內存取證
1. 內存取證工具volatility
猜測dump文件的profile值
root@kali:~/CTF# volatility -f mem.vmem imageinfo
Volatility Foundation Volatility Framework 2.6
INFO : volatility.debug : Determining profile based on KDBG search...
Suggested Profile(s) : WinXPSP2x86, WinXPSP3x86 (Instantiated with WinXPSP2x86)
AS Layer1 : IA32PagedMemoryPae (Kernel AS)
AS Layer2 : FileAddressSpace (/root/CTF/mem.vmem)
PAE type : PAE
DTB : 0xb18000L
KDBG : 0x80546ae0L
Number of Processors : 1
Image Type (Service Pack) : 3
KPCR for CPU 0 : 0xffdff000L
KUSER_SHARED_DATA : 0xffdf0000L
Image date and time : 2016-05-03 04:41:19 UTC+0000
Image local date and time : 2016-05-03 12:41:19 +0800
root@kali:~/CTF#
看到，profile可能是WinXPSP2x86
直接獲取volshell
shell的命令：
dt("內核關鍵數據結構名稱"")
如: dt("_PEB")
root@kali:~/CTF# volatility -f mem.vmem --profile=WinXPSP2x86 volshell
Volatility Foundation Volatility Framework 2.6
Current context: System @ 0x821b9830, pid=4, ppid=0 DTB=0xb18000
Welcome to volshell! Current memory image is:
file:///root/CTF/mem.vmem
To get help, type 'hh()'
>>> dt("_PEB")
'_PEB' (528 bytes)
0x0 : InheritedAddressSpace ['unsigned char']
0x1 : ReadImageFileExecOptions ['unsigned char']
0x2 : BeingDebugged ['unsigned char']
0x3 : SpareBool ['unsigned char']
0x4 : Mutant ['pointer', ['void']]
0x8 : ImageBaseAddress ['pointer', ['void']]
0xc : Ldr ['pointer', ['_PEB_LDR_DATA']]
0x10 : ProcessParameters ['pointer', ['_RTL_USER_PROCESS_PARAMETERS']]
0x14 : SubSystemData ['pointer', ['void']]
0x18 : ProcessHeap ['pointer', ['void']]
0x1c : FastPebLock ['pointer', ['_RTL_CRITICAL_SECTION']]
0x20 : FastPebLockRoutine ['pointer', ['void']]
0x24 : FastPebUnlockRoutine ['pointer', ['void']]
0x28 : EnvironmentUpdateCount ['unsigned long']
0x2c : KernelCallbackTable ['pointer', ['void']]
0x30 : SystemReserved ['array', 1, ['unsigned long']]
0x34 : AtlThunkSListPtr32 ['unsigned long']
0x38 : FreeList ['pointer', ['_PEB_FREE_BLOCK']]
0x3c : TlsExpansionCounter ['unsigned long']
0x40 : TlsBitmap ['pointer', ['void']]
0x44 : TlsBitmapBits ['array', 2, ['unsigned long']]
0x4c : ReadOnlySharedMemoryBase ['pointer', ['void']]
0x50 : ReadOnlySharedMemoryHeap ['pointer', ['void']]
0x54 : ReadOnlyStaticServerData ['pointer', ['pointer', ['void']]]
0x58 : AnsiCodePageData ['pointer', ['void']]
0x5c : OemCodePageData ['pointer', ['void']]
0x60 : UnicodeCaseTableData ['pointer', ['void']]
0x64 : NumberOfProcessors ['unsigned long']
0x68 : NtGlobalFlag ['unsigned long']
0x70 : CriticalSectionTimeout ['_LARGE_INTEGER']
0x78 : HeapSegmentReserve ['unsigned long']
0x7c : HeapSegmentCommit ['unsigned long']
0x80 : HeapDeCommitTotalFreeThreshold ['unsigned long']
0x84 : HeapDeCommitFreeBlockThreshold ['unsigned long']
0x88 : NumberOfHeaps ['unsigned long']
0x8c : MaximumNumberOfHeaps ['unsigned long']
0x90 : ProcessHeaps ['pointer', ['array', <function <lambda> at 0x7f88d57decf8>, ['pointer', ['_HEAP']]]]
0x94 : GdiSharedHandleTable ['pointer', ['void']]
0x98 : ProcessStarterHelper ['pointer', ['void']]
0x9c : GdiDCAttributeList ['unsigned long']
0xa0 : LoaderLock ['pointer', ['void']]
0xa4 : OSMajorVersion ['unsigned long']
0xa8 : OSMinorVersion ['unsigned long']
0xac : OSBuildNumber ['unsigned short']
0xae : OSCSDVersion ['unsigned short']
0xb0 : OSPlatformId ['unsigned long']
0xb4 : ImageSubsystem ['unsigned long']
