14  : SubSystemData                  ['pointer', ['void']]

0x18  : ProcessHeap                    ['pointer', ['void']]

0x1c  : FastPebLock                    ['pointer', ['_RTL_CRITICAL_SECTION']]

0x20  : FastPebLockRoutine             ['pointer', ['void']]

0x24  : FastPebUnlockRoutine           ['pointer', ['void']]

0x28  : EnvironmentUpdateCount         ['unsigned long']

0x2c  : KernelCallbackTable            ['pointer', ['void']]

0x30  : SystemReserved                 ['array', 1, ['unsigned long']]

0x34  : AtlThunkSListPtr32             ['unsigned long']

0x38  : FreeList                       ['pointer', ['_PEB_FREE_BLOCK']]

0x3c  : TlsExpansionCounter            ['unsigned long']

0x40  : TlsBitmap                      ['pointer', ['void']]

0x44  : TlsBitmapBits                  ['array', 2, ['unsigned long']]

0x4c  : ReadOnlySharedMemoryBase       ['pointer', ['void']]

0x50  : ReadOnlySharedMemoryHeap       ['pointer', ['void']]

0x54  : ReadOnlyStaticServerData       ['pointer', ['pointer', ['void']]]

0x58  : AnsiCodePageData               ['pointer', ['void']]

0x5c  : OemCodePageData                ['pointer', ['void']]

0x60  : UnicodeCaseTableData           ['pointer', ['void']]

0x64  : NumberOfProcessors             ['unsigned long']

0x68  : NtGlobalFlag                   ['unsigned long']

0x70  : CriticalSectionTimeout         ['_LARGE_INTEGER']

0x78  : HeapSegmentReserve             ['unsigned long']

0x7c  : HeapSegmentCommit              ['unsigned long']

0x80  : HeapDeCommitTotalFreeThreshold ['unsigned long']

0x84  : HeapDeCommitFreeBlockThreshold ['unsigned long']

0x88  : NumberOfHeaps                  ['unsigned long']

0x8c  : MaximumNumberOfHeaps           ['unsigned long']

0x90  : ProcessHeaps                   ['pointer', ['array', <function <lambda> at 0x7f88d57decf8>, ['pointer', ['_HEAP']]]]

0x94  : GdiSharedHandleTable           ['pointer', ['void']]

0x98  : ProcessStarterHelper           ['pointer', ['void']]

0x9c  : GdiDCAttributeList             ['unsigned long']

0xa0  : LoaderLock                     ['pointer', ['void']]

0xa4  : OSMajorVersion                 ['unsigned long']

0xa8  : OSMinorVersion                 ['unsigned long']

0xac  : OSBuildNumber                  ['unsigned short']

0xae  : OSCSDVersion                   ['unsigned short']

0xb0  : OSPlatformId                   ['unsigned long']

0xb4  : ImageSubsystem                 ['unsigned long']

0xb8  : ImageSubsystemMajorVersion     ['unsigned long']

0xbc  : ImageSubsystemMinorVersion     ['unsigned long']

0xc0  : ImageProcessAffinityMask       ['unsigned long']

0xc4  : GdiHandleBuffer                ['array', 34, ['unsigned long']]

0x14c : PostProcessInitRoutine         ['pointer', ['void']]

0x150 : TlsExpansionBitmap             ['pointer', ['void']]

0x154 : TlsExpansionBitmapBits         ['array', 32, ['unsigned long']]

0x1d4 : SessionId                      ['unsigned long']

0x1d8 : AppCompatFlags                 ['_ULARGE_INTEGER']

0x1e0 : AppCompatFlagsUser             ['_ULARGE_INTEGER']

0x1e8 : pShimData                      ['pointer', ['void']]

0x1ec : AppCompatInfo                  ['pointer', ['void']]

0x1f0 : CSDVersion                     ['_UNICODE_STRING']

0x1f8 : ActivationContextData          ['pointer', ['void']]

0x1fc : ProcessAssemblyStorageMap      ['pointer', ['void']]

0x200 : SystemDefaultActivationContextData ['pointer', ['void']]

