volatility主要参数PS C:\Users\Administrator\Downloads\世界技能大赛\volatility\volatility_2.6_win64_standalone .\volatility_2.6_win64_standalone.exe -h Volatility Foundation Volatility Framework 2.6 Usage: Volatility - A memory forensics analysis platform. Options: -h, --help list all available options and their default values. Default values may be set in the configuration file (/etc/volatilityrc) --conf-file.volatilityrc User based configuration file -d, --debug Debug volatility --pluginsPLUGINS Additional plugin directories to use (semi-colon separated) --info Print information about all registered objects --cache-directoryC:\Users\Administrator/.cache\volatility Directory where cache files are stored --cache Use caching --tzTZ Sets the (Olson) timezone for displaying timestamps using pytz (if installed) or tzset -f FILENAME, --filenameFILENAME Filename to use when opening an image --profileWinXPSP2x86 Name of the profile to load (use --info to see a list of supported profiles) -l LOCATION, --locationLOCATION A URN location from which to load an address space -w, --write Enable write support --dtbDTB DTB Address --shiftSHIFT Mac KASLR shift address --outputtext Output in this format (support is module specific, see the Module Output Options below) --output-fileOUTPUT_FILE Write output in this file -v, --verbose Verbose information -g KDBG, --kdbgKDBG Specify a KDBG virtual address (Note: for 64-bit Windows 8 and above this is the address of KdCopyDataBlock) --force Force utilization of suspect profile --cookieCOOKIE Specify the address of nt!ObHeaderCookie (valid for Windows 10 only) -k KPCR, --kpcrKPCR Specify a specific KPCR address Supported Plugin Commands: amcache Print AmCache information apihooks Detect API hooks in process and kernel memory atoms Print session and window station atom tables atomscan Pool scanner for atom tables auditpol Prints out the Audit Policies from HKLM\SECURITY\Policy\PolAdtEv bigpools Dump the big page pools using BigPagePoolScanner bioskbd Reads the keyboard buffer from Real Mode memory cachedump Dumps cached domain hashes from memory callbacks Print system-wide notification routines clipboard Extract the contents of the windows clipboard cmdline Display process command-line arguments cmdscan Extract command history by scanning for _COMMAND_HISTORY connections Print list of open connections [Windows XP and 2003 Only] connscan Pool scanner for tcp connections consoles Extract command history by scanning for _CONSOLE_INFORMATION crashinfo Dump crash-dump information deskscan Poolscaner for tagDESKTOP (desktops) devicetree Show device tree dlldump Dump DLLs from a process address space dlllist Print list of loaded dlls for each process driverirp Driver IRP hook detection drivermodule Associate driver objects to kernel modules driverscan Pool scanner for driver objects dumpcerts Dump RSA private and public SSL keys dumpfiles Extract memory mapped and cached files dumpregistry Dumps registry files out to disk editbox Displays information about Edit controls. (Listbox experimental.) envars Display process environment variables eventhooks Print details on windows event hooks evtlogs