mirror of
https://github.com/HackTricks-wiki/hacktricks.git
synced 2025-10-10 18:36:50 +00:00
770 lines
27 KiB
Markdown
770 lines
27 KiB
Markdown
# Volatility - CheatSheet
|
||
|
||
{{#include ../../../banners/hacktricks-training.md}}
|
||
|
||
|
||
|
||
|
||
如果您需要一个可以自动化内存分析的工具，具有不同的扫描级别并可以并行运行多个Volatility3插件，您可以使用autoVolatility3:: [https://github.com/H3xKatana/autoVolatility3/](https://github.com/H3xKatana/autoVolatility3/)
|
||
```bash
|
||
# Full scan (runs all plugins)
|
||
python3 autovol3.py -f MEMFILE -o OUT_DIR -s full
|
||
|
||
# Minimal scan (runs a limited set of plugins)
|
||
python3 autovol3.py -f MEMFILE -o OUT_DIR -s minimal
|
||
|
||
# Normal scan (runs a balanced set of plugins)
|
||
python3 autovol3.py -f MEMFILE -o OUT_DIR -s normal
|
||
|
||
```
|
||
如果你想要一些**快速而疯狂**的东西，可以并行启动多个Volatility插件，你可以使用：[https://github.com/carlospolop/autoVolatility](https://github.com/carlospolop/autoVolatility)
|
||
```bash
|
||
python autoVolatility.py -f MEMFILE -d OUT_DIRECTORY -e /home/user/tools/volatility/vol.py # It will use the most important plugins (could use a lot of space depending on the size of the memory)
|
||
```
|
||
## 安装
|
||
|
||
### volatility3
|
||
```bash
|
||
git clone https://github.com/volatilityfoundation/volatility3.git
|
||
cd volatility3
|
||
python3 setup.py install
|
||
python3 vol.py —h
|
||
```
|
||
### volatility2
|
||
|
||
{{#tabs}}
|
||
{{#tab name="Method1"}}
|
||
```
|
||
Download the executable from https://www.volatilityfoundation.org/26
|
||
```
|
||
{{#endtab}}
|
||
|
||
{{#tab name="方法 2"}}
|
||
```bash
|
||
git clone https://github.com/volatilityfoundation/volatility.git
|
||
cd volatility
|
||
python setup.py install
|
||
```
|
||
{{#endtab}}
|
||
{{#endtabs}}
|
||
|
||
## Volatility 命令
|
||
|
||
访问官方文档 [Volatility 命令参考](https://github.com/volatilityfoundation/volatility/wiki/Command-Reference#kdbgscan)
|
||
|
||
### 关于“list”和“scan”插件的说明
|
||
|
||
Volatility 有两种主要的插件方法，有时在其名称中反映出来。“list” 插件会尝试通过 Windows 内核结构导航，以检索诸如进程（定位并遍历内存中的 `_EPROCESS` 结构的链表）、操作系统句柄（定位并列出句柄表，取消引用找到的任何指针等）等信息。它们的行为或多或少类似于 Windows API，如果请求列出进程的话。
|
||
|
||
这使得“list”插件非常快速，但与 Windows API 一样容易受到恶意软件的操控。例如，如果恶意软件使用 DKOM 从 `_EPROCESS` 链表中取消链接一个进程，它将不会出现在任务管理器中，也不会出现在 pslist 中。
|
||
|
||
另一方面，“scan” 插件将采取类似于在内存中雕刻可能在取消引用为特定结构时有意义的内容的方法。例如，`psscan` 将读取内存并尝试从中创建 `_EPROCESS` 对象（它使用池标签扫描，搜索指示感兴趣结构存在的 4 字节字符串）。其优点是它可以挖掘已退出的进程，即使恶意软件篡改了 `_EPROCESS` 链表，插件仍然会找到在内存中存在的结构（因为它仍然需要存在以便进程运行）。缺点是“scan”插件比“list”插件稍慢，有时可能会产生误报（一个退出时间过长且其结构部分被其他操作覆盖的进程）。
|
||
|
||
来自: [http://tomchop.me/2016/11/21/tutorial-volatility-plugins-malware-analysis/](http://tomchop.me/2016/11/21/tutorial-volatility-plugins-malware-analysis/)
|
||
|
||
## 操作系统配置文件
|
||
|
||
### Volatility3
|
||
|
||
如 readme 中所述，您需要将您想要支持的 **操作系统符号表** 放入 _volatility3/volatility/symbols_ 中。\
|
||
各种操作系统的符号表包可在 **下载** 中获取：
|
||
|
||
- [https://downloads.volatilityfoundation.org/volatility3/symbols/windows.zip](https://downloads.volatilityfoundation.org/volatility3/symbols/windows.zip)
|
||
- [https://downloads.volatilityfoundation.org/volatility3/symbols/mac.zip](https://downloads.volatilityfoundation.org/volatility3/symbols/mac.zip)
|
||
- [https://downloads.volatilityfoundation.org/volatility3/symbols/linux.zip](https://downloads.volatilityfoundation.org/volatility3/symbols/linux.zip)
