Serbian - Ht
HackTricks Training Twitter Linkedin Sponsor

Volatility - CheatSheet

Naučite hakovanje AWS-a od nule do heroja sa htARTE (HackTricks AWS Red Team Expert)!

Drugi načini podrške HackTricks-u:

​

​​RootedCON je najrelevantniji događaj u oblasti kibernetičke bezbednosti u Španiji i jedan od najvažnijih u Evropi. Sa misijom promovisanja tehničkog znanja, ovaj kongres je ključno mesto susreta tehnoloških i kibernetičkih profesionalaca u svakoj disciplini.

LogoRootedCONRootedCON

Ako želite nešto brzo i ludo što će pokrenuti nekoliko Volatility dodataka paralelno, možete koristiti: https://github.com/carlospolop/autoVolatility

python autoVolatility.py -f MEMFILE -d OUT_DIRECTORY -e /home/user/tools/volatility/vol.py # It will use the most important plugins (could use a lot of space depending on the size of the memory)

Instalacija

volatility3

git clone https://github.com/volatilityfoundation/volatility3.git
cd volatility3
python3 setup.py install
python3 vol.py —h

volatility2

Download the executable from https://www.volatilityfoundation.org/26

Komande Volatility

Pristupite zvaničnoj dokumentaciji na Volatility command reference

Napomena o "list" vs. "scan" dodacima

Volatility ima dva glavna pristupa dodacima, što se ponekad odražava u njihovim imenima. "list" dodaci će pokušati da navigiraju kroz strukture Windows Kernela kako bi dobili informacije poput procesa (lociraju i prođu kroz povezanu listu _EPROCESS struktura u memoriji), OS ručki (lociraju i navedu tabelu ručki, dereferencirajući bilo koje pronađene pokazivače, itd). Oni se više-manje ponašaju kao Windows API kada bi bio zatražen, na primer, popis procesa.

To čini "list" dodatke prilično brzim, ali jednako ranjivim kao i Windows API na manipulaciju od strane malvera. Na primer, ako malver koristi DKOM da odvoji proces od povezane liste _EPROCESS, neće se pojaviti u Task Manageru, niti u pslist-u.

"scan" dodaci, s druge strane, pristupiće slično kao da se urezuju memorija za stvari koje bi mogle imati smisla kada se dereferenciraju kao specifične strukture. Na primer, psscan će pročitati memoriju i pokušati da napravi objekte _EPROCESS od nje (koristi skeniranje pool-tagova, što je traženje 4-bajtnih nizova koji ukazuju na prisustvo strukture od interesa). Prednost je što može otkriti procese koji su završili, i čak ako malver manipuliše sa povezanom listom _EPROCESS, dodatak će i dalje pronaći strukturu ostavljenu u memoriji (jer joj i dalje treba postojati da bi proces radio). Mana je što su "scan" dodaci malo sporiji od "list" dodataka, i ponekad mogu dati lažne pozitivne rezultate (proces koji je završio pre dugo vremena i čiji su delovi strukture prepisani drugim operacijama).

Izvor: http://tomchop.me/2016/11/21/tutorial-volatility-plugins-malware-analysis/

OS Profili

Volatility3

Kako je objašnjeno u readme datoteci, morate staviti tabelu simbola OS-a koji želite podržati unutar volatility3/volatility/symbols. Paketi tabela simbola za različite operativne sisteme dostupni su za preuzimanje na:

Volatility2

Spoljni Profil

Možete dobiti listu podržanih profila izvršavanjem:

./volatility_2.6_lin64_standalone --info | grep "Profile"

Ako želite da koristite novi profil koji ste preuzeli (na primer, linux profil), treba da kreirate sledeću strukturu foldera: plugins/overlays/linux i stavite zip fajl sa profilom unutar ovog foldera. Zatim, dobijte broj profila koristeći:

./vol --plugins=/home/kali/Desktop/ctfs/final/plugins --info
Volatility Foundation Volatility Framework 2.6


Profiles
--------
LinuxCentOS7_3_10_0-123_el7_x86_64_profilex64 - A Profile for Linux CentOS7_3.10.0-123.el7.x86_64_profile x64
VistaSP0x64                                   - A Profile for Windows Vista SP0 x64
VistaSP0x86                                   - A Profile for Windows Vista SP0 x86

Možete preuzeti profile za Linux i Mac sa https://github.com/volatilityfoundation/profiles

U prethodnom odeljku možete videti da se profil zove LinuxCentOS7_3_10_0-123_el7_x86_64_profilex64, i možete ga koristiti da izvršite nešto poput:

./vol -f file.dmp --plugins=. --profile=LinuxCentOS7_3_10_0-123_el7_x86_64_profilex64 linux_netscan

Otkrij profil

volatility imageinfo -f file.dmp
volatility kdbgscan -f file.dmp

Razlike između imageinfo i kdbgscan

Ovde: Za razliku od imageinfo koji jednostavno pruža predloge profila, kdbgscan je dizajniran da pozitivno identifikuje tačan profil i tačnu KDBG adresu (ako ih ima više). Ovaj dodatak skenira potpise KDBGHeader povezane sa Volatility profilima i primenjuje provere ispravnosti kako bi se smanjili lažni pozitivi. Opširnost izlaza i broj provera ispravnosti koje se mogu izvršiti zavise od toga da li Volatility može pronaći DTB, pa ako već znate tačan profil (ili ako imate predlog profila od imageinfo), onda se pobrinite da ga koristite iz .

