Volatility - CheatSheet

Reading time: 21 minutes

tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

​

Ikiwa unahitaji chombo kinachoweza kujiendesha kwa uchambuzi wa kumbukumbu kwa viwango tofauti vya skana na kuendesha plugins nyingi za Volatility3 kwa wakati mmoja, unaweza kutumia autoVolatility3:: https://github.com/H3xKatana/autoVolatility3/

bash
# Full scan (runs all plugins)
python3 autovol3.py -f MEMFILE -o OUT_DIR -s full

# Minimal scan (runs a limited set of plugins)
python3 autovol3.py -f MEMFILE -o OUT_DIR -s minimal

# Normal scan (runs a balanced set of plugins)
python3 autovol3.py -f MEMFILE -o OUT_DIR -s normal

Ikiwa unataka kitu haraka na cha ajabu ambacho kitazindua plugins kadhaa za Volatility kwa pamoja unaweza kutumia: https://github.com/carlospolop/autoVolatility

bash
python autoVolatility.py -f MEMFILE -d OUT_DIRECTORY -e /home/user/tools/volatility/vol.py # It will use the most important plugins (could use a lot of space depending on the size of the memory)

Installation

volatility3

bash
git clone https://github.com/volatilityfoundation/volatility3.git
cd volatility3
python3 setup.py install
python3 vol.py —h

volatility2

Download the executable from https://www.volatilityfoundation.org/26

Amri za Volatility

Fikia hati rasmi katika Volatility command reference

Kumbukumbu kuhusu plugins “list” vs. “scan”

Volatility ina mbinu mbili kuu za plugins, ambazo wakati mwingine zinaonekana katika majina yao. Plugins “list” zitajaribu kuvinjari kupitia muundo wa Windows Kernel ili kupata taarifa kama vile michakato (kupata na kutembea kwenye orodha iliyounganishwa ya _EPROCESS katika kumbukumbu), kushughulikia OS (kupata na kuorodhesha jedwali la kushughulikia, kuondoa viashiria vyovyote vilivyopatikana, nk). Zinajitahidi kutenda kama API ya Windows ingekuwa ikiwa itaombwa, kwa mfano, kuorodhesha michakato.

Hiyo inafanya plugins “list” kuwa za haraka, lakini pia zina hatari kama API ya Windows kwa ushawishi wa malware. Kwa mfano, ikiwa malware inatumia DKOM kuondoa mchakato kutoka kwenye orodha iliyounganishwa ya _EPROCESS, haitajitokeza katika Meneja wa Kazi wala katika pslist.

Plugins “scan”, kwa upande mwingine, zitachukua mbinu inayofanana na kuchonga kumbukumbu kwa vitu ambavyo vinaweza kuwa na maana wakati vinapondolewa kama muundo maalum. psscan kwa mfano itasoma kumbukumbu na kujaribu kutengeneza vitu vya _EPROCESS kutoka kwake (inatumia skanning ya pool-tag, ambayo inatafuta nyuzi za 4-byte zinazonyesha uwepo wa muundo wa interest). Faida ni kwamba inaweza kupata michakato ambayo imeondoka, na hata kama malware inaharibu orodha iliyounganishwa ya _EPROCESS, plugin bado itapata muundo huo ukiwa katika kumbukumbu (kwa kuwa bado inahitaji kuwepo ili mchakato ufanye kazi). Hasara ni kwamba plugins “scan” ni polepole kidogo kuliko plugins “list”, na wakati mwingine zinaweza kutoa matokeo yasiyo sahihi (mchakato ambao umeondoka kwa muda mrefu sana na sehemu za muundo wake zimeandikwa upya na operesheni nyingine).