|
||
|
||
### Volatility2
|
||
|
||
#### 外部配置文件
|
||
|
||
您可以通过以下方式获取支持的配置文件列表：
|
||
```bash
|
||
./volatility_2.6_lin64_standalone --info | grep "Profile"
|
||
```
|
||
如果您想使用**您下载的新配置文件**（例如 Linux 配置文件），您需要在某处创建以下文件夹结构：_plugins/overlays/linux_，并将包含配置文件的 zip 文件放入此文件夹中。然后，使用以下命令获取配置文件的编号：
|
||
```bash
|
||
./vol --plugins=/home/kali/Desktop/ctfs/final/plugins --info
|
||
Volatility Foundation Volatility Framework 2.6
|
||
|
||
|
||
Profiles
|
||
--------
|
||
LinuxCentOS7_3_10_0-123_el7_x86_64_profilex64 - A Profile for Linux CentOS7_3.10.0-123.el7.x86_64_profile x64
|
||
VistaSP0x64 - A Profile for Windows Vista SP0 x64
|
||
VistaSP0x86 - A Profile for Windows Vista SP0 x86
|
||
```
|
||
您可以**从 [https://github.com/volatilityfoundation/profiles](https://github.com/volatilityfoundation/profiles) 下载 Linux 和 Mac 配置文件**。
|
||
|
||
在前面的部分中，您可以看到配置文件名为 `LinuxCentOS7_3_10_0-123_el7_x86_64_profilex64`，您可以使用它来执行类似的操作：
|
||
```bash
|
||
./vol -f file.dmp --plugins=. --profile=LinuxCentOS7_3_10_0-123_el7_x86_64_profilex64 linux_netscan
|
||
```
|
||
#### 发现配置文件
|
||
```
|
||
volatility imageinfo -f file.dmp
|
||
volatility kdbgscan -f file.dmp
|
||
```
|
||
#### **imageinfo 和 kdbgscan 之间的区别**
|
||
|
||
[**从这里**](https://www.andreafortuna.org/2017/06/25/volatility-my-own-cheatsheet-part-1-image-identification/): 与仅提供配置文件建议的 imageinfo 相比，**kdbgscan** 旨在准确识别正确的配置文件和正确的 KDBG 地址（如果存在多个）。该插件扫描与 Volatility 配置文件相关的 KDBGHeader 签名，并应用合理性检查以减少误报。输出的详细程度和可以执行的合理性检查数量取决于 Volatility 是否能够找到 DTB，因此如果您已经知道正确的配置文件（或者如果您有来自 imageinfo 的配置文件建议），请确保使用它。
|
||
|
||
始终查看 **kdbgscan 找到的进程数量**。有时 imageinfo 和 kdbgscan 可以找到 **多个** 合适的 **配置文件**，但只有 **有效的一个会有一些相关的进程**（这是因为提取进程需要正确的 KDBG 地址）。
|
||
```bash
|
||
# GOOD
|
||
PsActiveProcessHead : 0xfffff800011977f0 (37 processes)
|
||
PsLoadedModuleList : 0xfffff8000119aae0 (116 modules)
|
||
```
|
||
|
||
```bash
|
||
# BAD
|
||
PsActiveProcessHead : 0xfffff800011947f0 (0 processes)
|
||
PsLoadedModuleList : 0xfffff80001197ac0 (0 modules)
|
||
```
|
||
#### KDBG
|
||
|
||
**内核调试器块**，在 Volatility 中称为 **KDBG**，对于 Volatility 和各种调试器执行的取证任务至关重要。它被识别为 `KdDebuggerDataBlock`，类型为 `_KDDEBUGGER_DATA64`，包含重要的引用，如 `PsActiveProcessHead`。这个特定的引用指向进程列表的头部，使得能够列出所有进程，这对于全面的内存分析是基础。
|
||
|
||
## OS 信息
|
||
```bash
|
||
#vol3 has a plugin to give OS information (note that imageinfo from vol2 will give you OS info)
|
||
./vol.py -f file.dmp windows.info.Info
|
||
```
|
||
插件 `banners.Banners` 可用于 **vol3 尝试在转储中查找 Linux 横幅**。
|
||
|
||
## 哈希/密码
|
||
|
||
提取 SAM 哈希、[域缓存凭据](../../../windows-hardening/stealing-credentials/credentials-protections.md#cached-credentials) 和 [lsa 秘密](../../../windows-hardening/authentication-credentials-uac-and-efs/#lsa-secrets)。
|
||
|
||
{{#tabs}}
|
||
{{#tab name="vol3"}}
|
||
```bash
|
||
./vol.py -f file.dmp windows.hashdump.Hashdump #Grab common windows hashes (SAM+SYSTEM)
|
||
./vol.py -f file.dmp windows.cachedump.Cachedump #Grab domain cache hashes inside the registry
|
||
./vol.py -f file.dmp windows.lsadump.Lsadump #Grab lsa secrets
|
||
```
|
||
{{#endtab}}
|
||
|
||
{{#tab name="vol2"}}
|
||
```bash
|
||
volatility --profile=Win7SP1x86_23418 hashdump -f file.dmp #Grab common windows hashes (SAM+SYSTEM)