Uvek pogledajte broj procesa koje je kdbgscan pronašao. Ponekad imageinfo i kdbgscan mogu pronaći više od jednog odgovarajućeg profila, ali samo validan će imati neke procese povezane (To je zato što je za izvlačenje procesa potrebna tačna KDBG adresa)

# GOOD
PsActiveProcessHead           : 0xfffff800011977f0 (37 processes)
PsLoadedModuleList            : 0xfffff8000119aae0 (116 modules)
# BAD
PsActiveProcessHead           : 0xfffff800011947f0 (0 processes)
PsLoadedModuleList            : 0xfffff80001197ac0 (0 modules)

KDBG

Kernel Debugger Block, poznat kao KDBG u Volatility-u, ključan je za forenzičke zadatke koje obavlja Volatility i razni debuggeri. Identifikovan kao KdDebuggerDataBlock i tipa _KDDEBUGGER_DATA64, sadrži bitne reference poput PsActiveProcessHead. Ova specifična referenca pokazuje na početak liste procesa, omogućavajući listanje svih procesa, što je osnovno za temeljnu analizu memorije.

Informacije o operativnom sistemu

#vol3 has a plugin to give OS information (note that imageinfo from vol2 will give you OS info)
./vol.py -f file.dmp windows.info.Info

Plugin banners.Banners može se koristiti u vol3 za pokušaj pronalaženja linux banera u dump-u.

Hashes/Lozinke

Izvadite SAM heševe, keširane kredencijale domena i lsa tajne.

./vol.py -f file.dmp windows.hashdump.Hashdump #Grab common windows hashes (SAM+SYSTEM)
./vol.py -f file.dmp windows.cachedump.Cachedump #Grab domain cache hashes inside the registry
./vol.py -f file.dmp windows.lsadump.Lsadump #Grab lsa secrets

Volatility Cheat Sheet

Basic Commands

  • Image Identification

    • volatility -f <memory_dump> imageinfo

  • Listing Processes

    • volatility -f <memory_dump> --profile=<profile> pslist

  • Dumping a Process

    • volatility -f <memory_dump> --profile=<profile> memdump -p <pid> -D <output_directory>

  • Listing Network Connections

    • volatility -f <memory_dump> --profile=<profile> connections

  • Dumping a File

    • vollocation -f <memory_dump> --profile=<profile> dumpfiles -Q <address_range> -D <output_directory>

Advanced Commands

  • Detecting Hidden Processes

    • volatility -f <memory_dump> --profile=<profile> psxview

  • Analyzing Registry

    • volatility -f <memory_dump> --profile=<profile> hivelist

    • volatility -f <memory_dump> --profile=<profile> printkey -K <registry_key>

  • Extracting DLLs

    • volatility -f <memory_dump> --profile=<profile> dlldump -p <pid> -D <output_directory>