0x204 : SystemAssemblyStorageMap       ['pointer', ['void']]

0x208 : MinimumStackCommit             ['unsigned long']

>>>

查看进程：

root@kali:~/CTF#

root@kali:~/CTF# volatility -f mem.vmem --profile=WinXPSP2x86 pslist

Volatility Foundation Volatility Framework 2.6

Offset(V)  Name                    PID   PPID   Thds     Hnds   Sess  Wow64 Start                          Exit

---------- -------------------- ------ ------ ------ -------- ------ ------ ------------------------------ ------------------------------

0x821b9830 System                    4      0     62      253 ------      0

0x81fb9210 smss.exe                552      4      3       19 ------      0 2016-05-03 04:32:10 UTC+0000

0x81c14da0 csrss.exe               616    552     10      328      0      0 2016-05-03 04:32:12 UTC+0000

0x81f81880 winlogon.exe            640    552     18      449      0      0 2016-05-03 04:32:12 UTC+0000

0x8208fda0 services.exe            684    640     16      260      0      0 2016-05-03 04:32:12 UTC+0000

0x81c32b10 lsass.exe               696    640     18      333      0      0 2016-05-03 04:32:12 UTC+0000

0x820a19a0 vmacthlp.exe            852    684      1       25      0      0 2016-05-03 04:32:13 UTC+0000

0x81c30458 svchost.exe             864    684     18      201      0      0 2016-05-03 04:32:13 UTC+0000

0x81c67020 svchost.exe             948    684     11      238      0      0 2016-05-03 04:32:13 UTC+0000

0x81ce7da0 svchost.exe            1040    684     55     1103      0      0 2016-05-03 04:32:13 UTC+0000

0x81c25020 svchost.exe            1096    684      4       66      0      0 2016-05-03 04:32:13 UTC+0000

0x82002b28 svchost.exe            1256    684     13      194      0      0 2016-05-03 04:32:14 UTC+0000

0x81f6c988 explorer.exe           1464   1448     12      329      0      0 2016-05-03 04:32:14 UTC+0000

0x82085550 spoolsv.exe            1576    684     13      140      0      0 2016-05-03 04:32:14 UTC+0000

0x81f64560 vmtoolsd.exe           1712   1464      5      145      0      0 2016-05-03 04:32:15 UTC+0000

0x820a3528 ctfmon.exe             1736   1464      1       78      0      0 2016-05-03 04:32:15 UTC+0000

0x81f7d3c0 vmtoolsd.exe           2020    684      7      273      0      0 2016-05-03 04:32:23 UTC+0000

0x8207db28 TPAutoConnSvc.e         512    684      5       99      0      0 2016-05-03 04:32:25 UTC+0000

0x81c26da0 alg.exe                1212    684      6      105      0      0 2016-05-03 04:32:26 UTC+0000

0x81f715c0 wscntfy.exe            1392   1040      1       39      0      0 2016-05-03 04:32:26 UTC+0000

0x81e1f520 TPAutoConnect.e        1972    512      1       72      0      0 2016-05-03 04:32:26 UTC+0000

0x81f9d3e8 TrueCrypt.exe          2012   1464      2      139      0      0 2016-05-03 04:33:36 UTC+0000

root@kali:~/CTF#

查看缓存在内存的注册表

root@kali:~/CTF# volatility -f mem.vmem --profile=WinXPSP2x86 hivelist

Volatility Foundation Volatility Framework 2.6

Virtual    Physical   Name

---------- ---------- ----

0xe1e9f9d8 0x0bf169d8 \Device\HarddiskVolume1\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat

0xe1cee5d0 0x0be075d0 \Device\HarddiskVolume1\Documents and Settings\Administrator\NTUSER.DAT

0xe1b99b60 0x0ae0ab60 \Device\HarddiskVolume1\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat

0xe1b95008 0x0adc6008 \Device\HarddiskVolume1\Documents and Settings\LocalService\NTUSER.DAT

0xe1a7c2a8 0x0a76b2a8 \Device\HarddiskVolume1\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat

0xe1a72b60 0x0a6e1b60 \Device\HarddiskVolume1\Documents and Settings\NetworkService\NTUSER.DAT

0xe146c398 0x084a3398 \Device\HarddiskVolume1\WINDOWS\system32\config\software

0xe1699758 0x08246758 \Device\HarddiskVolume1\WINDOWS\system32\config\default

0xe166faa8 0x05e7eaa8 \Device\HarddiskVolume1\WINDOWS\system32\config\SECURITY

0xe16aab60 0x082a6b60 \Device\HarddiskVolume1\WINDOWS\system32\config\SAM

0xe12e9008 0x02d7f008 [no name]

0xe1035b60 0x02b08b60 \Device\HarddiskVolume1\WINDOWS\system32\config\system

0xe102e008 0x02b02008 [no name]

root@kali:~/CTF#

hivedump 打印出注册表中的数据：

root@kali:~/CTF# volatility -f mem.vmem --profile=WinXPSP2x86 hivedump -o 0xe16aab60

Volatility Foundation Volatility Framework 2.6

Last Written         Key

2016-05-03 03:41:48 UTC+0000 \SAM

2016-05-03 03:41:48 UTC+0000 \SAM\SAM

2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains

2016-05-03 03:51:02 UTC+0000 \SAM\SAM\Domains\Account

2016-05-03 03:50:51 UTC+0000 \SAM\SAM\Domains\Account\Aliases

2016-05-03 03:51:02 UTC+0000 \SAM\SAM\Domains\Account\Aliases\000003E9

2016-05-03 03:51:02 UTC+0000 \SAM\SAM\Domains\Account\Aliases\Members

2016-05-03 03:51:02 UTC+0000 \SAM\SAM\Domains\Account\Aliases\Members\S-1-5-21-1844237615-1677128483-1801674531

2016-05-03 03:51:02 UTC+0000 \SAM\SAM\Domains\Account\Aliases\Members\S-1-5-21-1844237615-1677128483-1801674531\000003EA

2016-05-03 03:50:51 UTC+0000 \SAM\SAM\Domains\Account\Aliases\Names

2016-05-03 03:50:51 UTC+0000 \SAM\SAM\Domains\Account\Aliases\Names\HelpServicesGroup

2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Account\Groups

2016-05-03 03:51:02 UTC+0000 \SAM\SAM\Domains\Account\Groups\00000201

2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Account\Groups\Names

2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Account\Groups\Names\None

2016-05-03 03:51:02 UTC+0000 \SAM\SAM\Domains\Account\Users

2016-05-03 04:32:14 UTC+0000 \SAM\SAM\Domains\Account\Users\000001F4

2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Account\Users\000001F5

2016-05-03 03:50:15 UTC+0000 \SAM\SAM\Domains\Account\Users\000003E8

2016-05-03 03:51:02 UTC+0000 \SAM\SAM\Domains\Account\Users\000003EA

2016-05-03 03:51:02 UTC+0000 \SAM\SAM\Domains\Account\Users\Names

2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Account\Users\Names\Administrator

2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Account\Users\Names\Guest

2016-05-03 03:50:15 UTC+0000 \SAM\SAM\Domains\Account\Users\Names\HelpAssistant

2016-05-03 03:51:02 UTC+0000 \SAM\SAM\Domains\Account\Users\Names\SUPPORT_388945a0

2016-05-03 03:42:51 UTC+0000 \SAM\SAM\Domains\Builtin

2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases

2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\00000220

2016-05-03 03:42:51 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\00000221

2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\00000222

2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\00000223

2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\00000227

2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\00000228

2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\0000022B

2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\0000022C

2016-05-03 03:42:51 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Members

2016-05-03 03:42:51 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Members\S-1-5

2016-05-03 03:42:51 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Members\S-1-5\00000004

2016-05-03 03:42:51 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Members\S-1-5\0000000B

2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Members\S-1-5-21-1844237615-1677128483-1801674531

2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Members\S-1-5-21-1844237615-1677128483-1801674531\000001F4