|
||
volatility --profile=Win7SP1x86_23418 cachedump -f file.dmp #Grab domain cache hashes inside the registry
|
||
volatility --profile=Win7SP1x86_23418 lsadump -f file.dmp #Grab lsa secrets
|
||
```
|
||
{{#endtab}}
|
||
{{#endtabs}}
|
||
|
||
## 内存转储
|
||
|
||
进程的内存转储将**提取当前进程状态的所有内容**。**procdump**模块将仅**提取****代码**。
|
||
```
|
||
volatility -f file.dmp --profile=Win7SP1x86 memdump -p 2168 -D conhost/
|
||
```
|
||
## 进程
|
||
|
||
### 列出进程
|
||
|
||
尝试查找 **可疑** 进程（通过名称）或 **意外** 子 **进程**（例如 cmd.exe 作为 iexplorer.exe 的子进程）。\
|
||
比较 pslist 的结果与 psscan 的结果，以识别隐藏进程可能会很有趣。
|
||
|
||
{{#tabs}}
|
||
{{#tab name="vol3"}}
|
||
```bash
|
||
python3 vol.py -f file.dmp windows.pstree.PsTree # Get processes tree (not hidden)
|
||
python3 vol.py -f file.dmp windows.pslist.PsList # Get process list (EPROCESS)
|
||
python3 vol.py -f file.dmp windows.psscan.PsScan # Get hidden process list(malware)
|
||
```
|
||
{{#endtab}}
|
||
|
||
{{#tab name="vol2"}}
|
||
```bash
|
||
volatility --profile=PROFILE pstree -f file.dmp # Get process tree (not hidden)
|
||
volatility --profile=PROFILE pslist -f file.dmp # Get process list (EPROCESS)
|
||
volatility --profile=PROFILE psscan -f file.dmp # Get hidden process list(malware)
|
||
volatility --profile=PROFILE psxview -f file.dmp # Get hidden process list
|
||
```
|
||
{{#endtab}}
|
||
{{#endtabs}}
|
||
|
||
### 转储进程
|
||
|
||
{{#tabs}}
|
||
{{#tab name="vol3"}}
|
||
```bash
|
||
./vol.py -f file.dmp windows.dumpfiles.DumpFiles --pid <pid> #Dump the .exe and dlls of the process in the current directory
|
||
```
|
||
{{#endtab}}
|
||
|
||
{{#tab name="vol2"}}
|
||
```bash
|
||
volatility --profile=Win7SP1x86_23418 procdump --pid=3152 -n --dump-dir=. -f file.dmp
|
||
```
|
||
{{#endtab}}
|
||
{{#endtabs}}
|
||
|
||
### 命令行
|
||
|
||
是否执行了任何可疑的操作？
|
||
|
||
{{#tabs}}
|
||
{{#tab name="vol3"}}
|
||
```bash
|
||
python3 vol.py -f file.dmp windows.cmdline.CmdLine #Display process command-line arguments
|
||
```
|
||
{{#endtab}}
|
||
|
||
{{#tab name="vol2"}}
|
||
```bash
|
||
volatility --profile=PROFILE cmdline -f file.dmp #Display process command-line arguments
|
||
volatility --profile=PROFILE consoles -f file.dmp #command history by scanning for _CONSOLE_INFORMATION
|
||
```
|
||
{{#endtab}}
|
||
{{#endtabs}}
|
||
|
||
在 `cmd.exe` 中执行的命令由 **`conhost.exe`**（或在 Windows 7 之前的系统上为 `csrss.exe`）管理。这意味着如果 **`cmd.exe`** 在获取内存转储之前被攻击者终止，仍然可以从 **`conhost.exe`** 的内存中恢复会话的命令历史记录。为此，如果在控制台的模块中检测到异常活动，则应转储相关 **`conhost.exe`** 进程的内存。然后，通过在此转储中搜索 **strings**，可以提取会话中使用的命令行。
|
||
|
||
### 环境
|
||
|
||
获取每个运行进程的环境变量。可能会有一些有趣的值。
|
||
|
||
{{#tabs}}
|
||
{{#tab name="vol3"}}
|
||
```bash
|
||
python3 vol.py -f file.dmp windows.envars.Envars [--pid <pid>] #Display process environment variables
|
||
```
|
||
{{#endtab}}
|
||
|
||
{{#tab name="vol2"}}
|
||
```bash
|
||
volatility --profile=PROFILE envars -f file.dmp [--pid <pid>] #Display process environment variables
|
||
|
||
volatility --profile=PROFILE -f file.dmp linux_psenv [-p <pid>] #Get env of process. runlevel var means the runlevel where the proc is initated
|
||
```
|
||
{{#endtab}}
|
||
{{#endtabs}}
|
||
|
||
### 令牌权限
|
||
|
||
检查意外服务中的权限令牌。\
|
||
列出使用某些特权令牌的进程可能会很有趣。
|
||
|