Extract Windows Event Logs (XP/2003 only) filescan Pool scanner for file objects gahti Dump the USER handle type information gditimers Print installed GDI timers and callbacks gdt Display Global Descriptor Table getservicesids Get the names of services in the Registry and return Calculated SID getsids Print the SIDs owning each process handles Print list of open handles for each process hashdump Dumps passwords hashes (LM/NTLM) from memory hibinfo Dump hibernation file information hivedump Prints out a hive hivelist Print list of registry hives. hivescan Pool scanner for registry hives hpakextract Extract physical memory from an HPAK file hpakinfo Info on an HPAK file idt Display Interrupt Descriptor Table iehistory Reconstruct Internet Explorer cache / history imagecopy Copies a physical address space out as a raw DD image imageinfo Identify information for the image impscan Scan for calls to imported functions joblinks Print process job link information kdbgscan Search for and dump potential KDBG values kpcrscan Search for and dump potential KPCR values ldrmodules Detect unlinked DLLs lsadump Dump (decrypted) LSA secrets from the registry machoinfo Dump Mach-O file format information malfind Find hidden and injected code mbrparser Scans for and parses potential Master Boot Records (MBRs) memdump Dump the addressable memory for a process memmap Print the memory map messagehooks List desktop and thread window message hooks mftparser Scans for and parses potential MFT entries moddump Dump a kernel driver to an executable file sample modscan Pool scanner for kernel modules modules Print list of loaded modules multiscan Scan for various objects at once mutantscan Pool scanner for mutex objects notepad List currently displayed notepad text objtypescan Scan for Windows object type objects patcher Patches memory based on page scans poolpeek Configurable pool scanner plugin printkey Print a registry key, and its subkeys and values privs Display process privileges procdump Dump a process to an executable file sample pslist Print all running processes by following the EPROCESS lists psscan Pool scanner for process objects pstree Print process list as a tree psxview Find hidden processes with various process listings qemuinfo Dump Qemu information raw2dmp Converts a physical memory sample to a windbg crash dump screenshot Save a pseudo-screenshot based on GDI windows servicediff List Windows services (ala Plugx) sessions List details on _MM_SESSION_SPACE (user logon sessions) shellbags Prints ShellBags info shimcache Parses the Application Compatibility Shim Cache registry key shutdowntime Print ShutdownTime of machine from registry sockets Print list of open sockets sockscan Pool scanner for tcp socket objects ssdt Display SSDT entries strings Match physical offsets to virtual addresses (may take a while, VERY verbose) svcscan Scan for Windows services symlinkscan Pool scanner for symlink objects thrdscan Pool scanner for thread objects threads Investigate _ETHREAD and _KTHREADs timeliner Creates a timeline from various artifacts in memory timers Print kernel timers and associated module DPCs truecryptmaster