  • Analyzing Timelime

    • volatility -f <memory_dump> --profile=<profile> timeliner

  • Identifying Sockets

    • volatility -f <memory_dump> --profile=<profile> sockets

  • Analyzing Drivers

    • volatility -f <memory_dump> --profile=<profile> driverscan

  • Analyzing Packed Binaries

    • volatility -f <memory_dump> --profile=<profile> malfind

  • Analyzing Process Handles

    • volatility -f <memory_dump> --profile=<profile> handles

  • Analyzing Process DLLs

    • volatility -f <memory_dump> --profile=<profile> pslist

    • volatility -f <memory_dump> --profile=<profile> dlllist -p <pid>

  • Analyzing Kernel Modules

    • volatility -f <memory_dump> --profile=<profile> modscan

  • Analyling User Mode Hooks

    • volatility -f <memory_dump> --profile=<profile> usermodehooks

  • Analyzing SSDT Hooks json

    • volatility -f <memory_dump> --profile=<profile> ssdt

  • Analyzing IRP Hooks

    • volatility -f <memory_dump> --profile=<profile> irp

  • Analyzing IDT Hooks

    • volatility -f <memory_dump> --profile=<profile> idt

  • Analyzing GDT Hooks

    • volatility -f <memory_dump> --profile=<profile> gdt

  • Analyzing Hidden Modules

    • volatility -f <memory_dump> --profile=<profile> ldrmodules

  • Analyzing Mutants

    • volatility -f <memory_dump> --profile=<profile> mutantscan

  • Analyzing API Hooks

    • volatility -f <memory_dump> --profile=<profile> apihooks

  • Analyzing Callbacks

    • volatility -f <memory_dump> --profile=<profile> callbacks

  • Analyzing SSDT

    • volatility -f <memory_dump> --profile=<profile> ssdt

  • Analyzing IDT

    • volatility -f <memory_dump> --profile=<profile> idt

  • Analyzing GDT

    • volatility -f <memory_dump> --profile=<profile> gdt

  • Analyzing CSRSS

    • volatility -f <memory_dump> --profile=<profile> csrss

  • Analyzing Hidden Processes

    • volatility -f <memory_dump> --profile=<profile> psxview

  • Analyzing Hidden Modules

    • volatility -f <memory_dump> --profile=<profile> ldrmodules

  • Analyzing Hidden Handles

    • volatility -f <memory_dump> --profile=<profile> hivelist

  • Analyzing Hidden SSDT

    • vollocation -f <memory_dump> --profile=<profile> ssdt

  • Analyzing Hidden IRP

    • volatility -f <memory_dump> --profile=<profile> irp

  • Analyzing Hidden IDT

    • volatility -f <memory_dump> --profile=<profile> idt

  • Analyzing Hidden GDT

    • volatility -f <memory_dump> --profile=<profile> gdt

  • Analyzing Hidden Mutants

    • volatility -f <memory_dump> --profile=<profile> mutantscan

  • Analyzing Hidden API Hooks

    • volatility -f <memory_dump> --profile=<profile> apihooks

  • Analyzing Hidden Callbacks

    • volatility -f <memory_dump> --profile=<profile> callbacks

  • Analyzing Hidden User Mode Hooks

    • volatility -f <memory_dump> --profile=<profile> usermodehooks

  • Analyzing Hidden Kernel Modules

    • volatility -f <memory_dump> --profile=<profile> modscan

  • Analyzing Hidden CSRSS

    • volatility -f <memory_dump> --profile=<profile> csrss

  • Analyzing Hidden Sockets

    • volatility -f <memory_dump> --profile=<profile> sockets

  • Analyzing Hidden Drivers

    • volatility -f <memory_dump> --profile=<profile> driverscan

  • Analyzing Hidden Packed Binaries

    • volatility -f <memory_dump> --profile=<profile> malfind

  • Analyzing Hidden Process Handles

    • volatility -f <memory_dump> --profile=<profile> handles

  • Analyzing Hidden Process DLLs

    • volatility -f <memory_dump> --profile=<profile> pslist

    • volatility -f <memory_dump> --profile=<profile> dlllist -p <pid>

  • Analyzing Hidden Timelime

    • volatility -f <memory_dump> --profile=<profile> timeliner

  • Analyzing Hidden Registry

    • volatility -f <memory_dump> --profile=<profile> hivelist

    • volatility -f <memory_dump> --profile=<profile> printkey -K <registry_key>

  • Analyzing Hidden DLLs

    • volatility -f <memory_dump> --profile=<profile> dlldump -p <pid> -D <output_directory>

  • Analyzing Hidden Network Connections

    • volatility -f <memory_dump> --profile=<profile> connections

  • Analyzing Hidden Files

    • vollocation -f <memory_dump> --profile=<profile> dumpfiles -Q <address_range> -D <output_directory>

  • Analyzing Hidden Image

    • volatility -f <memory_dump> imageinfo

  • Analyzing Hidden Processes

    • volatility -f <memory_dump> --profile=<profile> pslist

  • Analyzing Hidden Threads

    • volatility -f <memory_dump> --profile=<profile> threads

  • Analyzing Hidden Handles

    • volatility -f <memory_dump> --profile=<profile> handles

  • Analyzing Hidden Mutants

    • volatility -f <memory_dump> --profile=<profile> mutantscan

  • Analyzing Hidden API Hooks

    • volatility -f <memory_dump> --profile=<profile> apihooks

  • Analyzing Hidden Callbacks

    • volatility -f <memory_dump> --profile=<profile> callbacks

  • Analyzing Hidden User Mode Hooks

    • volatility -f <memory_dump> --profile=<profile> usermodehooks

  • Analyzing Hidden Kernel Modules

    • volatility -f <memory_dump> --profile=<profile> modscan

  • Analyzing Hidden CSRSS

    • volatility -f <memory_dump> --profile=<profile> csrss

  • Analyzing Hidden Sockets

    • volatility -f <memory_dump> --profile=<profile> sockets

  • Analyzing Hidden Drivers

    • volatility -f <memory_dump> --profile=<profile> driverscan

  • Analyzing Hidden Packed Binaries

    • volatility -f <memory_dump> --profile=<profile> malfind

  • Analyzing Hidden Process Handles

    • volatility -f <memory_dump> --profile=<profile> handles

  • Analyzing Hidden Process DLLs

    • volatility -f <memory_dump> --profile=<profile> pslist

    • volatility -f <memory_dump> --profile=<profile> dlllist -p <pid>

  • Analyzing Hidden Kernel Modules

    • volatility -f <memory_dump> --profile=<profile> modscan

  • Analyzing Hidden Timelime

    • volatility -f <memory_dump> --profile=<profile> timeliner

  • Analyzing Hidden Registry

    • volatility -f <memory_dump> --profile=<profile> hivelist

    • volatility -f <memory_dump> --profile=<profile> printkey -K <registry_key>

  • Analyzing Hidden DLLs

    • volatility -f <memory_dump> --profile=<profile> dlldump -p <pid> -D <output_directory>

  • Analyzing Hidden Network Connections

    • volatility -f <memory_dump> --profile=<profile> connections

  • Analyzing Hidden Files

    • vollocation -f <memory_dump> --profile=<profile> dumpfiles -Q <address_range> -D <output_directory>