||
{{#tabs}}
|
||
{{#tab name="vol3"}}
|
||
```bash
|
||
#Get enabled privileges of some processes
|
||
python3 vol.py -f file.dmp windows.privileges.Privs [--pid <pid>]
|
||
#Get all processes with interesting privileges
|
||
python3 vol.py -f file.dmp windows.privileges.Privs | grep "SeImpersonatePrivilege\|SeAssignPrimaryPrivilege\|SeTcbPrivilege\|SeBackupPrivilege\|SeRestorePrivilege\|SeCreateTokenPrivilege\|SeLoadDriverPrivilege\|SeTakeOwnershipPrivilege\|SeDebugPrivilege"
|
||
```
|
||
{{#endtab}}
|
||
|
||
{{#tab name="vol2"}}
|
||
```bash
|
||
#Get enabled privileges of some processes
|
||
volatility --profile=Win7SP1x86_23418 privs --pid=3152 -f file.dmp | grep Enabled
|
||
#Get all processes with interesting privileges
|
||
volatility --profile=Win7SP1x86_23418 privs -f file.dmp | grep "SeImpersonatePrivilege\|SeAssignPrimaryPrivilege\|SeTcbPrivilege\|SeBackupPrivilege\|SeRestorePrivilege\|SeCreateTokenPrivilege\|SeLoadDriverPrivilege\|SeTakeOwnershipPrivilege\|SeDebugPrivilege"
|
||
```
|
||
{{#endtab}}
|
||
{{#endtabs}}
|
||
|
||
### SIDs
|
||
|
||
检查每个由进程拥有的SSID。\
|
||
列出使用特权SID的进程（以及使用某些服务SID的进程）可能会很有趣。
|
||
|
||
{{#tabs}}
|
||
{{#tab name="vol3"}}
|
||
```bash
|
||
./vol.py -f file.dmp windows.getsids.GetSIDs [--pid <pid>] #Get SIDs of processes
|
||
./vol.py -f file.dmp windows.getservicesids.GetServiceSIDs #Get the SID of services
|
||
```
|
||
{{#endtab}}
|
||
|
||
{{#tab name="vol2"}}
|
||
```bash
|
||
volatility --profile=Win7SP1x86_23418 getsids -f file.dmp #Get the SID owned by each process
|
||
volatility --profile=Win7SP1x86_23418 getservicesids -f file.dmp #Get the SID of each service
|
||
```
|
||
{{#endtab}}
|
||
{{#endtabs}}
|
||
|
||
### 句柄
|
||
|
||
了解一个 **进程拥有的句柄**（已打开）指向哪些其他文件、密钥、线程、进程... 是很有用的
|
||
|
||
{{#tabs}}
|
||
{{#tab name="vol3"}}
|
||
```bash
|
||
vol.py -f file.dmp windows.handles.Handles [--pid <pid>]
|
||
```
|
||
{{#endtab}}
|
||
|
||
{{#tab name="vol2"}}
|
||
```bash
|
||
volatility --profile=Win7SP1x86_23418 -f file.dmp handles [--pid=<pid>]
|
||
```
|
||
{{#endtab}}
|
||
{{#endtabs}}
|
||
|
||
### DLLs
|
||
|
||
{{#tabs}}
|
||
{{#tab name="vol3"}}
|
||
```bash
|
||
./vol.py -f file.dmp windows.dlllist.DllList [--pid <pid>] #List dlls used by each
|
||
./vol.py -f file.dmp windows.dumpfiles.DumpFiles --pid <pid> #Dump the .exe and dlls of the process in the current directory process
|
||
```
|
||
{{#endtab}}
|
||
|
||
{{#tab name="vol2"}}
|
||
```bash
|
||
volatility --profile=Win7SP1x86_23418 dlllist --pid=3152 -f file.dmp #Get dlls of a proc
|
||
volatility --profile=Win7SP1x86_23418 dlldump --pid=3152 --dump-dir=. -f file.dmp #Dump dlls of a proc
|
||
```
|
||
{{#endtab}}
|
||
{{#endtabs}}
|
||
|
||
### 每个进程的字符串
|
||
|
||
Volatility 允许我们检查一个字符串属于哪个进程。
|
||
|
||
{{#tabs}}
|
||
{{#tab name="vol3"}}
|
||
```bash
|
||
strings file.dmp > /tmp/strings.txt
|
||
./vol.py -f /tmp/file.dmp windows.strings.Strings --strings-file /tmp/strings.txt
|
||
```
|
||
{{#endtab}}
|
||
|
||
{{#tab name="vol2"}}
|
||
```bash
|
||
strings file.dmp > /tmp/strings.txt
|
||
volatility -f /tmp/file.dmp windows.strings.Strings --string-file /tmp/strings.txt
|
||
|
||
volatility -f /tmp/file.dmp --profile=Win81U1x64 memdump -p 3532 --dump-dir .