Recover TrueCrypt 7.1a Master Keys truecryptpassphrase TrueCrypt Cached Passphrase Finder truecryptsummary TrueCrypt Summary unloadedmodules Print list of unloaded modules userassist Print userassist registry keys and information userhandles Dump the USER handle tables vaddump Dumps out the vad sections to a file vadinfo Dump the VAD info vadtree Walk the VAD tree and display in tree format vadwalk Walk the VAD tree vboxinfo Dump virtualbox information verinfo Prints out the version information from PE images vmwareinfo Dump VMware VMSS/VMSN information volshell Shell in the memory image windows Print Desktop Windows (verbose details) wintree Print Z-Order Desktop Windows Tree wndscan Pool scanner for window stations yarascan Scan process or kernel memory with Yara signatures常用命令❤可以先查看当前内存镜像中的用户printkey -K “SAM\Domains\Account\Users\Names” ❤查看用户名密码信息(密码是哈希值需要john爆破) hashdump ❤如果john爆破不出来就使用 lasdmp 查看强密码 lsadmp ❤查看进程pslist ❤查看已知进程pslist ❤隐藏或解链的进程psscan ❤查看服务 查询服务名称svcscan ❤查看浏览器历史记录,获取当前系统浏览器搜索过的关键词 iehistory ❤查看网络连接 获取当前系统 ip netscan ❤查看网络连接connscan ❤查看网络连接connections ❤查看命令行操作显示cmd历史命令 cmdscan ❤查看进程命令行参数具体一些可疑进程的参数指令cmdline ❤扫描所有的文件列表 filescan ❤查看文件内容dmpfiles ❤查看当前展示的notepad内容 notepad ❤显示有关编辑控件曾经编辑过的内容的信息 editbox ❤提取进程memdump ❤屏幕截图screenshot ❤查看注册表配置单元hivelist ❤查看注册表键名hivedmp ❤查看注册表键值printkey ❤ 获取主机名 printkey ❤列出用户名 pringkey ❤查看运行程序相关的记录比如最后一次更新时间运行过的次数等。serassist ❤最大程序提取信息timeliner ❤查看剪贴板信息clipboard ❤显示关于计算机及其操作系统的详细配置信息插件systeminfo ❤恢复被删除的文件mftparser ❤查看环境变量envars ❤列出某一进程加载的所有dll文件dlllist ❤程序版本信息 verinfo ❤产看进程树可以轻松了解各进程之间的关系父进程与子进程 pstree ❤从内存文件中找到异常程序植入到系统的开机自启痕迹 shimcache 七内存取证的大致思路 八例题讲解 题目一 解析 1.从内存中获取到用户admin的密码并且破解密码以Flag{admin,password} 形式提交(密码为 6 位) 2.获取当前系统 ip 地址及主机名以 Flag{ip:主机名}形式提交 3.获取当前系统浏览器搜索过的关键词作为 Flag 提交 4.当前系统中存在挖矿进程请获取指向的矿池地址以 Flag{ip:端口}形式 提交 5.恶意进程在系统中注册了服务请将服务名以 Flag{服务名}形式提交。任务一 获取admin用户密码是多少 20分· 你需要从内存中获取到当前用户admin的密码。1.从内存中获取到用户admin的密码并且破解密码以Flag{admin,password} 形式提交(密码为 6 位)不管什么题内存取证的第一步肯定是去判断当前的镜像信息分析出是哪个操作系统 使用参数 imageinfo 查看系统信息.\volatility_2.6_win64_standalone.exe -f .\worldskills3.vmem imageinfo.\volatility_2.6_win64_standalone.exe -f .\worldskills3.vmem imageinfo操作系统我们一般取第一个就可以了接下来就可以输入参数可以先查看当前内存镜像中的用户volatility -f 1.vmem –profileWin7SP1x64 printkey -K “SAM\Domains\Account\Users\Names”.\volatility_2.6_win64_standalone.exe -f .\worldskills3.vmem –profileWin7SP1x64 printkey -K “SAM\Domains\Account\Users\Names”WimR输入regedit快速打开注册表SAM\Domains\Account\Users\Names 详解该路径为Windows 注册表 SAM 安全账户管理器核心路径完整注册表路径HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\Names一、基础定义与结构SAM 简介SAMSecurity Accounts Manager安全账户管理器Windows 用来存储本地账户、SID、密码哈希、账户权限的数据库对应磁盘文件C:\Windows\System32\config\SAM。Names 目录作用Names是用户名→SID 索引映射表每一个子项名称 本地用户名Administrator、Guest、新建普通账号等每个项的默认值数据 该用户对应的RID相对标识符上层Users文件夹以数字 RID命名子项存放该用户完整配置NTLM 哈希、账户状态、登录配置等。映射逻辑用户名 (Names 子项) → RID → Users [RID] → 账户详细信息、密码哈希示例Names\Administrator 数值为0x1f4(十进制 500)对应 Users\000001F4即为管理员账户详情。二、权限特性默认状态系统内核独占锁定正常运行时管理员、system 都无法直接读取、修改 SAM 注册表仅系统进程lsass.exe可读写仅 PE 系统、系统蓝屏快照、内存转储、卷影副本、离线挂载可导出 SAM 文件。.\volatility_2.6_win64_standalone.exe -f .\worldskills3.vmem --profileWin7SP1x64 printkey -K SAM\Domains\Account\Users\Names使用hashdump获取samvolatility -f 1.vmem --profileWin7SP1x64 hashdump.