0xb8 : ImageSubsystemMajorVersion ['unsigned long']
0xbc : ImageSubsystemMinorVersion ['unsigned long']
0xc0 : ImageProcessAffinityMask ['unsigned long']
0xc4 : GdiHandleBuffer ['array', 34, ['unsigned long']]
0x14c : PostProcessInitRoutine ['pointer', ['void']]
0x150 : TlsExpansionBitmap ['pointer', ['void']]
0x154 : TlsExpansionBitmapBits ['array', 32, ['unsigned long']]
0x1d4 : SessionId ['unsigned long']
0x1d8 : AppCompatFlags ['_ULARGE_INTEGER']
0x1e0 : AppCompatFlagsUser ['_ULARGE_INTEGER']
0x1e8 : pShimData ['pointer', ['void']]
0x1ec : AppCompatInfo ['pointer', ['void']]
0x1f0 : CSDVersion ['_UNICODE_STRING']
0x1f8 : ActivationContextData ['pointer', ['void']]
0x1fc : ProcessAssemblyStorageMap ['pointer', ['void']]
0x200 : SystemDefaultActivationContextData ['pointer', ['void']]
0x204 : SystemAssemblyStorageMap ['pointer', ['void']]
0x208 : MinimumStackCommit ['unsigned long']
>>>
查看進程：
root@kali:~/CTF#
root@kali:~/CTF# volatility -f mem.vmem --profile=WinXPSP2x86 pslist
Volatility Foundation Volatility Framework 2.6
Offset(V) Name PID PPID Thds Hnds Sess Wow64 Start Exit
---------- -------------------- ------ ------ ------ -------- ------ ------ ------------------------------ ------------------------------
0x821b9830 System 4 0 62 253 ------ 0
0x81fb9210 smss.exe 552 4 3 19 ------ 0 2016-05-03 04:32:10 UTC+0000
0x81c14da0 csrss.exe 616 552 10 328 0 0 2016-05-03 04:32:12 UTC+0000
0x81f81880 winlogon.exe 640 552 18 449 0 0 2016-05-03 04:32:12 UTC+0000
0x8208fda0 services.exe 684 640 16 260 0 0 2016-05-03 04:32:12 UTC+0000
0x81c32b10 lsass.exe 696 640 18 333 0 0 2016-05-03 04:32:12 UTC+0000
0x820a19a0 vmacthlp.exe 852 684 1 25 0 0 2016-05-03 04:32:13 UTC+0000
0x81c30458 svchost.exe 864 684 18 201 0 0 2016-05-03 04:32:13 UTC+0000
0x81c67020 svchost.exe 948 684 11 238 0 0 2016-05-03 04:32:13 UTC+0000
0x81ce7da0 svchost.exe 1040 684 55 1103 0 0 2016-05-03 04:32:13 UTC+0000
0x81c25020 svchost.exe 1096 684 4 66 0 0 2016-05-03 04:32:13 UTC+0000
0x82002b28 svchost.exe 1256 684 13 194 0 0 2016-05-03 04:32:14 UTC+0000
0x81f6c988 explorer.exe 1464 1448 12 329 0 0 2016-05-03 04:32:14 UTC+0000
0x82085550 spoolsv.exe 1576 684 13 140 0 0 2016-05-03 04:32:14 UTC+0000
0x81f64560 vmtoolsd.exe 1712 1464 5 145 0 0 2016-05-03 04:32:15 UTC+0000
0x820a3528 ctfmon.exe 1736 1464 1 78 0 0 2016-05-03 04:32:15 UTC+0000
0x81f7d3c0 vmtoolsd.exe 2020 684 7 273 0 0 2016-05-03 04:32:23 UTC+0000
0x8207db28 TPAutoConnSvc.e 512 684 5 99 0 0 2016-05-03 04:32:25 UTC+0000
0x81c26da0 alg.exe 1212 684 6 105 0 0 2016-05-03 04:32:26 UTC+0000
0x81f715c0 wscntfy.exe 1392 1040 1 39 0 0 2016-05-03 04:32:26 UTC+0000
0x81e1f520 TPAutoConnect.e 1972 512 1 72 0 0 2016-05-03 04:32:26 UTC+0000
0x81f9d3e8 TrueCrypt.exe 2012 1464 2 139 0 0 2016-05-03 04:33:36 UTC+0000
root@kali:~/CTF#
查看緩存在內存的注冊表
root@kali:~/CTF# volatility -f mem.vmem --profile=WinXPSP2x86 hivelist
Volatility Foundation Volatility Framework 2.6
Virtual Physical Name
---------- ---------- ----
0xe1e9f9d8 0x0bf169d8 \Device\HarddiskVolume1\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
0xe1cee5d0 0x0be075d0 \Device\HarddiskVolume1\Documents and Settings\Administrator\NTUSER.DAT
0xe1b99b60 0x0ae0ab60 \Device\HarddiskVolume1\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