|
||
strings 3532.dmp > strings_file
|
||
```
|
||
{{#endtab}}
|
||
{{#endtabs}}
|
||
|
||
它还允许使用 yarascan 模块在进程中搜索字符串：
|
||
|
||
{{#tabs}}
|
||
{{#tab name="vol3"}}
|
||
```bash
|
||
./vol.py -f file.dmp windows.vadyarascan.VadYaraScan --yara-rules "https://" --pid 3692 3840 3976 3312 3084 2784
|
||
./vol.py -f file.dmp yarascan.YaraScan --yara-rules "https://"
|
||
```
|
||
{{#endtab}}
|
||
|
||
{{#tab name="vol2"}}
|
||
```bash
|
||
volatility --profile=Win7SP1x86_23418 yarascan -Y "https://" -p 3692,3840,3976,3312,3084,2784
|
||
```
|
||
{{#endtab}}
|
||
{{#endtabs}}
|
||
|
||
### UserAssist
|
||
|
||
**Windows** 通过注册表中的一个功能 **UserAssist keys** 跟踪您运行的程序。这些键记录每个程序执行的次数以及最后一次运行的时间。
|
||
|
||
{{#tabs}}
|
||
{{#tab name="vol3"}}
|
||
```bash
|
||
./vol.py -f file.dmp windows.registry.userassist.UserAssist
|
||
```
|
||
{{#endtab}}
|
||
|
||
{{#tab name="vol2"}}
|
||
```
|
||
volatility --profile=Win7SP1x86_23418 -f file.dmp userassist
|
||
```
|
||
{{#endtab}}
|
||
{{#endtabs}}
|
||
|
||
|
||
|
||
|
||
## 服务
|
||
|
||
{{#tabs}}
|
||
{{#tab name="vol3"}}
|
||
```bash
|
||
./vol.py -f file.dmp windows.svcscan.SvcScan #List services
|
||
./vol.py -f file.dmp windows.getservicesids.GetServiceSIDs #Get the SID of services
|
||
```
|
||
{{#endtab}}
|
||
|
||
{{#tab name="vol2"}}
|
||
```bash
|
||
#Get services and binary path
|
||
volatility --profile=Win7SP1x86_23418 svcscan -f file.dmp
|
||
#Get name of the services and SID (slow)
|
||
volatility --profile=Win7SP1x86_23418 getservicesids -f file.dmp
|
||
```
|
||
{{#endtab}}
|
||
{{#endtabs}}
|
||
|
||
## 网络
|
||
|
||
{{#tabs}}
|
||
{{#tab name="vol3"}}
|
||
```bash
|
||
./vol.py -f file.dmp windows.netscan.NetScan
|
||
#For network info of linux use volatility2
|
||
```
|
||
{{#endtab}}
|
||
|
||
{{#tab name="vol2"}}
|
||
```bash
|
||
volatility --profile=Win7SP1x86_23418 netscan -f file.dmp
|
||
volatility --profile=Win7SP1x86_23418 connections -f file.dmp#XP and 2003 only
|
||
volatility --profile=Win7SP1x86_23418 connscan -f file.dmp#TCP connections
|
||
volatility --profile=Win7SP1x86_23418 sockscan -f file.dmp#Open sockets
|
||
volatility --profile=Win7SP1x86_23418 sockets -f file.dmp#Scanner for tcp socket objects
|
||
|
||
volatility --profile=SomeLinux -f file.dmp linux_ifconfig
|
||
volatility --profile=SomeLinux -f file.dmp linux_netstat
|
||
volatility --profile=SomeLinux -f file.dmp linux_netfilter
|
||
volatility --profile=SomeLinux -f file.dmp linux_arp #ARP table
|
||
volatility --profile=SomeLinux -f file.dmp linux_list_raw #Processes using promiscuous raw sockets (comm between processes)
|
||
volatility --profile=SomeLinux -f file.dmp linux_route_cache
|
||
```
|
||
{{#endtab}}
|
||
{{#endtabs}}
|
||
|
||
## 注册表蜂巢
|
||
|
||
### 打印可用的蜂巢
|
||
|
||
{{#tabs}}
|
||
{{#tab name="vol3"}}
|
||
```bash
|
||
./vol.py -f file.dmp windows.registry.hivelist.HiveList #List roots
|
||
./vol.py -f file.dmp windows.registry.printkey.PrintKey #List roots and get initial subkeys
|
||
```
|
||
{{#endtab}}
|
||
|
||
{{#tab name="vol2"}}
|
||
```bash
|
||
volatility --profile=Win7SP1x86_23418 -f file.dmp hivelist #List roots
|
||
volatility --profile=Win7SP1x86_23418 -f file.dmp printkey #List roots and get initial subkeys
|
||
```
|
||
{{#endtab}}
|
||
{{#endtabs}}
|
||
|
||
### 获取一个值
|
||
|
||
{{#tabs}}
|
||
{{#tab name="vol3"}}
|
||
```bash
|
||
./vol.py -f file.dmp windows.registry.printkey.PrintKey --key "Software\Microsoft\Windows NT\CurrentVersion"