Kutoka: http://tomchop.me/2016/11/21/tutorial-volatility-plugins-malware-analysis/

Profaili za OS

Volatility3

Kama ilivyoelezwa ndani ya readme unahitaji kuweka meza ya alama ya OS unayotaka kusaidia ndani ya volatility3/volatility/symbols.
Pakiti za meza za alama za mifumo mbalimbali ya uendeshaji zinapatikana kwa kupakua katika:

Volatility2

Profaili za Nje

Unaweza kupata orodha ya profaili zinazosaidiwa kwa kufanya:

bash
./volatility_2.6_lin64_standalone --info | grep "Profile"

Ikiwa unataka kutumia wasifu mpya ulio pakuliwa (kwa mfano wa linux) unahitaji kuunda mahali fulani muundo wa folda ufuatao: plugins/overlays/linux na kuweka ndani ya folda hii faili ya zip inayoshikilia wasifu. Kisha, pata nambari ya wasifu kwa kutumia:

bash
./vol --plugins=/home/kali/Desktop/ctfs/final/plugins --info
Volatility Foundation Volatility Framework 2.6


Profiles
--------
LinuxCentOS7_3_10_0-123_el7_x86_64_profilex64 - A Profile for Linux CentOS7_3.10.0-123.el7.x86_64_profile x64
VistaSP0x64                                   - A Profile for Windows Vista SP0 x64
VistaSP0x86                                   - A Profile for Windows Vista SP0 x86

Unaweza kupakua profaili za Linux na Mac kutoka https://github.com/volatilityfoundation/profiles

Katika kipande kilichopita unaweza kuona kwamba profaili inaitwa LinuxCentOS7_3_10_0-123_el7_x86_64_profilex64, na unaweza kuitumia kutekeleza kitu kama:

bash
./vol -f file.dmp --plugins=. --profile=LinuxCentOS7_3_10_0-123_el7_x86_64_profilex64 linux_netscan

Gundua Profaili

volatility imageinfo -f file.dmp
volatility kdbgscan -f file.dmp

Tofauti kati ya imageinfo na kdbgscan

Kutoka hapa: Kinyume na imageinfo ambayo inatoa tu mapendekezo ya wasifu, kdbgscan imeundwa kubaini kwa uhakika wasifu sahihi na anwani sahihi ya KDBG (ikiwa kuna nyingi). Plugin hii inatafuta saini za KDBGHeader zinazohusiana na wasifu wa Volatility na inatekeleza ukaguzi wa akili ili kupunguza matokeo yasiyo sahihi. Ufanisi wa matokeo na idadi ya ukaguzi wa akili wanaoweza kufanywa inategemea ikiwa Volatility inaweza kupata DTB, hivyo ikiwa tayari unajua wasifu sahihi (au ikiwa una pendekezo la wasifu kutoka imageinfo), basi hakikisha unalitumia kutoka .

Daima angalia idadi ya michakato ambayo kdbgscan imepata. Wakati mwingine imageinfo na kdbgscan zinaweza kupata zaidi ya moja wasifu unaofaa lakini tu ule halali utakuwa na mchakato wowote unaohusiana (Hii ni kwa sababu ili kutoa michakato anwani sahihi ya KDBG inahitajika)

bash
# GOOD
PsActiveProcessHead           : 0xfffff800011977f0 (37 processes)
PsLoadedModuleList            : 0xfffff8000119aae0 (116 modules)
bash
# BAD
PsActiveProcessHead           : 0xfffff800011947f0 (0 processes)
PsLoadedModuleList            : 0xfffff80001197ac0 (0 modules)

KDBG

KDBG inaitwa kernel debugger block, ni muhimu kwa kazi za forensics zinazofanywa na Volatility na debuggers mbalimbali. Inatambulika kama KdDebuggerDataBlock na aina ya _KDDEBUGGER_DATA64, ina marejeleo muhimu kama PsActiveProcessHead. Marejeleo haya maalum yanaonyesha kichwa cha orodha ya michakato, kuruhusu orodha ya michakato yote, ambayo ni ya msingi kwa uchambuzi wa kina wa kumbukumbu.

OS Information

bash
#vol3 has a plugin to give OS information (note that imageinfo from vol2 will give you OS info)
./vol.py -f file.dmp windows.info.Info

Plugin banners.Banners inaweza kutumika katika vol3 kujaribu kupata mabango ya linux katika dump.