0xe1b95008 0x0adc6008 \Device\HarddiskVolume1\Documents and Settings\LocalService\NTUSER.DAT
0xe1a7c2a8 0x0a76b2a8 \Device\HarddiskVolume1\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
0xe1a72b60 0x0a6e1b60 \Device\HarddiskVolume1\Documents and Settings\NetworkService\NTUSER.DAT
0xe146c398 0x084a3398 \Device\HarddiskVolume1\WINDOWS\system32\config\software
0xe1699758 0x08246758 \Device\HarddiskVolume1\WINDOWS\system32\config\default
0xe166faa8 0x05e7eaa8 \Device\HarddiskVolume1\WINDOWS\system32\config\SECURITY
0xe16aab60 0x082a6b60 \Device\HarddiskVolume1\WINDOWS\system32\config\SAM
0xe12e9008 0x02d7f008 [no name]
0xe1035b60 0x02b08b60 \Device\HarddiskVolume1\WINDOWS\system32\config\system
0xe102e008 0x02b02008 [no name]
root@kali:~/CTF#
hivedump 打印出注冊表中的數據 ：
root@kali:~/CTF# volatility -f mem.vmem --profile=WinXPSP2x86 hivedump -o 0xe16aab60
Volatility Foundation Volatility Framework 2.6
Last Written Key
2016-05-03 03:41:48 UTC+0000 \SAM
2016-05-03 03:41:48 UTC+0000 \SAM\SAM
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains
2016-05-03 03:51:02 UTC+0000 \SAM\SAM\Domains\Account
2016-05-03 03:50:51 UTC+0000 \SAM\SAM\Domains\Account\Aliases
2016-05-03 03:51:02 UTC+0000 \SAM\SAM\Domains\Account\Aliases\000003E9
2016-05-03 03:51:02 UTC+0000 \SAM\SAM\Domains\Account\Aliases\Members
2016-05-03 03:51:02 UTC+0000 \SAM\SAM\Domains\Account\Aliases\Members\S-1-5-21-1844237615-1677128483-1801674531
2016-05-03 03:51:02 UTC+0000 \SAM\SAM\Domains\Account\Aliases\Members\S-1-5-21-1844237615-1677128483-1801674531\000003EA
2016-05-03 03:50:51 UTC+0000 \SAM\SAM\Domains\Account\Aliases\Names
2016-05-03 03:50:51 UTC+0000 \SAM\SAM\Domains\Account\Aliases\Names\HelpServicesGroup
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Account\Groups
2016-05-03 03:51:02 UTC+0000 \SAM\SAM\Domains\Account\Groups\00000201
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Account\Groups\Names
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Account\Groups\Names\None
2016-05-03 03:51:02 UTC+0000 \SAM\SAM\Domains\Account\Users
2016-05-03 04:32:14 UTC+0000 \SAM\SAM\Domains\Account\Users\000001F4
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Account\Users\000001F5
2016-05-03 03:50:15 UTC+0000 \SAM\SAM\Domains\Account\Users\000003E8
2016-05-03 03:51:02 UTC+0000 \SAM\SAM\Domains\Account\Users\000003EA
2016-05-03 03:51:02 UTC+0000 \SAM\SAM\Domains\Account\Users\Names
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Account\Users\Names\Administrator
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Account\Users\Names\Guest
2016-05-03 03:50:15 UTC+0000 \SAM\SAM\Domains\Account\Users\Names\HelpAssistant
2016-05-03 03:51:02 UTC+0000 \SAM\SAM\Domains\Account\Users\Names\SUPPORT_388945a0
2016-05-03 03:42:51 UTC+0000 \SAM\SAM\Domains\Builtin
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\00000220
2016-05-03 03:42:51 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\00000221
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\00000222
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\00000223
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\00000227
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\00000228
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\0000022B
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\0000022C
