Download volatility 2.6 from official website.
Go to that folder after extraction.
To find out list of profile:
./vol.py --info
To find out imageinfo:
./volatility -f jackobsPC.raw imageinfo (jackobsPC.raw memory dump file)
Sometimes the above command will return nothing. So try:
strings jackobsPC.raw | grep -i 'Linux version' | uniq (equivalent to uname -r command)
To find correct profiles using kdbgscan plugin:
/volatility -f jackobsPC.raw kdbgscan
To find out process list:
./volatility -f jackobsPC.raw --profile=Win7SP1x64 pslist
./volatility -f jackobsPC.raw --profile=Win7SP1x64 pslist -p 8560
./volatility -f jackobsPC.raw --profile=Win7SP1x64 pslist -P
To find out process tree in parent-child relationship manner:
./volatility -f jackobsPC.raw --profile=Win7SP1x64 pstree
without dot means main parent process
single dot means child process
double dot means further child process
To find out process scan: find out hidden process
./volatility -f jackobsPC.raw --profile=Win7SP1x64 psscan
To find out process is running on memory or not or hidden process used by malware. If the process is not listed in psActiveProcessHead then it could be an indicator that this is malware. If you see that true statement is present under pslist column then assume that processes are active in psActiveProcessHead, so no processes are hidden. If you see it false, then its an indicator of malicious activity:
./volatility -f jackobsPC.raw --profile=Win7SP1x64 psxview
To dump a process in current directory, sometimes you need to upload the malicious process to virustotal to check:
./volatility -f jackobsPC.raw --profile=Win7SP1x64 memdump -p 8560 -D .
./volatility -f ram.mem --profile=Win7SP1x64 memdump --dump-dir
/root/ramdump/
To find out what are the dll's added in specific process id:
./volatility -f ram.mem --profile=Win7SP1x64 dlllist -p 1116,788
./volatility -f ram.mem --profile=Win7SP1x64 dlllist (to list all the dll's)
You may wish to dump all the dll:
./volatility -f ram.mem --profile=Win7SP1x64 dlldump --dump-dir /root/dlldump/
Get sids of winlogon.exe with pid 464:
./volatility -f ram.mem --profile=Win7SP1x64 getsids -p 464
To dump the hash from the memory using hashdump:
./volatility -f ram.mem --profile=Win7SP1x64 getsids hashdump
To dump the hash from the memory using lsadump:
./volatility -f ram.mem --profile=Win7SP1x64 getsids lsadump
To find out network scan: If you are asked what is the malicious executable that is making network connection? then first use malfind plugin to find out the malicious exe then using that pid, search using netscan plugin.
ldrmodules: The ldrmodules command is used to identify memory-mapped PE files in a process's address space, cross-referencing their information with the three PEB lists: InLoad, InInit, and InMem. The InLoad list contains all loaded modules, the InInit list contains modules that require initialization, and the InMem list contains modules that have been fully initialized and are currently in memory.
When the ldrmodules command is executed, it checks if each memory-mapped PE file exists in any of the three PEB lists. If a file is not listed in any of the PEB lists, it means that it is not loaded by the process and may be a hidden or malicious DLL. If three of them appear as false then it is suspicious.
./volatility -f memory_dump.mem --profile=Win7SP1x64 ldrmodules
./volatility -f jackobsPC.raw --profile=Win7SP1x64 netscan
To find out connection scan:
./volatility -f jackobsPC.raw --profile=Win7SP1x64 connscan
In order to track of programs that are executed in the windows system, the windows system maintains a set of keys in the registry database. Those are called userassist keys. The number of execution and last execution data and time are available in these keys.
./volatility -f jackobsPC.raw --profile=Win7SP1x64 userassist
After running userassist command we found a suspicious file called notsuspicious.exe
File scan: File scan can also be run to find out malicious file or rootkits. It will tell you the offset value that will help in order to extract any suspicious files from mem dump to pc.
./volatility -f jackobsPC.raw --profile=Win7SP1x64 filescan
./volatility -f jackobsPC.raw --profile=Win7SP1x64 filescan | grep -i "notsuspicious.exe"
Now take a note of notsuspicious.exe files offset value.
Dump files: on current directory by mentioning dot
./volatility -f jackobsPC.raw --profile=Win7SP1x64 dumpfiles --dump-dir=. -Q 0x000000007f7cb980
Now corresponding files of that offset will be extracted. dump directory . (dot) means we want to dump in our current directory.
Svcscan to find service details: You can find any malicious service full details including image binary path, etc.