Hashes/Passwords

Toa SAM hashes, credentials za domain zilizohifadhiwa na siri za lsa.

bash
./vol.py -f file.dmp windows.hashdump.Hashdump #Grab common windows hashes (SAM+SYSTEM)
./vol.py -f file.dmp windows.cachedump.Cachedump #Grab domain cache hashes inside the registry
./vol.py -f file.dmp windows.lsadump.Lsadump #Grab lsa secrets

Memory Dump

Memory dump ya mchakato itatoa kila kitu cha hali ya sasa ya mchakato. Moduli ya procdump itatoa tu kanuni.

volatility -f file.dmp --profile=Win7SP1x86 memdump -p 2168 -D conhost/

Mchakato

Orodha ya michakato

Jaribu kutafuta michakato ya shaka (kwa jina) au michakato ya mtoto isiyotarajiwa (kwa mfano cmd.exe kama mtoto wa iexplorer.exe).
Inaweza kuwa ya kuvutia kulinganisha matokeo ya pslist na yale ya psscan ili kubaini michakato iliyofichwa.

bash
python3 vol.py -f file.dmp windows.pstree.PsTree # Get processes tree (not hidden)
python3 vol.py -f file.dmp windows.pslist.PsList # Get process list (EPROCESS)
python3 vol.py -f file.dmp windows.psscan.PsScan # Get hidden process list(malware)

Dump proc

bash
./vol.py -f file.dmp windows.dumpfiles.DumpFiles --pid <pid> #Dump the .exe and dlls of the process in the current directory

Command line

Je, kuna kitu chochote kinachoshuku kilitekelezwa?

bash
python3 vol.py -f file.dmp windows.cmdline.CmdLine #Display process command-line arguments

Amri zinazotekelezwa katika cmd.exe zinadhibitiwa na conhost.exe (au csrss.exe kwenye mifumo kabla ya Windows 7). Hii ina maana kwamba ikiwa cmd.exe itakatishwa na mshambuliaji kabla ya kupatikana kwa dump ya kumbukumbu, bado inawezekana kurejesha historia ya amri za kikao kutoka kwenye kumbukumbu ya conhost.exe. Ili kufanya hivyo, ikiwa shughuli zisizo za kawaida zinagundulika ndani ya moduli za console, kumbukumbu ya mchakato wa conhost.exe inayohusiana inapaswa kutolewa. Kisha, kwa kutafuta strings ndani ya dump hii, mistari ya amri zilizotumika katika kikao inaweza kutolewa.

Mazingira

Pata vigezo vya env vya kila mchakato unaotembea. Kunaweza kuwa na thamani za kuvutia.

bash
python3 vol.py -f file.dmp windows.envars.Envars [--pid <pid>] #Display process environment variables

Token privileges

Angalia kwa token za mamlaka katika huduma zisizotarajiwa.
Inaweza kuwa ya kuvutia kuorodhesha michakato inayotumia token fulani za mamlaka.

bash
#Get enabled privileges of some processes
python3 vol.py -f file.dmp windows.privileges.Privs [--pid <pid>]
#Get all processes with interesting privileges
python3 vol.py -f file.dmp windows.privileges.Privs | grep "SeImpersonatePrivilege\|SeAssignPrimaryPrivilege\|SeTcbPrivilege\|SeBackupPrivilege\|SeRestorePrivilege\|SeCreateTokenPrivilege\|SeLoadDriverPrivilege\|SeTakeOwnershipPrivilege\|SeDebugPrivilege"

SIDs

Angalia kila SSID inayomilikiwa na mchakato.
Inaweza kuwa ya kuvutia kuorodhesha michakato inayotumia SID ya ruhusa (na michakato inayotumia SID ya huduma).

bash
./vol.py -f file.dmp windows.getsids.GetSIDs [--pid <pid>] #Get SIDs of processes
./vol.py -f file.dmp windows.getservicesids.GetServiceSIDs #Get the SID of services

Handles

Ni muhimu kujua ni faili, funguo, nyuzi, michakato... zipi mchakato una mkono kwa ajili ya (amefungua)

bash
vol.py -f file.dmp windows.handles.Handles [--pid <pid>]

DLLs

bash
./vol.py -f file.dmp windows.dlllist.DllList [--pid <pid>] #List dlls used by each
./vol.py -f file.dmp windows.dumpfiles.DumpFiles --pid <pid> #Dump the .exe and dlls of the process in the current directory process

Mifumo ya nyuzi kwa michakato

Volatility inatuwezesha kuangalia ni mchakato gani nyuzi inahusiana nayo.

bash
strings file.dmp > /tmp/strings.txt
./vol.py -f /tmp/file.dmp windows.strings.Strings --strings-file /tmp/strings.txt