2016-05-03 03:42:51 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Members
2016-05-03 03:42:51 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Members\S-1-5
2016-05-03 03:42:51 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Members\S-1-5\00000004
2016-05-03 03:42:51 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Members\S-1-5\0000000B
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Members\S-1-5-21-1844237615-1677128483-1801674531
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Members\S-1-5-21-1844237615-1677128483-1801674531\000001F4
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Members\S-1-5-21-1844237615-1677128483-1801674531\000001F5
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Names
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Names\Administrators
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Names\Backup Operators
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Names\Guests
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Names\Network Configuration Operators
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Names\Power Users
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Names\Remote Desktop Users
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Names\Replicator
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Aliases\Names\Users
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Groups
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Groups\Names
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Users
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\Domains\Builtin\Users\Names
2016-05-03 03:41:48 UTC+0000 \SAM\SAM\RXACT
root@kali:~/CTF#
獲取SAM表中的用戶
root@kali:~/CTF# volatility -f mem.vmem --profile=WinXPSP2x86 printkey -K "SAM\Domains\Account\Users\Names"
Volatility Foundation Volatility Framework 2.6
Legend: (S) = Stable (V) = Volatile
----------------------------
Registry: \Device\HarddiskVolume1\WINDOWS\system32\config\SAM
Key name: Names (S)
Last updated: 2016-05-03 03:51:02 UTC+0000
Subkeys:
(S) Administrator
(S) Guest
(S) HelpAssistant
(S) SUPPORT_388945a0
Values:
REG_NONE : (S)
root@kali:~/CTF#
獲取最后登錄系統的賬戶
volatility -f mem.vmem –profile=WinXPSP2x86 printkey -K "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"
提取出內存中記錄的 當時正在運行的程序有哪些，運行過多少次，最后一次運行的時間等信息
root@kali:~/CTF# volatility -f mem.vmem --profile=WinXPSP2x86 userassist
Volatility Foundation Volatility Framework 2.6
----------------------------
Registry: \Device\HarddiskVolume1\Documents and Settings\Administrator\NTUSER.DAT
Path: Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count
Last updated: 2016-05-03 04:31:34 UTC+0000
Subkeys:
Values:
REG_BINARY UEME_CTLSESSION : Raw Data:
0x00000000 9c 27 8d 0e 01 00 00 00 .'......
REG_BINARY UEME_CTLCUACount:ctor :
ID: 1
Count: 2
Last updated: 1970-01-01 00:00:00 UTC+0000
Raw Data:
0x00000000 01 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 ................
REG_BINARY UEME_UITOOLBAR :
ID: 1
Count: 5
Last updated: 2016-05-03 04:31:34 UTC+0000
Raw Data:
0x00000000 01 00 00 00 0a 00 00 00 50 d4 8a ac f4 a4 d1 01 ........P.......
REG_BINARY UEME_UITOOLBAR:0x4,7031 :
ID: 1
Count: 3
Last updated: 2016-05-03 04:30:11 UTC+0000
Raw Data:
0x00000000 01 00 00 00 08 00 00 00 30 de 54 7b f4 a4 d1 01 ........0.T{....