2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Members\S-1-5-21-1844237615-1677128483-1801674531\000001F5

2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Names

2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Names\Administrators

2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Names\Backup Operators

2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Names\Guests

2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Names\Network Configuration Operators

2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Names\Power Users

2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Names\Remote Desktop Users

2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Names\Replicator

2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Names\Users

2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Groups

2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Groups\Names

2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Users

2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Users\Names

2016-05-03 03:41:48 UTC+0000 \SAM\SAM\RXACT

root@kali:~/CTF#

获取SAM表中的用户

root@kali:~/CTF# volatility -f mem.vmem --profile=WinXPSP2x86 printkey -K "SAM\Domains\Account\Users\Names"

Volatility Foundation Volatility Framework 2.6

Legend: (S) = Stable   (V) = Volatile

----------------------------

Registry: \Device\HarddiskVolume1\WINDOWS\system32\config\SAM

Key name: Names (S)

Last updated: 2016-05-03 03:51:02 UTC+0000

Subkeys:

  (S) Administrator

  (S) Guest

  (S) HelpAssistant

  (S) SUPPORT_388945a0

Values:

REG_NONE                      : (S) 

root@kali:~/CTF#

获取最后登录系统的账户

volatility -f mem.vmem –profile=WinXPSP2x86 printkey -K "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"

提取出内存中记录的当时正在运行的程序有哪些，运行过多少次，最后一次运行的时间等信息

root@kali:~/CTF# volatility -f mem.vmem --profile=WinXPSP2x86 userassist

Volatility Foundation Volatility Framework 2.6

----------------------------

Registry: \Device\HarddiskVolume1\Documents and Settings\Administrator\NTUSER.DAT

Path: Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count

Last updated: 2016-05-03 04:31:34 UTC+0000

Subkeys:

Values:

REG_BINARY    UEME_CTLSESSION : Raw Data:

0x00000000  9c 27 8d 0e 01 00 00 00                           .'......

REG_BINARY    UEME_CTLCUACount:ctor :

ID:             1

Count:          2

Last updated:   1970-01-01 00:00:00 UTC+0000

Raw Data:

0x00000000  01 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00   ................

REG_BINARY    UEME_UITOOLBAR  :

ID:             1

Count:          5

Last updated:   2016-05-03 04:31:34 UTC+0000

Raw Data:

0x00000000  01 00 00 00 0a 00 00 00 50 d4 8a ac f4 a4 d1 01   ........P.......

REG_BINARY    UEME_UITOOLBAR:0x4,7031 :

ID:             1

Count:          3

Last updated:   2016-05-03 04:30:11 UTC+0000

Raw Data:

0x00000000  01 00 00 00 08 00 00 00 30 de 54 7b f4 a4 d1 01   ........0.T{....

REG_BINARY    UEME_UITOOLBAR:0x1,120 :

ID:             1

Count:          2

Last updated:   2016-05-03 04:31:34 UTC+0000

Raw Data:

0x00000000  01 00 00 00 07 00 00 00 50 d4 8a ac f4 a4 d1 01   ........P.......

----------------------------

Registry: \Device\HarddiskVolume1\Documents and Settings\Administrator\NTUSER.DAT

Path: Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count

Last updated: 2016-05-03 04:33:36 UTC+0000

Subkeys:

Values:

REG_BINARY    UEME_CTLSESSION : Raw Data:

0x00000000  7b 27 8d 0e 01 00 00 00                           {'......

REG_BINARY    UEME_RUNPIDL:%csidl2%\Windows Media Player.lnk :

ID:             1

Count:          14

Last updated:   2016-05-03 03:52:39 UTC+0000

Raw Data:

0x00000000  01 00 00 00 13 00 00 00 f0 b1 09 3d ef a4 d1 01   ...........=....

REG_BINARY    UEME_RUNPIDL:%csidl2%\Windows Messenger.lnk :

ID:             1

Count:          13

Last updated:   2016-05-03 03:52:39 UTC+0000

Raw Data:

0x00000000  01 00 00 00 12 00 00 00 f0 b1 09 3d ef a4 d1 01   ...........=....