Inaruhusu pia kutafuta nyuzi ndani ya mchakato kwa kutumia moduli ya yarascan:

bash
./vol.py -f file.dmp windows.vadyarascan.VadYaraScan --yara-rules "https://" --pid 3692 3840 3976 3312 3084 2784
./vol.py -f file.dmp yarascan.YaraScan --yara-rules "https://"

UserAssist

Windows inashika rekodi ya programu unazotumia kwa kutumia kipengele katika rejista kinachoitwa UserAssist keys. Funguo hizi zinaandika ni mara ngapi kila programu imefanywa na wakati ilifanya mara ya mwisho.

bash
./vol.py -f file.dmp windows.registry.userassist.UserAssist

​

Huduma

bash
./vol.py -f file.dmp windows.svcscan.SvcScan #List services
./vol.py -f file.dmp windows.getservicesids.GetServiceSIDs #Get the SID of services

Mtandao

bash
./vol.py -f file.dmp windows.netscan.NetScan
#For network info of linux use volatility2

Registry hive

bash
./vol.py -f file.dmp windows.registry.hivelist.HiveList #List roots
./vol.py -f file.dmp windows.registry.printkey.PrintKey #List roots and get initial subkeys

Pata thamani

bash
./vol.py -f file.dmp windows.registry.printkey.PrintKey --key "Software\Microsoft\Windows NT\CurrentVersion"

Dump

bash
#Dump a hive
volatility --profile=Win7SP1x86_23418 hivedump -o 0x9aad6148 -f file.dmp #Offset extracted by hivelist
#Dump all hives
volatility --profile=Win7SP1x86_23418 hivedump -f file.dmp

Mfumo wa Faili

Pandisha

bash
#See vol2

Scan/dump

bash
./vol.py -f file.dmp windows.filescan.FileScan #Scan for files inside the dump
./vol.py -f file.dmp windows.dumpfiles.DumpFiles --physaddr <0xAAAAA> #Offset from previous command

Jedwali la Faili Kuu

bash
# I couldn't find any plugin to extract this information in volatility3

Mfumo wa NTFS unatumia kipengele muhimu kinachojulikana kama meza ya faili ya bwana (MFT). Meza hii ina angalau kiingilio kimoja kwa kila faili kwenye volumu, ikijumuisha MFT yenyewe pia. Maelezo muhimu kuhusu kila faili, kama vile ukubwa, alama za muda, ruhusa, na data halisi, yanajumuishwa ndani ya viingilio vya MFT au katika maeneo ya nje ya MFT lakini yanarejelea na viingilio hivi. Maelezo zaidi yanaweza kupatikana katika nyaraka rasmi.

Funguo za SSL/Certs

bash
#vol3 allows to search for certificates inside the registry
./vol.py -f file.dmp windows.registry.certificates.Certificates

Malware

bash
./vol.py -f file.dmp windows.malfind.Malfind [--dump] #Find hidden and injected code, [dump each suspicious section]
#Malfind will search for suspicious structures related to malware
./vol.py -f file.dmp windows.driverirp.DriverIrp #Driver IRP hook detection
./vol.py -f file.dmp windows.ssdt.SSDT #Check system call address from unexpected addresses

./vol.py -f file.dmp linux.check_afinfo.Check_afinfo #Verifies the operation function pointers of network protocols
./vol.py -f file.dmp linux.check_creds.Check_creds #Checks if any processes are sharing credential structures
./vol.py -f file.dmp linux.check_idt.Check_idt #Checks if the IDT has been altered
./vol.py -f file.dmp linux.check_syscall.Check_syscall #Check system call table for hooks
./vol.py -f file.dmp linux.check_modules.Check_modules #Compares module list to sysfs info, if available
./vol.py -f file.dmp linux.tty_check.tty_check #Checks tty devices for hooks