|
||
```
|
||
{{#endtab}}
|
||
|
||
{{#tab name="vol2"}}
|
||
```bash
|
||
volatility --profile=Win7SP1x86_23418 printkey -K "Software\Microsoft\Windows NT\CurrentVersion" -f file.dmp
|
||
# Get Run binaries registry value
|
||
volatility -f file.dmp --profile=Win7SP1x86 printkey -o 0x9670e9d0 -K 'Software\Microsoft\Windows\CurrentVersion\Run'
|
||
```
|
||
{{#endtab}}
|
||
{{#endtabs}}
|
||
|
||
### 转储
|
||
```bash
|
||
#Dump a hive
|
||
volatility --profile=Win7SP1x86_23418 hivedump -o 0x9aad6148 -f file.dmp #Offset extracted by hivelist
|
||
#Dump all hives
|
||
volatility --profile=Win7SP1x86_23418 hivedump -f file.dmp
|
||
```
|
||
## 文件系统
|
||
|
||
### 挂载
|
||
|
||
{{#tabs}}
|
||
{{#tab name="vol3"}}
|
||
```bash
|
||
#See vol2
|
||
```
|
||
{{#endtab}}
|
||
|
||
{{#tab name="vol2"}}
|
||
```bash
|
||
volatility --profile=SomeLinux -f file.dmp linux_mount
|
||
volatility --profile=SomeLinux -f file.dmp linux_recover_filesystem #Dump the entire filesystem (if possible)
|
||
```
|
||
{{#endtab}}
|
||
{{#endtabs}}
|
||
|
||
### 扫描/转储
|
||
|
||
{{#tabs}}
|
||
{{#tab name="vol3"}}
|
||
```bash
|
||
./vol.py -f file.dmp windows.filescan.FileScan #Scan for files inside the dump
|
||
./vol.py -f file.dmp windows.dumpfiles.DumpFiles --physaddr <0xAAAAA> #Offset from previous command
|
||
```
|
||
{{#endtab}}
|
||
|
||
{{#tab name="vol2"}}
|
||
```bash
|
||
volatility --profile=Win7SP1x86_23418 filescan -f file.dmp #Scan for files inside the dump
|
||
volatility --profile=Win7SP1x86_23418 dumpfiles -n --dump-dir=/tmp -f file.dmp #Dump all files
|
||
volatility --profile=Win7SP1x86_23418 dumpfiles -n --dump-dir=/tmp -Q 0x000000007dcaa620 -f file.dmp
|
||
|
||
volatility --profile=SomeLinux -f file.dmp linux_enumerate_files
|
||
volatility --profile=SomeLinux -f file.dmp linux_find_file -F /path/to/file
|
||
volatility --profile=SomeLinux -f file.dmp linux_find_file -i 0xINODENUMBER -O /path/to/dump/file
|
||
```
|
||
{{#endtab}}
|
||
{{#endtabs}}
|
||
|
||
### 主文件表
|
||
|
||
{{#tabs}}
|
||
{{#tab name="vol3"}}
|
||
```bash
|
||
# I couldn't find any plugin to extract this information in volatility3
|
||
```
|
||
{{#endtab}}
|
||
|
||
{{#tab name="vol2"}}
|
||
```bash
|
||
volatility --profile=Win7SP1x86_23418 mftparser -f file.dmp
|
||
```
|
||
{{#endtab}}
|
||
{{#endtabs}}
|
||
|
||
**NTFS 文件系统**使用一个关键组件，称为_主文件表_（MFT）。该表为卷上的每个文件至少包含一个条目，也包括 MFT 本身。关于每个文件的重要细节，如**大小、时间戳、权限和实际数据**，都封装在 MFT 条目中或在 MFT 外部但由这些条目引用的区域中。更多细节可以在[官方文档](https://docs.microsoft.com/en-us/windows/win32/fileio/master-file-table)中找到。
|
||
|
||
### SSL 密钥/证书
|
||
|
||
{{#tabs}}
|
||
{{#tab name="vol3"}}
|
||
```bash
|
||
#vol3 allows to search for certificates inside the registry
|
||
./vol.py -f file.dmp windows.registry.certificates.Certificates
|
||
```
|
||
{{#endtab}}
|
||
|
||
{{#tab name="vol2"}}
|
||
```bash
|
||
#vol2 allos you to search and dump certificates from memory
|
||
#Interesting options for this modules are: --pid, --name, --ssl
|
||
volatility --profile=Win7SP1x86_23418 dumpcerts --dump-dir=. -f file.dmp
|
||
```
|
||
{{#endtab}}
|
||
{{#endtabs}}
|
||
|
||
## 恶意软件
|
||
|
||
{{#tabs}}
|
||
{{#tab name="vol3"}}
|
||
```bash
|
||
./vol.py -f file.dmp windows.malfind.Malfind [--dump] #Find hidden and injected code, [dump each suspicious section]
|
||
#Malfind will search for suspicious structures related to malware
|
||