REG_BINARY    U               :

ID:             1

Count:          12

Last updated:   2016-05-03 03:52:39 UTC+0000

Raw Data:

0x00000000  01 00 00 00 11 00 00 00 f0 b1 09 3d ef a4 d1 01   ...........=....

REG_BINARY    U               :

ID:             1

Count:          11

Last updated:   2016-05-03 03:52:39 UTC+0000

Raw Data:

0x00000000  01 00 00 00 10 00 00 00 f0 b1 09 3d ef a4 d1 01   ...........=....

REG_BINARY    UEME_CTLCUACount:ctor :

ID:             1

Count:          2

Last updated:   1970-01-01 00:00:00 UTC+0000

Raw Data:

0x00000000  01 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00   ................

REG_BINARY    UEME_RUNCPL     :

ID:             1

Count:          1

Last updated:   2016-05-03 04:09:17 UTC+0000

Raw Data:

0x00000000  01 00 00 00 06 00 00 00 f0 cc 99 8f f1 a4 d1 01   ................

REG_BINARY    UEME_RUNCPL:desk.cpl :

ID:             1

Count:          1

Last updated:   2016-05-03 04:09:17 UTC+0000

Raw Data:

0x00000000  01 00 00 00 06 00 00 00 f0 cc 99 8f f1 a4 d1 01   ................

REG_BINARY    UEME_UISCUT     :

ID:             1

Count:          8

Last updated:   2016-05-03 04:33:35 UTC+0000

Raw Data:

0x00000000  01 00 00 00 0d 00 00 00 20 a5 ec f4 f4 a4 d1 01   ................

REG_BINARY    UEME_RUNPATH    :

ID:             1

Count:          13

Last updated:   2016-05-03 04:33:36 UTC+0000

Raw Data:

0x00000000  01 00 00 00 12 00 00 00 70 53 2f f5 f4 a4 d1 01   ........pS/.....

REG_BINARY    U               :

ID:             1

Count:          1

Last updated:   2016-05-03 04:21:44 UTC+0000

Raw Data:

0x00000000  01 00 00 00 06 00 00 00 c0 18 b5 4c f3 a4 d1 01   ...........L....

REG_BINARY    UEME_RUNPATH:TrueCrypt.lnk :

ID:             1

Count:          3

Last updated:   2016-05-03 04:33:35 UTC+0000

Raw Data:

0x00000000  01 00 00 00 08 00 00 00 10 ef ee f4 f4 a4 d1 01   ................

REG_BINARY    UEME_RUNPATH:C:\Program Files\TrueCrypt\TrueCrypt.exe :

ID:             1

Count:          3

Last updated:   2016-05-03 04:33:36 UTC+0000

Raw Data:

0x00000000  01 00 00 00 08 00 00 00 70 53 2f f5 f4 a4 d1 01   ........pS/.....

REG_BINARY    U               :

ID:             1

Count:          1

Last updated:   2016-05-03 04:24:19 UTC+0000

Raw Data:

0x00000000  01 00 00 00 06 00 00 00 b0 70 51 a9 f3 a4 d1 01   .........pQ.....

REG_BINARY    UEME_RUNPATH:C:\WINDOWS\system32\NOTEPAD.EXE :

ID:             1

Count:          5

Last updated:   2016-05-03 04:29:24 UTC+0000

Raw Data:

0x00000000  01 00 00 00 0a 00 00 00 b0 cb 4e 5f f4 a4 d1 01   ..........N_....

root@kali:~/CTF#

将内存中的某个进程数据以 dmp 的格式保存出来

root@kali:~/CTF# mkdir ctfmon

root@kali:~/CTF# volatility -f mem.vmem --profile=WinXPSP2x86 memdump -p 1736 -D ctfmon/