REG_BINARY UEME_UITOOLBAR:0x1,120 :
ID: 1
Count: 2
Last updated: 2016-05-03 04:31:34 UTC+0000
Raw Data:
0x00000000 01 00 00 00 07 00 00 00 50 d4 8a ac f4 a4 d1 01 ........P.......
----------------------------
Registry: \Device\HarddiskVolume1\Documents and Settings\Administrator\NTUSER.DAT
Path: Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count
Last updated: 2016-05-03 04:33:36 UTC+0000
Subkeys:
Values:
REG_BINARY UEME_CTLSESSION : Raw Data:
0x00000000 7b 27 8d 0e 01 00 00 00 {'......
REG_BINARY UEME_RUNPIDL:%csidl2%\Windows Media Player.lnk :
ID: 1
Count: 14
Last updated: 2016-05-03 03:52:39 UTC+0000
Raw Data:
0x00000000 01 00 00 00 13 00 00 00 f0 b1 09 3d ef a4 d1 01 ...........=....
REG_BINARY UEME_RUNPIDL:%csidl2%\Windows Messenger.lnk :
ID: 1
Count: 13
Last updated: 2016-05-03 03:52:39 UTC+0000
Raw Data:
0x00000000 01 00 00 00 12 00 00 00 f0 b1 09 3d ef a4 d1 01 ...........=....
REG_BINARY U :
ID: 1
Count: 12
Last updated: 2016-05-03 03:52:39 UTC+0000
Raw Data:
0x00000000 01 00 00 00 11 00 00 00 f0 b1 09 3d ef a4 d1 01 ...........=....
REG_BINARY U :
ID: 1
Count: 11
Last updated: 2016-05-03 03:52:39 UTC+0000
Raw Data:
0x00000000 01 00 00 00 10 00 00 00 f0 b1 09 3d ef a4 d1 01 ...........=....
REG_BINARY UEME_CTLCUACount:ctor :
ID: 1
Count: 2
Last updated: 1970-01-01 00:00:00 UTC+0000
Raw Data:
0x00000000 01 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 ................
REG_BINARY UEME_RUNCPL :
ID: 1
Count: 1
Last updated: 2016-05-03 04:09:17 UTC+0000
Raw Data:
0x00000000 01 00 00 00 06 00 00 00 f0 cc 99 8f f1 a4 d1 01 ................
REG_BINARY UEME_RUNCPL:desk.cpl :
ID: 1
Count: 1
Last updated: 2016-05-03 04:09:17 UTC+0000
Raw Data:
0x00000000 01 00 00 00 06 00 00 00 f0 cc 99 8f f1 a4 d1 01 ................
REG_BINARY UEME_UISCUT :
ID: 1
Count: 8
Last updated: 2016-05-03 04:33:35 UTC+0000
Raw Data:
0x00000000 01 00 00 00 0d 00 00 00 20 a5 ec f4 f4 a4 d1 01 ................
REG_BINARY UEME_RUNPATH :
ID: 1
Count: 13
Last updated: 2016-05-03 04:33:36 UTC+0000
Raw Data:
0x00000000 01 00 00 00 12 00 00 00 70 53 2f f5 f4 a4 d1 01 ........pS/.....
REG_BINARY U :
ID: 1
Count: 1
Last updated: 2016-05-03 04:21:44 UTC+0000
Raw Data:
0x00000000 01 00 00 00 06 00 00 00 c0 18 b5 4c f3 a4 d1 01 ...........L....
REG_BINARY UEME_RUNPATH:TrueCrypt.lnk :
ID: 1
Count: 3
Last updated: 2016-05-03 04:33:35 UTC+0000
Raw Data:
0x00000000 01 00 00 00 08 00 00 00 10 ef ee f4 f4 a4 d1 01 ................
REG_BINARY UEME_RUNPATH:C:\Program Files\TrueCrypt\TrueCrypt.exe :
ID: 1
Count: 3
Last updated: 2016-05-03 04:33:36 UTC+0000
Raw Data:
0x00000000 01 00 00 00 08 00 00 00 70 53 2f f5 f4 a4 d1 01 ........pS/.....