./vol.py -f file.dmp windows.driverirp.DriverIrp #Driver IRP hook detection
|
||
./vol.py -f file.dmp windows.ssdt.SSDT #Check system call address from unexpected addresses
|
||
|
||
./vol.py -f file.dmp linux.check_afinfo.Check_afinfo #Verifies the operation function pointers of network protocols
|
||
./vol.py -f file.dmp linux.check_creds.Check_creds #Checks if any processes are sharing credential structures
|
||
./vol.py -f file.dmp linux.check_idt.Check_idt #Checks if the IDT has been altered
|
||
./vol.py -f file.dmp linux.check_syscall.Check_syscall #Check system call table for hooks
|
||
./vol.py -f file.dmp linux.check_modules.Check_modules #Compares module list to sysfs info, if available
|
||
./vol.py -f file.dmp linux.tty_check.tty_check #Checks tty devices for hooks
|
||
```
|
||
{{#endtab}}
|
||
|
||
{{#tab name="vol2"}}
|
||
```bash
|
||
volatility --profile=Win7SP1x86_23418 -f file.dmp malfind [-D /tmp] #Find hidden and injected code [dump each suspicious section]
|
||
volatility --profile=Win7SP1x86_23418 -f file.dmp apihooks #Detect API hooks in process and kernel memory
|
||
volatility --profile=Win7SP1x86_23418 -f file.dmp driverirp #Driver IRP hook detection
|
||
volatility --profile=Win7SP1x86_23418 -f file.dmp ssdt #Check system call address from unexpected addresses
|
||
|
||
volatility --profile=SomeLinux -f file.dmp linux_check_afinfo
|
||
volatility --profile=SomeLinux -f file.dmp linux_check_creds
|
||
volatility --profile=SomeLinux -f file.dmp linux_check_fop
|
||
volatility --profile=SomeLinux -f file.dmp linux_check_idt
|
||
volatility --profile=SomeLinux -f file.dmp linux_check_syscall
|
||
volatility --profile=SomeLinux -f file.dmp linux_check_modules
|
||
volatility --profile=SomeLinux -f file.dmp linux_check_tty
|
||
volatility --profile=SomeLinux -f file.dmp linux_keyboard_notifiers #Keyloggers
|
||
```
|
||
{{#endtab}}
|
||
{{#endtabs}}
|
||
|
||
### 使用 yara 扫描
|
||
|
||
使用此脚本从 github 下载并合并所有 yara 恶意软件规则: [https://gist.github.com/andreafortuna/29c6ea48adf3d45a979a78763cdc7ce9](https://gist.github.com/andreafortuna/29c6ea48adf3d45a979a78763cdc7ce9)\
|
||
创建 _**rules**_ 目录并执行它。这将创建一个名为 _**malware_rules.yar**_ 的文件，其中包含所有恶意软件的 yara 规则。
|
||
|
||
{{#tabs}}
|
||
{{#tab name="vol3"}}
|
||
```bash
|
||
wget https://gist.githubusercontent.com/andreafortuna/29c6ea48adf3d45a979a78763cdc7ce9/raw/4ec711d37f1b428b63bed1f786b26a0654aa2f31/malware_yara_rules.py
|
||
mkdir rules
|
||
python malware_yara_rules.py
|
||
#Only Windows
|
||
./vol.py -f file.dmp windows.vadyarascan.VadYaraScan --yara-file /tmp/malware_rules.yar
|
||
#All
|
||
./vol.py -f file.dmp yarascan.YaraScan --yara-file /tmp/malware_rules.yar
|
||
```
|
||
{{#endtab}}
|
||
|
||
{{#tab name="vol2"}}
|
||
```bash
|
||
wget https://gist.githubusercontent.com/andreafortuna/29c6ea48adf3d45a979a78763cdc7ce9/raw/4ec711d37f1b428b63bed1f786b26a0654aa2f31/malware_yara_rules.py
|
||
mkdir rules
|
||
python malware_yara_rules.py
|
||
volatility --profile=Win7SP1x86_23418 yarascan -y malware_rules.yar -f ch2.dmp | grep "Rule:" | grep -v "Str_Win32" | sort | uniq
|
||
```
|
||
{{#endtab}}
|
||
{{#endtabs}}
|
||
|
||
## 杂项
|
||
|
||
### 外部插件
|
||
|
||
如果您想使用外部插件，请确保与插件相关的文件夹是第一个使用的参数。
|
||
|
||
{{#tabs}}
|
||
{{#tab name="vol3"}}
|
||
```bash
|
||
./vol.py --plugin-dirs "/tmp/plugins/" [...]
|
||
```
|
||
{{#endtab}}
|
||
|
||
{{#tab name="vol2"}}
|
||
```bash
|
||
volatilitye --plugins="/tmp/plugins/" [...]