  • Analyzing Hidden Image

    • volatility -f <memory_dump> imageinfo

  • Analyzing Hidden Processes

    • volatility -f <memory_dump> --profile=<profile> pslist

  • Analyzing Hidden Threads

    • volatility -f <memory_dump> --profile=<profile> threads

  • Analyzing Hidden Handles

    • volatility -f <memory_dump> --profile=<profile> handles

  • Analyzing Hidden Mutants

    • volatility -f <memory_dump> --profile=<profile> mutantscan

  • Analyzing Hidden API Hooks

    • volatility -f <memory_dump> --profile=<profile> apihooks

  • Analyzing Hidden Callbacks

    • volatility -f <memory_dump> --profile=<profile> callbacks

  • Analyzing Hidden User Mode Hooks

    • volatility -f <memory_dump> --profile=<profile> usermodehooks

  • Analyzing Hidden Kernel Modules

    • volatility -f <memory_dump> --profile=<profile> modscan

  • Analyzing Hidden CSRSS

    • volatility -f <memory_dump> --profile=<profile> csrss

  • Analyzing Hidden Sockets

    • volatility -f <memory_dump> --profile=<profile> sockets

  • Analyzing Hidden Drivers

    • volatility -f <memory_dump> --profile=<profile> driverscan

  • Analyzing Hidden Packed Binaries

    • volatility -f <memory_dump> --profile=<profile> malfind

  • Analyzing Hidden Process Handles

    • volatility -f <memory_dump> --profile=<profile> handles

  • Analyzing Hidden Process DLLs

    • volatility -f <memory_dump> --profile=<profile> pslist

    • volatility -f <memory_dump> --profile=<profile> dlllist -p <pid>

  • Analyzing Hidden Kernel Modules

    • volatility -f <memory_dump> --profile=<profile> modscan

  • Analyzing Hidden Timelime

    • volatility -f <memory_dump> --profile=<profile> timeliner

  • Analyzing Hidden Registry

    • volatility -f <memory_dump> --profile=<profile> hivelist

    • volatility -f <memory_dump> --profile=<profile> printkey -K <registry_key>

  • Analyzing Hidden DLLs

    • volatility -f <memory_dump> --profile=<profile> dlldump -p <pid> -D <output_directory>

  • Analyzing Hidden Network Connections

    • volatility -f <memory_dump> --profile=<profile> connections

  • Analyzing Hidden Files

    • vollocation -f <memory_dump> --profile=<profile> dumpfiles -Q <address_range> -D <output_directory>

Plugin Development

  • Creating a New Plugin

    • volatility --plugins=<path_to_plugin_directory> -f <memory_dump> --profile=<profile> <plugin_name>

  • Debugging a Plugin

    • volatility --plugins=<path_to_plugin_directory> -f <memory_dump> --profile=<profile> --debug <plugin_name>

  • Listing Available Plugins

    • volatility --plugins=<path_to_plugin_directory> --info

  • Listing Available Plugin Options

    • volatility --plugins=<path_to_plugin_directory> --info <plugin_name>

  • Running a Plugin with Options

    • volatility --plugins=<path_to_plugin_directory> -f <memory_dump> --profile=<profile> <plugin_name> --<option_name> <option_value>

  • Running a Plugin with Multiple Options

    • volatility --plugins=<path_to_plugin_directory> -f <memory_dump> --profile=<profile> <plugin_name> --<option1_name> <option1_value> --<option2_name> <option2_value>

  • Running a Plugin with Output to File

    • volatility --plugins=<path_to_plugin_directory> -f <memory_dump> --profile=<profile> <plugin_name> > <output_file>

  • Running a Plugin with Output to CSV

    • volatility --plugins=<path_to_plugin_directory> -f <memory_dump> --profile=<profile> <plugin_name> --output=csv > <output_csv_file>

  • Running a Plugin with Output to JSON

    • volatility --plugins=<path_to_plugin_directory> -f <memory_dump> --profile=<profile> <plugin_name> --output=json > <output_json_file>

  • Running a Plugin with Output to SQLite Database

    • volatility --plugins=<path_to_plugin_directory> -f <memory_dump> --profile=<profile> <plugin_name> --output=sqlite > <output_sqlite_file>

  • Running a Plugin with Output to SQLite Database with Custom Table Name

    • volatility --plugins=<path_to_plugin_directory> -f <memory_dump> --profile=<profile> <plugin_name> --output=sqlite --output-file=<output_sqlite_file> --output-table=<table_name>

  • Running a Plugin with Output to SQLite Database with Custom Table Name and Additional Options

    • volatility --plugins=<path_to_plugin_directory> -f <memory_dump> --profile=<profile> <plugin_name> --output=sqlite --output-file=<output_sqlite_file> --output-table=<table_name> --<option_name> <option_value>

  • Running a Plugin with Output to SQLite Database with Custom Table Name and Multiple Options

    • volatility --plugins=<path_to_plugin_directory> -f <memory_dump> --profile=<profile> <plugin_name> --output=sqlite --output-file=<output_sqlite_file> --output-table=<table_name> --<option1_name> <option1_value> --<option2_name> <option2_value>

  • Running a Plugin with Output to SQLite Database with Custom Table Name and Debugging

    • volatility --plugins=<path_to_plugin_directory> -f <memory_dump> --profile=<profile> <plugin_name> --output=sqlite --output-file=<output_sqlite_file> --output-table=<table_name> --debug

  • Running a Plugin with Output to SQLite Database with Custom Table Name, Debugging, and Additional Options

    • volatility --plugins=<path_to_plugin_directory> -f <memory_dump> --profile=<profile> <plugin_name> --output=sqlite --output-file=<output_sqlite_file> --output-table=<table_name> --debug --<option_name> <option_value>