Volatility Foundation Volatility Framework 2.6

************************************************************************

Writing ctfmon.exe [  1736] to 1736.dmp

root@kali:~/CTF# ls

ctfmon  mem.vmem  suspicion

root@kali:~/CTF# cd ctfmon/

root@kali:~/CTF/ctfmon# ls

1736.dmp

root@kali:~/CTF/ctfmon#

后续可以使用16进制编辑器分析，或使用strings提取其中的字符串分析。

提取内存中保留的 cmd 命令使用情况。

root@kali:~/CTF# volatility -f mem.vmem --profile=WinXPSP2x86 cmdscan

Volatility Foundation Volatility Framework 2.6

**************************************************

CommandProcess: csrss.exe Pid: 616

CommandHistory: 0x55cc00 Application: TPAutoConnect.exe Flags: Allocated

CommandCount: 0 LastAdded: -1 LastDisplayed: -1

FirstCommand: 0 CommandCountMax: 50

ProcessHandle: 0x628

Cmd #19 @ 0xe300f7: ??????????????????????????????????????????????????????????????

????'+7;GKW|??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

root@kali:~/CTF#

查看当时网络连接情况

root@kali:~/CTF# volatility -f mem.vmem --profile=WinXPSP2x86 netscan

Volatility Foundation Volatility Framework 2.6

ERROR   : volatility.debug    : This command does not support the profile WinXPSP2x86

root@kali:~/CTF#

获取 IE 浏览器的使用情况

volatility -f mem.vmem --profile=WinXPSP2x86 iehistory

获取内存中的系统密码

获取内存中的系统密码，我们可以使用 hashdump 将它提取出来。

ubuntu@DESKTOP-RO316QM:/mnt/d$ volatility -f easy_dump.img --profile=Win7SP1x64 hashdump

Volatility Foundation Volatility Framework 2.6

Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::

Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::

n3k0:1000:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::

ubuntu@DESKTOP-RO316QM:/mnt/d$

或者：

volatility -f mem.vmem –profile=WinXPSP2x86 hashdump -y （注册表 system 的 virtual 地址 ）-s （SAM 的 virtual 地址）

root@kali:~/CTF# volatility -f mem.vmem --profile=WinXPSP2x86 hivelist

Volatility Foundation Volatility Framework 2.6

Virtual    Physical   Name

---------- ---------- ----

0xe1e9f9d8 0x0bf169d8 \Device\HarddiskVolume1\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat

0xe1cee5d0 0x0be075d0 \Device\HarddiskVolume1\Documents and Settings\Administrator\NTUSER.DAT

0xe1b99b60 0x0ae0ab60 \Device\HarddiskVolume1\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat

0xe1b95008 0x0adc6008 \Device\HarddiskVolume1\Documents and Settings\LocalService\NTUSER.DAT

0xe1a7c2a8 0x0a76b2a8 \Device\HarddiskVolume1\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat

0xe1a72b60 0x0a6e1b60 \Device\HarddiskVolume1\Documents and Settings\NetworkService\NTUSER.DAT

0xe146c398 0x084a3398 \Device\HarddiskVolume1\WINDOWS\system32\config\software

0xe1699758 0x08246758 \Device\HarddiskVolume1\WINDOWS\system32\config\default

0xe166faa8 0x05e7eaa8 \Device\HarddiskVolume1\WINDOWS\system32\config\SECURITY

0xe16aab60 0x082a6b60 \Device\HarddiskVolume1\WINDOWS\system32\config\SAM

0xe12e9008 0x02d7f008 [no name]

0xe1035b60 0x02b08b60 \Device\HarddiskVolume1\WINDOWS\system32\config\system

0xe102e008 0x02b02008 [no name]

root@kali:~/CTF#

root@kali:~/CTF# volatility -f mem.vmem --profile=WinXPSP2x86 hashdump -y 0xe1035b60 -s 0xe16aab60

Volatility Foundation Volatility Framework 2.6

timeliner

最大程度上将内存中的信息提取出来，那么你可以使用 timeliner 这个插件。它会从多个位置来收集系统的活动信息

volatility -f mem.vmem –profile=WinXPSP2x86 timeliner

查找镜像中的文件

ubuntu@DESKTOP-RO316QM:/mnt/d$ volatility -f easy_dump.img --profile=Win7SP1x64 filescan | grep  -E 'jpg|png|jpeg|bmp|gif'