./volatility -f ram.mem --profile=Win7SP1x64 svcscan
Registry hive list:
./volatility -f jackobsPC.raw --profile=Win7SP1x64 hivelist (we can also extract the hive list)
./volatility -f jackobsPC.raw --profile=Win7SP1x64 printkey
From the above link, you will learn the usage of some important plugins i.e. kdbgscan (to get the correct profile), pslist, memdump (dump the malicious process), hivelist (to fetch info from system and software hive), mftparser (to uncover hidden data from alternate data stream, browser cache data)
IEHistory: This will check if user downloaded any suspicious things or not.
./volatility -f ram.mem --profile=Win7SP1x64 iehistory
Dump registry: this will dump the registry hive into a folder.
./volatility -f ram.mem --profile=Win7SP1x64 dumpregistry --dump-dir
/root/ramdump/
Dump kernel drivers into a folder:
./volatility -f ram.mem --profile=Win7SP1x64 moddump --dump-dir
/root/ramdump/
Procdump: this will dump all the process in a single folder: by mentioning the single process id, you can also dump that of process executables.
./volatility -f ram.mem --profile=Win7SP1x64 procdump --dump-dir
/root/ramdump/
Shellbags plugins to find out last directory accessed by the user. It is used to find out files, folders, zip, installers that were present on the system at one point of time even if deleted:
./volatility -f jackobsPC.raw --profile=Win7SP1x64 shellbags
Read the content of notepad documents:
./volatility -f jackobsPC.raw --profile=Win7SP1x64 notepad
Malfind plugin to find out malicious code injection. It is related to network connection as well:
./volatility -f victim2.raw --profile=Win7SP1x64 malfind
./volatility -f victim2.raw --profile=Win7SP1x64 malfind -D . (to dump that in the current folder)
Command line:
./volatility -f jackobsPC.raw --profile=Win7SP1x64 cmdline
./volatility -f jackobsPC.raw --profile=Win7SP1x64 cmdscan
./volatility -f jackobsPC.raw --profile=Win7SP1x64 consoles
Environment variables: to find out pc name and some other info
./volatility -f jackobsPC.raw --profile=Win7SP1x64 envars
./volatility -f victim3.raw --profile=Win7SP1x64 envars -f 2464.dmp -p 2464 (using memdump plugin, we already dump pid 2464 and save that as 2464.dmp)
To maintain persistency, malware change Registry key | print key extract:
./volatility -f jackobsPC.raw --profile=Win7SP1x64 printkey -K 'Software\Microsoft\Windows\CurrentVersion\Run' (you can also run RunOnce)
www.cyberdonald.com jigsaw malware analysis.
Challenge download:
Volatility cheat sheet :
For linux system or profile:
Assume you are in volatility directory and python 2 is used.
To see available commands:
python vol.py --profile=Linuxprofilex64 -f /home/avi/Desktop/memdump.vmem -h
python vol.py --info
Find process in linux:
python vol.py --profile=Linuxprofilex64 -f /home/avi/Desktop/memdump.vmem linux_psaux
Finding files and Credential finding:
python vol.py --profile=Linuxprofilex64 -f /home/avi/Desktop/memdump.vmem linux_find_file -F "/etc/passwd" (now you should get the inode. copy that for extraction)
Dumping creds:
python vol.py --profile=Linuxprofilex64 -f /home/avi/Desktop/memdump.vmem linux_find_file -i 0xffff931202b685e0 -O passwd
cat passwd
The same way find the shadow file and extract the shadow file.
Enumerate files:
python vol.py --profile=Linuxprofilex64 -f /home/avi/Desktop/memdump.vmem linux_enumerate_files
Finding shares and password:
python vol.py --profile=Linuxprofilex64 -f /home/avi/Desktop/memdump.vmem linux_enumerate_files | grep /var/log
take a note of inode of /var/log/syslog which is
0xffff931231bb8140 because we want to extract syslog file.
python vol.py --profile=Linuxprofilex64 -f /home/avi/Desktop/memdump.vmem linux_find_file -i 0xffff931231bb8140 -O syslog
cat syslog --> you could see that gvfsd-smb related pid 1315 for example.
Process id dumping:
python vol.py --profile=Linuxprofilex64 -f /home/avi/Desktop/memdump.vmem linux_dump_map -p 1315 -D dump (under dump directory it will dump)
Now go to dump directory. You will see lots of files.
grep -ri "research" * (research is share related name)
You will see 5 files come out. Try to read each of the file 1 by 1.
strings -n 10 task.1315.0x559c379d5000.vma | grep research
strings -n 10 task.1315.0x559c379d5000.vma > temp.txt (search research keyword in temp.txt file)
search for any details that you got in syslog file related to this share. or search for anything related to share. you should get the password. search for administrator account.
Special note: samba stores its password in a special file called smbpasswd. located under /usr/local/samba/private directory
Avi
Comments
Post a Comment