  • Running a Plugin with Output to SQLite Database with Custom Table Name, Debugging, and Multiple Options

    • volatility --plugins=<path_to_plugin_directory> -f <memory_dump> --profile=<profile> <plugin_name> --output=sqlite --output-file=<output_sqlite_file> --output-table=<table_name> --debug --<option1_name> <option1_value> --<option2_name> <option2_value>

  • Running a Plugin with Output to SQLite Database with Custom Table Name, Debugging, and Multiple Options

    • volatility --plugins=<path_to_plugin_directory> -f <memory_dump> --profile=<profile> <plugin_name> --output=sqlite --output-file=<output_sqlite_file> --output-table=<table_name> --debug --<option1_name> <option1_value> --<option2_name> <option2_value>

  • Running a Plugin with Output to SQLite Database with Custom Table Name, Debugging, and Multiple Options

    • volatility --plugins=<path_to_plugin_directory> -f <memory_dump> --profile=<profile> <plugin_name> --output=sqlite --output-file=<output_sqlite_file> --output-table=<table_name> --debug --<option1_name> <option1_value> --<option2_name> <option2_value>

  • Running a Plugin with Output to SQLite Database with Custom Table Name, Debugging, and Multiple Options

    • volatility --plugins=<path_to_plugin_directory> -f <memory_dump> --profile=<profile> <plugin_name> --output=sqlite --output-file=<output_sqlite_file> --output-table=<table_name> --debug --<option1_name> <option1_value> --<option2_name> <option2_value>

  • Running a Plugin with Output to SQLite Database with Custom Table Name, Debugging, and Multiple Options

    • volatility --plugins=<path_to_plugin_directory> -f <memory_dump> --profile=<profile> <plugin_name> --output=sqlite --output-file=<output_sqlite_file> --output-table=<table_name> --debug --<option1_name> <option1_value> --<option2_name> <option2_value>

  • **Running a Plugin with Output to SQLite Database with Custom Table Name,

volatility --profile=Win7SP1x86_23418 hashdump -f file.dmp #Grab common windows hashes (SAM+SYSTEM)
volatility --profile=Win7SP1x86_23418 cachedump -f file.dmp #Grab domain cache hashes inside the registry
volatility --profile=Win7SP1x86_23418 lsadump -f file.dmp #Grab lsa secrets

Memorija za odlaganje

Memorija za odlaganje procesa će izvući sve trenutno stanje procesa. Modul procdump će samo izvući kôd.

volatility -f file.dmp --profile=Win7SP1x86 memdump -p 2168 -D conhost/

​​​RootedCON je najrelevantniji događaj u oblasti kibernetičke bezbednosti u Španiji i jedan od najvažnijih u Evropi. Sa misijom promovisanja tehničkog znanja, ovaj kongres je ključno mesto susreta tehnoloških i stručnjaka za kibernetičku bezbednost u svakoj disciplini.

LogoRootedCONRootedCON

Procesi

Lista procesa

Pokušajte da pronađete sumnjive procese (po imenu) ili neočekivane podprocese (na primer cmd.exe kao podproces iexplorer.exe). Moglo bi biti interesantno uporediti rezultat pslist sa rezultatom psscan kako biste identifikovali skrivene procese.

python3 vol.py -f file.dmp windows.pstree.PsTree # Get processes tree (not hidden)
python3 vol.py -f file.dmp windows.pslist.PsList # Get process list (EPROCESS)
python3 vol.py -f file.dmp windows.psscan.PsScan # Get hidden process list(malware)

​

​​​​RootedCON je najrelevantniji događaj u oblasti kibernetičke bezbednosti u Španiji i jedan od najvažnijih u Evropi. Sa misijom promovisanja tehničkog znanja, ovaj kongres je ključno mesto susreta tehnoloških i stručnjaka za kibernetičku bezbednost u svakoj disciplini.

Usluge

./vol.py -f file.dmp windows.svcscan.SvcScan #List services
./vol.py -f file.dmp windows.getservicesids.GetServiceSIDs #Get the SID of services

Volatility Cheat Sheet

Basic Commands

  • imageinfo: Provides information about the profile and operating system version.

  • pslist: Lists running processes.

  • pstree: Displays the process list in a tree format.

  • psscan: Scans for processes in the memory dump.

  • dlllist: Lists DLLs loaded into each process.

  • handles: Lists open handles in the memory dump.

  • filescan: Scans for file objects in memory.

  • cmdline: Displays process command line arguments.

  • netscan: Scans for network artifacts.

  • connections: Lists open network connections.

  • sockets: Lists network socket information.

  • svcscan: Scans for Windows services.

  • modscan: Scans for kernel modules.

  • malfind: Finds suspicious process mappings.

  • yarascan: Scans for matches with Yara rules.

  • dumpfiles: Extracts files from the memory dump.

  • dumpregistry: Dumps the registry hives.

  • hashdump: Dumps password hashes.

  • hivelist: Lists registry hives.

  • printkey: Prints a specific registry key.

  • timeliner: Creates a timeline of processes and events.

  • apihooks: Detects processes using API hooking techniques.

  • ldrmodules: Lists loaded kernel modules.

  • devicetree: Displays the device tree.

  • idt: Displays the Interrupt Descriptor Table.