REG_BINARY U :
ID: 1
Count: 1
Last updated: 2016-05-03 04:24:19 UTC+0000
Raw Data:
0x00000000 01 00 00 00 06 00 00 00 b0 70 51 a9 f3 a4 d1 01 .........pQ.....
REG_BINARY UEME_RUNPATH:C:\WINDOWS\system32\NOTEPAD.EXE :
ID: 1
Count: 5
Last updated: 2016-05-03 04:29:24 UTC+0000
Raw Data:
0x00000000 01 00 00 00 0a 00 00 00 b0 cb 4e 5f f4 a4 d1 01 ..........N_....
root@kali:~/CTF#
將內存中的某個進程數據以 dmp 的格式保存出來
root@kali:~/CTF# mkdir ctfmon
root@kali:~/CTF# volatility -f mem.vmem --profile=WinXPSP2x86 memdump -p 1736 -D ctfmon/
Volatility Foundation Volatility Framework 2.6
************************************************************************
Writing ctfmon.exe [ 1736] to 1736.dmp
root@kali:~/CTF# ls
ctfmon mem.vmem suspicion
root@kali:~/CTF# cd ctfmon/
root@kali:~/CTF/ctfmon# ls
1736.dmp
root@kali:~/CTF/ctfmon#
后續可以使用16進制編輯器分析，或使用strings提取其中的字符串分析。
提取內存中保留的 cmd 命令使用情況 。
root@kali:~/CTF# volatility -f mem.vmem --profile=WinXPSP2x86 cmdscan
Volatility Foundation Volatility Framework 2.6
**************************************************
CommandProcess: csrss.exe Pid: 616
CommandHistory: 0x55cc00 Application: TPAutoConnect.exe Flags: Allocated
CommandCount: 0 LastAdded: -1 LastDisplayed: -1
FirstCommand: 0 CommandCountMax: 50
ProcessHandle: 0x628
Cmd #19 @ 0xe300f7: ??????????????????????????????????????????????????????????????
????'+7;GKW|??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
root@kali:~/CTF#
查看當時網絡連接情況
root@kali:~/CTF# volatility -f mem.vmem --profile=WinXPSP2x86 netscan
Volatility Foundation Volatility Framework 2.6
ERROR : volatility.debug : This command does not support the profile WinXPSP2x86
root@kali:~/CTF#
獲取 IE 瀏覽器的使用情況
volatility -f mem.vmem --profile=WinXPSP2x86 iehistory
獲取內存中的系統密碼
獲取內存中的系統密碼，我們可以使用 hashdump 將它提取出來 。
ubuntu@DESKTOP-RO316QM:/mnt/d$ volatility -f easy_dump.img --profile=Win7SP1x64 hashdump
Volatility Foundation Volatility Framework 2.6
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
n3k0:1000:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
ubuntu@DESKTOP-RO316QM:/mnt/d$
或者：
volatility -f mem.vmem –profile=WinXPSP2x86 hashdump -y （注冊表 system 的 virtual 地址 ）-s （SAM 的 virtual 地址）
root@kali:~/CTF# volatility -f mem.vmem --profile=WinXPSP2x86 hivelist
Volatility Foundation Volatility Framework 2.6
Virtual Physical Name
---------- ---------- ----
0xe1e9f9d8 0x0bf169d8 \Device\HarddiskVolume1\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
0xe1cee5d0 0x0be075d0 \Device\HarddiskVolume1\Documents and Settings\Administrator\NTUSER.DAT
0xe1b99b60 0x0ae0ab60 \Device\HarddiskVolume1\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
0xe1b95008 0x0adc6008 \Device\HarddiskVolume1\Documents and Settings\LocalService\NTUSER.DAT
0xe1a7c2a8 0x0a76b2a8 \Device\HarddiskVolume1\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