Volatility Foundation Volatility Framework 2.6

0x000000002408c460     32      0 RW---- \Device\HarddiskVolume1\phos.jpg

ubuntu@DESKTOP-RO316QM:/mnt/d$

Linux下命令

可以通过linux_route_cache参数查看路由表情况

使用linux_lsof命令查看1517和27157进程相关的文件

使用linux_netstat查看网络链接情况。

使用linux_psaux检查进程详细信息

使用linux_proc_maps参数，可以查看进程细节包括共享库、开始和结束的位置等信息

使用linux_find_file查看可疑文件的位置

Processes

linux_pslist

linux_psaux

linux_pstree

linux_pslist_cache

linux_pidhashtable

linux_psxview

linux_lsof

Process Memory

linux_memmap

linux_proc_maps

linux_dump_map

linux_bash

Kernel Memory and Objects

linux_lsmod

linux_moddump

linux_tmpfs

Rootkit Detection

linux_check_afinfo

linux_check_tty

linux_keyboard_notifier

linux_check_creds

linux_check_fop

linux_check_idt

linux_check_syscall

linux_check_modules

linux_check_creds

Networking

linux_arp

linux_ifconfig

linux_route_cache

linux_netstat

linux_pkt_queues

linux_sk_buff_cache

System Information

linux_cpuinfo

linux_dmesg

linux_iomem

linux_slabinfo

linux_mount

linux_mount_cache

linux_dentry_cache

linux_find_file

linux_vma_cache

Miscellaneous

linux_volshell

linux_yarascan

2. foremost

Foremost是基于文件开始格式，文件结束标志和内部数据结构进行恢复文件的程序。

foremost命令参数英文中文说明：

$ foremost [-v|-V|-h|-T|-Q|-q|-a|-w-d] [-t ] [-s ] [-k ]

[-b ] [-c ] [-o ] [-i <file]

-V - 显示版权信息并退出

-t - 指定文件类型. (-t jpeg,pdf ...)

-d -打开间接块检测 (针对UNIX文件系统)

-i - 指定输入文件 (默认为标准输入)

-a - 写入所有的文件头部, 不执行错误检测(损坏文件)

-w - 向磁盘写入审计文件，不写入任何检测到的文件

-o - 设置输出目录 (默认为为输出)

-c - 设置配置文件 (默认为 foremost.conf)

-q - 启用快速模式. 在512字节边界执行搜索.

-Q - 启用安静模式. 禁用输出消息.