  • gdt: Displays the Global Descriptor Table.

  • ssdt: Displays the System Service Descriptor Table.

  • callbacks: Lists kernel callbacks.

  • driverirp: Lists drivers and IRP handlers.

  • deskscan: Scans for windows on the desktop.

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SSIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

  • getsids: Lists Security Identifiers (SIDs).

#Get services and binary path
volatility --profile=Win7SP1x86_23418 svcscan -f file.dmp
#Get name of the services and SID (slow)
volatility --profile=Win7SP1x86_23418 getservicesids -f file.dmp

Mreža

./vol.py -f file.dmp windows.netscan.NetScan
#For network info of linux use volatility2

Autoruns

Preuzmite sa https://github.com/tomchop/volatility-autoruns

volatility --plugins=volatility-autoruns/ --profile=WinXPSP2x86 -f file.dmp autoruns

Mutexes

./vol.py -f file.dmp windows.mutantscan.MutantScan

Uobičajena metodologija i resursi

Osnovna forenzička metodologija

  1. Identifikacija problema

    • Definišite problem i ciljeve analize.

  2. Prikupljanje informacija

    • Prikupite informacije o sistemu, korisnicima, aktivnostima i vremenskom okviru.

  3. Analiza informacija

    • Analizirajte informacije kako biste identifikovali sumnjive aktivnosti ili tragove.

  4. Validacija

    • Potvrdite identifikovane tragove i aktivnosti.

  5. Izveštavanje

    • Pripremite izveštaj o analizi sa svim relevantnim informacijama i zaključcima.

Analiza memorijskog ispusta pomoću Volatility alata

  1. Identifikacija profila

    • Identifikujte odgovarajući profil memorijskog ispusta.

  2. Analiza procesa

    • Proučite procese u memorijskom ispustu.

  3. Analiza mrežnih veza

    • Istražite mrežne veze i aktivnosti.

  4. Analiza registara

    • Pregledajte registre radi pronalaženja korisnih informacija.

  5. Analiza datoteka

    • Ispitajte datoteke kako biste pronašli sumnjive sadržaje.

  6. Analiza šifrovanja

    • Identifikujte i dešifrujte šifrovane podatke ako je potrebno.

  7. Analiza zlonamernih aktivnosti

    • Tražite znakove zlonamernih aktivnosti u memorijskom ispustu.

  8. Generisanje izveštaja

    • Kreirajte detaljan izveštaj o analizi memorijskog ispusta.

volatility --profile=Win7SP1x86_23418 mutantscan -f file.dmp
volatility --profile=Win7SP1x86_23418 -f file.dmp handles -p <PID> -t mutant

Simboličke veze

./vol.py -f file.dmp windows.symlinkscan.SymlinkScan
volatility --profile=Win7SP1x86_23418 -f file.dmp symlinkscan

Bash

Moguće je čitati iz memorije istoriju komandi u bash-u. Takođe možete izvući fajl .bash_history, ali ako je onemogućen, bićete srećni što možete koristiti ovaj modul volatilnosti.

./vol.py -f file.dmp linux.bash.Bash

Osnovna forenzička metodologija

Analiza memorije

Volatility Cheat Sheet

Osnovne komande

  • volatility -f <dumpfile> imageinfo - prikaz informacija o dump fajlu

  • volatility -f <dumpfile> pslist - prikaz listi aktivnih procesa

  • volatility -f <dumpfile> psscan - skeniranje procesa

  • volatility -f <dumpfile> pstree - prikaz stabla procesa

  • volatility -f <dumpfile> dlllist -p <PID> - prikaz učitanih DLL-ova za određeni proces

  • volatility -f <dumpfile> filescan - skeniranje fajlova

  • volatility -f <dumpfile> cmdline -p <PID> - prikaz komandne linije za određeni proces

  • volatility -f <dumpfile> netscan - skeniranje mrežnih konekcija

  • volatility -f <dumpfile> connections - prikaz TCP konekcija

  • volatility -f <dumpfile> timeliner - analiza vremenske linije

  • volatility -f <dumpfile> malfind - detekcija sumnjivih procesa

  • volatility -f <dumpfile> apihooks - prikaz API hook-ova

  • volatility -f <dumpfile> ldrmodules - prikaz učitanih modula

  • volatility -f <dumpfile> modscan - skeniranje modula

  • volatility -f <dumpfile> mutantscan - skeniranje mutanata

  • volatility -f <dumpfile> svcscan - skeniranje servisa

  • volatility -f <dumpfile> userassist - analiza UserAssist ključeva

  • volatility -f <dumpfile> shimcache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> hivelist - prikaz registarskih ključeva

  • volatility -f <dumpfile> printkey -o <Offset> - prikaz sadržaja registarskog kljujsona na određenom offsetu

  • volatility -f <dumpfile> hashdump - ekstrakcija korisničkih lozinki

  • volatility -f <dumpfile> truecryptpassphrase - ekstrakcija TrueCrypt lozinke

  • volatility -f <dumpfile> clipboard - prikaz sadržaja clipboard-a

  • volatility -f <dumpfile> screenshot - snimanje screenshot-a

  • volatility -f <dumpfile> memdump -p <PID> -D <output_directory> - dumpovanje memorije za određeni proces

  • volatility -f <dumpfile> memdump -p <PID> --output-file <output_file> - dumpovanje memorije za određeni proces u određeni fajl