0xe1a72b60 0x0a6e1b60 \Device\HarddiskVolume1\Documents and Settings\NetworkService\NTUSER.DAT
0xe146c398 0x084a3398 \Device\HarddiskVolume1\WINDOWS\system32\config\software
0xe1699758 0x08246758 \Device\HarddiskVolume1\WINDOWS\system32\config\default
0xe166faa8 0x05e7eaa8 \Device\HarddiskVolume1\WINDOWS\system32\config\SECURITY
0xe16aab60 0x082a6b60 \Device\HarddiskVolume1\WINDOWS\system32\config\SAM
0xe12e9008 0x02d7f008 [no name]
0xe1035b60 0x02b08b60 \Device\HarddiskVolume1\WINDOWS\system32\config\system
0xe102e008 0x02b02008 [no name]
root@kali:~/CTF#
root@kali:~/CTF# volatility -f mem.vmem --profile=WinXPSP2x86 hashdump -y 0xe1035b60 -s 0xe16aab60
Volatility Foundation Volatility Framework 2.6
timeliner
最大程度上將內存中的信息提取出來，那么你可以使用 timeliner 這個插件。它會從多個位置來收集系統的活動信息
volatility -f mem.vmem –profile=WinXPSP2x86 timeliner
查找鏡像中的文件
ubuntu@DESKTOP-RO316QM:/mnt/d$ volatility -f easy_dump.img --profile=Win7SP1x64 filescan | grep -E 'jpg|png|jpeg|bmp|gif'
Volatility Foundation Volatility Framework 2.6
0x000000002408c460 32 0 RW---- \Device\HarddiskVolume1\phos.jpg
ubuntu@DESKTOP-RO316QM:/mnt/d$
Linux下命令
可以通過linux_route_cache參數查看路由表情況
使用linux_lsof命令查看1517和27157進程相關的文件
使用linux_netstat查看網絡鏈接情況。
使用linux_psaux檢查進程詳細信息
使用linux_proc_maps參數，可以查看進程細節包括共享庫、開始和結束的位置等信息
使用linux_find_file查看可疑文件的位置
Processes
linux_pslist
linux_psaux
linux_pstree
linux_pslist_cache
linux_pidhashtable
linux_psxview
linux_lsof
Process Memory
linux_memmap
linux_proc_maps
linux_dump_map
linux_bash
Kernel Memory and Objects
linux_lsmod
linux_moddump
linux_tmpfs
Rootkit Detection
linux_check_afinfo
linux_check_tty
linux_keyboard_notifier
linux_check_creds
linux_check_fop
linux_check_idt
linux_check_syscall
linux_check_modules
linux_check_creds
Networking
linux_arp
linux_ifconfig
linux_route_cache
linux_netstat
linux_pkt_queues
linux_sk_buff_cache
System Information
linux_cpuinfo
linux_dmesg
linux_iomem
linux_slabinfo
linux_mount
linux_mount_cache
linux_dentry_cache
linux_find_file
linux_vma_cache
Miscellaneous
linux_volshell
linux_yarascan
2. foremost
Foremost是基於文件開始格式，文件結束標志和內部數據結構進行恢復文件的程序。
foremost命令參數英文中文說明：
$ foremost [-v|-V|-h|-T|-Q|-q|-a|-w-d] [-t
[-b
-V - 顯示版權信息並退出
-t - 指定文件類型. (-t jpeg,pdf ...)
-d -打開間接塊檢測 (針對UNIX文件系統)
-i - 指定輸入文件 (默認為標准輸入)
-a - 寫入所有的文件頭部, 不執行錯誤檢測(損壞文件)
-w - 向磁盤寫入審計文件，不寫入任何檢測到的文件
-o - 設置輸出目錄 (默認為為輸出)
-c - 設置配置文件 (默認為 foremost.conf)
-q - 啟用快速模式. 在512字節邊界執行搜索.
-Q - 啟用安靜模式. 禁用輸出消息.
-v - 詳細模式. 向屏幕上記錄所有消息。
foremost 掃描誤刪文件
如果誤刪一個png文件，可以 foremost -t png -i /dev/sda1
恢復內存中dump出的文件
先用volatility提取出對應pid的進程的數據，然后foremost 2616.dump
3. binwalk
遞歸提取 binwalk -Me firmware.bin
自動化（自動）提取 binwalk -e firmware.bin
https://www.freebuf.com/column/152545.html
https://www.freebuf.com/articles/system/26763.html