-v - 详细模式. 向屏幕上记录所有消息。

foremost 扫描误删文件

如果误删一个png文件，可以 foremost -t png -i /dev/sda1

恢复内存中dump出的文件

先用volatility提取出对应pid的进程的数据，然后foremost 2616.dump

3. binwalk

递归提取 binwalk -Me firmware.bin

自动化（自动）提取 binwalk -e firmware.bin

https://www.freebuf.com/column/152545.html

https://www.freebuf.com/articles/system/26763.html

https://www.freebuf.com/articles/rookie/145262.html

https://bbs.ichunqiu.com/thread-46827-1-1.html

内存取证工具-volatility、foremost的更多相关文章

苹果内存取证工具volafox
苹果内存取证工具volafox volafox是一款针对苹果内存取证的专用工具.该工具使用Python语言编写.该工具内置了overlay data数据,用户可以直接分析苹果10.6-10.11的各种 ...
volatility内存取证学习
工具下载: Linux环境 apt-get install volatility 各种依赖的安装,(视情况安装) #Distorm3:牛逼的反编译库 pip install distorm3 #Y ...
volatility内存取证
最近参加了45届世界技能大赛的山东选拔赛,样题里有一个题如下: 师傅好不容易拿到了压缩包的密码,刚准备输入,电脑蓝屏了... = =",题意简单明了,易于理解.一看就是内存取证的题并且已经 ...
Android 内存监测工具 DDMS --> Heap
一.什么是内存泄露内存泄露是指程序中间动态分配了内存,但是在程序结束时没有释放这部分内存,从而造成那一部分内存不可用.导致系统运行变慢或应用程序崩溃.二.如何检测Android中的内存泄露 ...
[原创]推荐一款强大的.NET程序内存分析工具.NET Memory Profiler
[原创]推荐一款强大的.NET程序内存分析工具.NET Memory Profiler 1 官方网站:http://memprofiler.com/2 下载地址:http://memprofiler. ...
javascript js 内存泄露工具使用
javascript内存泄露工具使用原文:http://lanhy2000.blog.163.com/blog/static/43678608201121472644851/ 2011-03-14 ...
JS内存泄漏和Chrome 内存分析工具简介（摘）
原文地址:http://web.jobbole.com/88463/ JavaScript 中 4 种常见的内存泄露陷阱原文:Sebastián Peyrott 译文:伯乐在线专栏作者 - AR ...
Android 内存分析工具 MAT(Memory Analyzer Tool)
如果使用DDMS确实发现了我们的程序中存在内存泄漏,那又如何定位到具体出现问题的代码片段,最终找到问题所在呢?如果从头到尾的分析代码逻辑,那肯定会把人逼疯,特别是在维护别人写的代码的时候.这里介绍一 ...
Android内存分析工具DDMS heap + MAT 安装和使用
一 Java内存分析工具扫盲如果像我一样一点都不了解,可以先进行内存分析工具扫盲 MAT介绍: Eclipse Memory Analyzer(MAT)一个功能丰富的 JAVA 堆转储 ...

随机推荐

js之观察者模式和发布订阅模式区别
观察者模式(Observer) 观察者模式指的是一个对象(Subject)维持一系列依赖于它的对象(Observer),当有关状态发生变更时 Subject 对象则通知一系列 Observer 对象进 ...
luogu P1976 鸡蛋饼
题目背景 Czyzoiers 都想知道小 x 为什么对鸡蛋饼情有独钟.经过一番逼问,小 x 道出了实情:因为他喜欢圆. 题目描述最近小 x 又发现了一个关于圆的有趣的问题:在圆上有 2N 个不同的点 ...
Java修炼——内部类详解
内部类详解定义:将一个类定义在另一个类的内部,该类就称为内部类类中定义的内部类特点: 内部类作为外部类的成员,可以直接访问外部类的成员 (包括 private 成员),反之则不行. 内部类做为外部 ...
Mysql多实例数据库
什么是Mysql的多实例? 简单的说,Mysql多实例就是一台服务器上同时开启多个不同的服务端口(如3306.3307)同时运行多个Mysql服务进程,这些服务进程通过不同socket监听不同的服务端 ...
mui 顶部选项卡的两种切换方式
mui 顶部选项卡的两种切换方式第一种main页面 <!DOCTYPE html> <html> <head> <meta charset="ut ...
[问题记录]——log4net记录多个级别文件
目录前言 Log4net 测试小结前言不知不觉可都快又一年了,最近这段时间一直在忙着图形方面的东西(确实快给我搞死了),虽说时间还是相对有的,但是精力耗费的十有十一,把问题记录单开一栏,是为了 ...
大数据学习笔记——HDFS写入过程源码分析(1)
HDFS写入过程方法调用逻辑 & 源码注释解读前一篇介绍HDFS模块的博客中,我们重点从实践角度介绍了各种API如何使用以及IDEA的基本安装和配置步骤,而从这一篇开始,将会正式整理HDFS ...
vue click.stop阻止点击事件继续传播
<div id="app"> <div @click="dodo"> <button @:click="doThis&q ...
SSM非springboot配置swagger2
前提:maven,ssm,不是springboot项目 1.在maven中添加依赖   ...
Linux vi与vim使用
vi与vimvi编辑器是所有Unix及Linux系统下标准的编辑器,他就相当于windows系统中的记事本一样,它的强大不逊色于任何最新的文本编辑器.他是我们使用Linux系统不能缺少的工具.由于对U ...

内存取证工具-volatility、foremost