|
||
```
|
||
{{#endtab}}
|
||
{{#endtabs}}
|
||
|
||
#### Autoruns
|
||
|
||
从 [https://github.com/tomchop/volatility-autoruns](https://github.com/tomchop/volatility-autoruns) 下载
|
||
```
|
||
volatility --plugins=volatility-autoruns/ --profile=WinXPSP2x86 -f file.dmp autoruns
|
||
```
|
||
### 互斥锁
|
||
|
||
{{#tabs}}
|
||
{{#tab name="vol3"}}
|
||
```
|
||
./vol.py -f file.dmp windows.mutantscan.MutantScan
|
||
```
|
||
{{#endtab}}
|
||
|
||
{{#tab name="vol2"}}
|
||
```bash
|
||
volatility --profile=Win7SP1x86_23418 mutantscan -f file.dmp
|
||
volatility --profile=Win7SP1x86_23418 -f file.dmp handles -p <PID> -t mutant
|
||
```
|
||
{{#endtab}}
|
||
{{#endtabs}}
|
||
|
||
### 符号链接
|
||
|
||
{{#tabs}}
|
||
{{#tab name="vol3"}}
|
||
```bash
|
||
./vol.py -f file.dmp windows.symlinkscan.SymlinkScan
|
||
```
|
||
{{#endtab}}
|
||
|
||
{{#tab name="vol2"}}
|
||
```bash
|
||
volatility --profile=Win7SP1x86_23418 -f file.dmp symlinkscan
|
||
```
|
||
{{#endtab}}
|
||
{{#endtabs}}
|
||
|
||
### Bash
|
||
|
||
可以**从内存中读取 bash 历史记录。** 你也可以转储 _.bash_history_ 文件，但它已被禁用，你会很高兴可以使用这个 volatility 模块。
|
||
|
||
{{#tabs}}
|
||
{{#tab name="vol3"}}
|
||
```
|
||
./vol.py -f file.dmp linux.bash.Bash
|
||
```
|
||
{{#endtab}}
|
||
|
||
{{#tab name="vol2"}}
|
||
```
|
||
volatility --profile=Win7SP1x86_23418 -f file.dmp linux_bash
|
||
```
|
||
{{#endtab}}
|
||
{{#endtabs}}
|
||
|
||
### 时间线
|
||
|
||
{{#tabs}}
|
||
{{#tab name="vol3"}}
|
||
```bash
|
||
./vol.py -f file.dmp timeLiner.TimeLiner
|
||
```
|
||
{{#endtab}}
|
||
|
||
{{#tab name="vol2"}}
|
||
```
|
||
volatility --profile=Win7SP1x86_23418 -f timeliner
|
||
```
|
||
{{#endtab}}
|
||
{{#endtabs}}
|
||
|
||
### 驱动程序
|
||
|
||
{{#tabs}}
|
||
{{#tab name="vol3"}}
|
||
```
|
||
./vol.py -f file.dmp windows.driverscan.DriverScan
|
||
```
|
||
{{#endtab}}
|
||
|
||
{{#tab name="vol2"}}
|
||
```bash
|
||
volatility --profile=Win7SP1x86_23418 -f file.dmp driverscan
|
||
```
|
||
{{#endtab}}
|
||
{{#endtabs}}
|
||
|
||
### 获取剪贴板
|
||
```bash
|
||
#Just vol2
|
||
volatility --profile=Win7SP1x86_23418 clipboard -f file.dmp
|
||
```
|
||
### 获取IE历史记录
|
||
```bash
|
||
#Just vol2
|
||
volatility --profile=Win7SP1x86_23418 iehistory -f file.dmp
|
||
```
|
||
### 获取记事本文本
|
||
```bash
|
||
#Just vol2
|
||
volatility --profile=Win7SP1x86_23418 notepad -f file.dmp
|
||
```
|
||
### 截图
|
||
```bash
|
||
#Just vol2
|
||
volatility --profile=Win7SP1x86_23418 screenshot -f file.dmp
|
||
```
|
||
### 主引导记录 (MBR)
|
||
```bash
|
||
volatility --profile=Win7SP1x86_23418 mbrparser -f file.dmp
|
||
```
|
||
**主引导记录 (MBR)** 在管理存储介质的逻辑分区中发挥着至关重要的作用，这些分区采用不同的 [文件系统](https://en.wikipedia.org/wiki/File_system) 进行结构化。它不仅包含分区布局信息，还包含作为引导加载程序的可执行代码。该引导加载程序要么直接启动操作系统的二阶段加载过程（参见 [二阶段引导加载程序](https://en.wikipedia.org/wiki/Second-stage_boot_loader)），要么与每个分区的 [卷引导记录](https://en.wikipedia.org/wiki/Volume_boot_record) (VBR) 协同工作。有关深入知识，请参阅 [MBR 维基百科页面](https://en.wikipedia.org/wiki/Master_boot_record)。
|
||
|
||
## 参考文献
|
||
|
||
- [https://andreafortuna.org/2017/06/25/volatility-my-own-cheatsheet-part-1-image-identification/](https://andreafortuna.org/2017/06/25/volatility-my-own-cheatsheet-part-1-image-identification/)
|
||
- [https://scudette.blogspot.com/2012/11/finding-kernel-debugger-block.html](https://scudette.blogspot.com/2012/11/finding-kernel-debugger-block.html)
|
||
- [https://or10nlabs.tech/cgi-sys/suspendedpage.cgi](https://or10nlabs.tech/cgi-sys/suspendedpage.cgi)
|
||
- [https://www.aldeid.com/wiki/Windows-userassist-keys](https://www.aldeid.com/wiki/Windows-userassist-keys) \* [https://learn.microsoft.com/en-us/windows/win32/fileio/master-file-table](https://learn.microsoft.com/en-us/windows/win32/fileio/master-file-table)
|
||
- [https://answers.microsoft.com/en-us/windows/forum/all/uefi-based-pc-protective-mbr-what-is-it/0fc7b558-d8d4-4a7d-bae2-395455bb19aa](https://answers.microsoft.com/en-us/windows/forum/all/uefi-based-pc-protective-mbr-what-is-it/0fc7b558-d8d4-4a7d-bae2-395455bb19aa)
|
||
|
||
{{#include ../../../banners/hacktricks-training.md}}
|