  • volatility -f <dumpfile> memmap - prikaz mapiranja memorije

  • volatility -f <dumpfile> raw2dmp -f <input_file> -o <output_file> - konverzija raw memorije u dump fajl

  • volatility -f <dumpfile> raw2dmp --physmap -f <input_file> -o <output_file> - konverzija raw fizičke memorije u dump fajl

Napredne komande

  • volatility -f <dumpfile> windows.lsadump.Lsadump - ekstrakcija LSASS procesa

  • volatility -f <dumpfile> windows.dumpfiles.DumpFiles - ekstrakcija fajlova iz memorije

  • volatility -f <dumpfile> windows.registry.hivelist.HiveList - prikaz registarskih ključeva

  • volatility -f <dumpfile> windows.registry.printkey.PrintKey -o <Offset> - prikaz sadržaja registarskog ključa na određenom offsetu

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

  • volatility -f <dumpfile> windows.registry.shimcache.ShimCache - analiza Shimcache baze podataka

  • volatility -f <dumpfile> windows.registry.userassist.UserAssist - analiza UserAssist ključeva

volatility --profile=Win7SP1x86_23418 -f file.dmp linux_bash

Vremenska linija

./vol.py -f file.dmp timeLiner.TimeLiner

Volatility Cheat Sheet

Basic Commands

  • Image Identification

    • volatility -f <memory_dump> imageinfo

  • Listing Processes

    • volatility -f <memory_dump> --profile=<profile> pslist

  • Dumping a Process

    • volatility -f <memory_dump> --profile=<profile> memdump -p <pid> -D <output_directory>

  • Listing Network Connections

    • volatility -f <memory_dump> --profile=<profile> connections

  • Dumping Registry Hives

    • volatility -f <memory_dump> --profile=<profile> hivelist

  • Dumping a Registry Hive

    • voljsonity -f <memory_dump> --profile=<profile> printkey -o <output_directory> -K <hive_offset>

Advanced Commands

  • Analyzing Malware

    • volatility -f <memory_dump> --profile=<profile> malfind

  • Identifying Hidden Processes

    • volatility -f <memory_dump> --profile=<profile> psxview

  • Extracting DLLs

    • volatility -f <memory_dump> --profile=<profile> dlldump -D <output_directory>

  • Analyzing Timelining

    • volatility -f <memory_dump> --profile=<profile> timeliner

  • Analyzing Packed Binaries

    • volatility -f <memory_dump> --profile=<profile> mpp

  • Analyzing Suspicious Drivers

    • volatility -f <memory_dump> --profile=<profile> ldrmodules

  • Analyzing Process Handles

    • volatility -f <memory_dump> --profile=<profile> handles

  • Analyzing Registry Transactions

    • volatility -f <memory_dump> --profile=<profile> printkey -o <output_directory> -K <hive_offset>

  • Analyzing UserAssist

    • volatility -f <memory_dump> --profile=<profile> userassist

  • Analyzing Shellbags

    • volatility -f <memory_dump> --profile=<profile> shellbags

  • Analyzing LSA Secrets

    • volatility -f <memory_dump> --profile=<profile> lsadump

  • Analyzing API Hooks

    • volatility -f <memory_dump> --profile=<profile> apihooks

  • Analyzing SSDT Hooks

    • volatility -f <memory_dump> --profile=<profile> ssdt

  • Analyzing IRP Hooks

    • volatility -f <memory_dump> --profile=<profile> irp

  • Analyzing IDT Hooks

    • volatility -f <memory_dump> --profile=<profile> idt

  • Analyzing GDT Hooks

    • volatility -f <memory_dump> --profile=<profile> gdt

  • Analyzing Hidden Modules

    • volatility -f <memory_dump> --profile=<profile> ldrmodules

  • Analyzing Hidden SSDT

    • volatility -f <memory_dump> --profile=<profile> ssdt

  • Analyzing Hidden IRP

    • volatility -f <memory_dump> --profile=<profile> irp

  • Analyzing Hidden IDT

    • volatility -f <memory_dump> --profile=<profile> idt

  • Analyzing Hidden GDT

    • volatility -f <memory_dump> --profile=<profile> gdt

  • Analyzing Hidden Handlers

    • volatility -f <memory_dump> --profile=<profile> handlers

  • Analyzing Hidden Ports

    • volatility -f <memory_dump> --profile=<profile> ports

  • Analyzing Hidden Services

    • volatility -f <memory_dump> --profile=<profile> svcscan

  • Analyizing Hidden Devices

    • volatility -f <memory_dump> --profile=<profile> devicetree

  • Analyzing Hidden Files

    • volatility -f <memory_dump> --profile=<profile> filescan

  • Analyzing Hidden Registry Keys

    • volatility -f <memory_dump> --profile=<profile> hivescan

  • Analyzing Hidden Objects

    • volatility -f <memory_dump> --profile=<profile> callbacks

  • Analyzing Hidden Mutants

    • volatility -f <memory_dump> --profile=<profile> mutantscan

  • Analyzing Hidden Sockets

    • volatility -f <memory_dump> --profile=<profile> sockets

  • Analyzing Hidden Threads

    • volatility -f <memory_dump> --profile=<profile> threads

  • Analyzing Hidden Timers

    • volatility -f <memory_dump> --profile=<profile> timers

  • Analyzing Hidden Windows

    • volatility -f <memory_dump> --profile=<profile> windows

  • Analyzing Hidden Handles

    • volatility -f <memory_dump> --profile=<profile> handles

  • Analyzing Hidden Tokens

    • volatility -f <memory_dump> --profile=<profile> tokens

  • Analyzing Hidden Drivers

    • volatility -f <memory_dump> --profile=<profile> drivers

  • Analyzing Hidden Services

    • volatility -f <memory_dump> --profile=<profile> services

  • Analyzing Hidden Processes

    • volatility -f <memory_dump> --profile=<profile> psxview

  • Analyizing Hidden Modules

    • volatility -f <memory_dump> --profile=<profile> modules

  • Analyzing Hidden DLLs

    • volatility -f <memory_dump> --profile=<profile> dlldump

  • Analyzing Hidden Malware

    • volatility -f <memory_dump> --profile=<profile> malfind

  • Analyzing Hidden Malware

    • volatility -f <memory_dump> --profile=<profile> malfind

  • Analyzing Hidden Malware

    • volatility -f <memory_dump> --profile=<profile> malfind

  • Analyzing Hidden Malware

    • volatility -f <memory_dump> --profile=<profile> malfind

  • Analyzing Hidden Malware

    • volatility -f <memory_dump> --profile=<profile> malfind

  • Analyzing Hidden Malware

    • volatility -f <memory_dump> --profile=<profile> malfind

  • Analyzing Hidden Malware

    • volatility -f <memory_dump> --profile=<profile> malfind

  • Analyzing Hidden Malware

    • volatility -f <memory_dump> --profile=<profile> malfind

  • Analyzing Hidden Malware

    • volatility -f <memory_dump> --profile=<profile> malfind

volatility --profile=Win7SP1x86_23418 -f timeliner

Drajveri

./vol.py -f file.dmp windows.driverscan.DriverScan

Kratki vodič za Volatility

  • Analiza procesa

    • volatility -f <dumpfile> --profile=<profile> pslist - Lista aktivnih procesa

    • volatility -f <dumpfile> --profile=<profile> psscan - Skenira procese u fizičkoj memoriji

    • volatility -f <dumpfile> --profile=<profile> pstree - Prikazuje stablo procesa

  • Analiza mreže

    • volatility -f <dumpfile> --profile=<profile> netscan - Skenira otvorene mrežne veze

    • volatility -f <dumpfile> --profile=<profile> connscan - Skenira TCP i UDP konekcije

  • Analiza registra

    • volatility -f <dumpfile> --profile=<profile> hivelist - Lista registarskih datoteka u memoriji

    • volatility -f <dumpfile> --profile=<profile> printkey -o <offset> - Prikazuje ključeve registra

  • Analiza datoteka

    • volatility -f <dumpfile> --profile=<profile> filescan - Skenira otvorene datoteke

    • volatility -f <dumpfile> --profile=<profile> dumpfiles -Q <address> - Izdvaja datoteke iz memorije

  • Analiza korisnika

    • volatility -f <dumpfile> --profile=<profile> getsids - Prikazuje SID-ove korisnika

    • volatility -f <dumpfile> --profile=<profile> hivescan - Skenira korisničke profile

  • Ostalo

    • volatility -f <dumpfile> --profile=<profile> cmdline - Prikazuje argumente komandne linije procesa

    • volatility -f <dumpfile> --profile=<profile> consoles - Prikazuje otvorene konzole

volatility --profile=Win7SP1x86_23418 -f file.dmp driverscan

Dobijanje sadržaja klipborda

#Just vol2
volatility --profile=Win7SP1x86_23418 clipboard -f file.dmp

Dobijanje istorije pretraživača Internet Explorer

#Just vol2
volatility --profile=Win7SP1x86_23418 iehistory -f file.dmp

Dobijanje teksta iz beležnice

#Just vol2
volatility --profile=Win7SP1x86_23418 notepad -f file.dmp

Snimak ekrana

#Just vol2
volatility --profile=Win7SP1x86_23418 screenshot -f file.dmp

Master Boot Record (MBR)

volatility --profile=Win7SP1x86_23418 mbrparser -f file.dmp

Master Boot Record (MBR) igra ključnu ulogu u upravljanju logičkim particijama skladišnog medijuma, koje su strukturirane sa različitim sistemima datoteka. Ne samo da sadrži informacije o rasporedu particija već takođe sadrži izvršni kod koji deluje kao bootloader. Ovaj bootloader ili direktno pokreće proces učitavanja drugog nivoa OS-a (videti bootloader drugog nivoa) ili radi u harmoniji sa zapisa o podizanju zapremine (VBR) svake particije. Za dubinsko znanje, pogledajte MBR Wikipedia stranicu.

Reference

RootedCON je najrelevantniji događaj u oblasti kibernetičke bezbednosti u Španiji i jedan od najvažnijih u Evropi. Sa misijom promovisanja tehničkog znanja, ovaj kongres je ključno mesto susreta tehnoloških i kibernetičkih profesionalaca u svakoj disciplini.

Naučite hakovanje AWS-a od nule do heroja sa htARTE (HackTricks AWS Red Team Expert)!

Drugi načini podrške HackTricks-u:

PreviousMemory dump analysisNextPartitions/File Systems/Carving

Last updated