\volatility_2.6_win64_standalone.exe -f .\worldskills3.vmem --profileWin7SP1x64 hashdump可以通过john工具来进行爆破但是好像跑不出来结果。应该是设定了强密码。于是只能使用了lasdump命令来查看.\volatility_2.6_win64_standalone.exe -f .\worldskills3.vmem --profileWin7SP1x64 lsadump.\volatility_2.6_win64_standalone.exe -f .\worldskills3.vmem --profileWin7SP1x64 lsadump发现flag{406990ff88f13dac3c9debbc0769588c}flag{406990ff88f13dac3c9debbc0769588c}md5在线解密破解,md5解密加密在线破解flag{admin.dfsddew}任务二 获ip和主机名是什么Netscan 可以查ip.\volatility_2.6_win64_standalone.exe -f .\worldskills3.vmem --profileWin7SP1x6 netscan.\volatility_2.6_win64_standalone.exe -f .\worldskills3.vmem --profileWin7SP1x6 netscanIP:192.168.85.129主机名需要通过查询注册表先用hivelistVolatility -f 1.vmem --profileWin7SP1x64 hivelist主机名需要通过查询注册表先用hivelist .\volatility_2.6_win64_standalone.exe -f .\worldskills3.vmem --profileWin7SP1x6 netscan hivelist然后我们需要一步一步去找键名主机名需要通过查询注册表先用hivelist.\volatility_2.6_win64_standalone.exe -f .\worldskills3.vmem --profileWin7SP1x6 netscan -o 0xfffff8a000024010 printkey主机名需要通过查询注册表先用hivelist .\volatility_2.6_win64_standalone.exe -f .\worldskills3.vmem --profileWin7SP1x6 -o 0xfffff8a000024010 printkey继续volatility -f 1.vmem --profileWin7SP1x64-o 0xfffff8a000024010 printkey -K ControlSet001\Control 继续 .\volatility_2.6_win64_standalone.exe -f .\worldskills3.vmem --profileWin7SP1x -o 0xfffff8a000024010 printkey -K ControlSet001\Control volatility -f 1.vmem --profileWin7SP1x64 -o 0xfffff8a000024010 printkey -K ControlSet001\Control volatility -f 1.vmem --profileWin7SP1x64 -o 0xfffff8a000024010 printkey -K ControlSet001\Control\ComputerName volatility -f 1.vmem --profileWin7SP1x64 -o 0xfffff8a000024010 printkey -K ControlSet001\Control\ComputerName\ComputerNameComputerName : (S) WIN-9FBAEH4UV8C得到主机名WIN-9FBAEH4UV8C也可以直接通过 hivedump查询相应的键名 但比较慢volatility -f 1.vmem --profileWin7SP1x64 hivedump -o 0xfffff8a000024010 system.txt任务三获取桌面上的 flag.txt中的文件内容是什么40分·桌面上存放着一个flag文件请获取flag文件中的内容。.\volatility_2.6_win64_standalone.exe -f .\worldskills3.vmem --profileWin7SP1x64 filescan |grep flag下载下来.\volatility_2.6_win64_standalone.exe -f .\worldskills3.vmem --profileWin7SP1x64 dumpfiles -Q 0x000000007f1b6c10 -n --dump-dir./查看 type .\file.None.0xfffffa801a879510.flag.txt.datflag{180d163ca48c793cb0db74fb96d6a882}任务四 服务器中存在一个挖矿病毒 矿池地址是10分·当前系统中存在挖矿进程请获取矿池地址 以flag的形式提交以flag形式提交flag{ip:端口}Flag{54.36.109.161:2222}0x7d500b20 TCPv4 192.168.85.129:49163 54.36.109.161:2222 ESTABLISHED 2588 svchost.exeFlag{54.36.109.161:2222}任务五恶意代码在系统中注册了服务 服务名是什么20分·恶意进程在系统中注册了服务请获取服务名 以flag的形式提交以flag形式提交flag{服务名}限制提交三次服务扫描.\volatility_2.6_win64_standalone.exe -f .\worldskills3.vmem --profileWin7SP1x64 svcscan任务六 获取恶意代码的进程名pid。30分·初步判断系统中存在系统存在恶意代码获取恶意进程名和PID 如果存在多个进程以pid大小进行排列以flag的形式提交 flag{恶意进程1pid(PID小);恶意进程2(PID)恶意进程3(PID大))Flag{svchost.exe 2588 loader.exe 3036}.\volatility_2.6_win64_standalone.exe -f .\worldskills3.vmem --profileWin7SP1x64 pslist任务七 病毒在自我删除时 执行的命令是什么30分·病毒进入系统后会删除原始文件请获取文件删除时执行的命令;以flag的形式提交 flag{命令的md5值} ;提示 路径信息用*代替 不带cmd.exe#导出病毒数据 默认导出了大量数据,而我们只需要关键信息即可python3 tools/volatility3/vol.py -f /root/1/worldskills3.vmem windows.dumpfiles --pid 3036