{{#endtab}}

{{#tab name="vol2"}}

bash
volatility --profile=Win7SP1x86_23418 -f file.dmp malfind [-D /tmp] #Find hidden and injected code [dump each suspicious section]
volatility --profile=Win7SP1x86_23418 -f file.dmp apihooks #Detect API hooks in process and kernel memory
volatility --profile=Win7SP1x86_23418 -f file.dmp driverirp #Driver IRP hook detection
volatility --profile=Win7SP1x86_23418 -f file.dmp ssdt #Check system call address from unexpected addresses

volatility --profile=SomeLinux -f file.dmp linux_check_afinfo
volatility --profile=SomeLinux -f file.dmp linux_check_creds
volatility --profile=SomeLinux -f file.dmp linux_check_fop
volatility --profile=SomeLinux -f file.dmp linux_check_idt
volatility --profile=SomeLinux -f file.dmp linux_check_syscall
volatility --profile=SomeLinux -f file.dmp linux_check_modules
volatility --profile=SomeLinux -f file.dmp linux_check_tty
volatility --profile=SomeLinux -f file.dmp linux_keyboard_notifiers #Keyloggers

{{#endtab}} {{#endtabs}}

Skanning na yara

Tumia skripti hii kupakua na kuunganisha sheria zote za yara malware kutoka github: https://gist.github.com/andreafortuna/29c6ea48adf3d45a979a78763cdc7ce9
Unda saraka ya rules na uifanye. Hii itaunda faili inayoitwa malware_rules.yar ambayo ina sheria zote za yara za malware.

bash
wget https://gist.githubusercontent.com/andreafortuna/29c6ea48adf3d45a979a78763cdc7ce9/raw/4ec711d37f1b428b63bed1f786b26a0654aa2f31/malware_yara_rules.py
mkdir rules
python malware_yara_rules.py
#Only Windows
./vol.py -f file.dmp windows.vadyarascan.VadYaraScan --yara-file /tmp/malware_rules.yar
#All
./vol.py -f file.dmp yarascan.YaraScan --yara-file /tmp/malware_rules.yar

MISC

Vionge vya nje

Ikiwa unataka kutumia vionge vya nje hakikisha kwamba folda zinazohusiana na vionge ni kipimo cha kwanza kinachotumika.

bash
./vol.py --plugin-dirs "/tmp/plugins/" [...]

Autoruns

Pakua kutoka https://github.com/tomchop/volatility-autoruns

volatility --plugins=volatility-autoruns/ --profile=WinXPSP2x86 -f file.dmp autoruns

Mutexes

./vol.py -f file.dmp windows.mutantscan.MutantScan
bash
./vol.py -f file.dmp windows.symlinkscan.SymlinkScan

Bash

Inawezekana kusoma kutoka kwa kumbukumbu historia ya bash. Unaweza pia kutupa faili ya .bash_history, lakini ilizuiliwa utashukuru unaweza kutumia moduli hii ya volatility

./vol.py -f file.dmp linux.bash.Bash

Muda

bash
./vol.py -f file.dmp timeLiner.TimeLiner

Madereva

./vol.py -f file.dmp windows.driverscan.DriverScan

{{#endtab}}

{{#tab name="vol2"}}

bash
volatility --profile=Win7SP1x86_23418 -f file.dmp driverscan

{{#endtab}} {{#endtabs}}

Pata clipboard

bash
#Just vol2
volatility --profile=Win7SP1x86_23418 clipboard -f file.dmp

Pata historia ya IE

bash
#Just vol2
volatility --profile=Win7SP1x86_23418 iehistory -f file.dmp

Pata maandiko ya notepad

bash
#Just vol2
volatility --profile=Win7SP1x86_23418 notepad -f file.dmp

Picha ya skrini

bash
#Just vol2
volatility --profile=Win7SP1x86_23418 screenshot -f file.dmp

Rekodi ya Kuanza ya Mwalimu (MBR)

bash
volatility --profile=Win7SP1x86_23418 mbrparser -f file.dmp

Master Boot Record (MBR) ina jukumu muhimu katika kusimamia sehemu za mantiki za kifaa cha kuhifadhi, ambazo zimeundwa na mifumo tofauti ya file systems. Haishikilii tu taarifa za mpangilio wa sehemu bali pia ina msimbo unaoweza kutekelezwa ukifanya kazi kama kipakiaji cha boot. Kipakiaji hiki cha boot kinanzisha moja kwa moja mchakato wa upakiaji wa hatua ya pili wa OS (tazama second-stage boot loader) au hufanya kazi kwa ushirikiano na volume boot record (VBR) ya kila sehemu. Kwa maarifa ya kina, rejelea MBR Wikipedia page.

References

tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks