Volatility

Info sur le dump

 # ./vol.py -f ch2.dmp imageinfo
 Volatile Systems Volatility Framework 2.0
         Suggested Profile(s) : Win7SP1x86, Win7SP0x86
                    AS Layer1 : JKIA32PagedMemoryPae (Kernel AS)
                    AS Layer2 : FileAddressSpace (./ch2.dmp)
                     PAE type : PAE
                          DTB : 0x185000

Trouver le hostname

 # ./vol.py -f ch2.dmp --profile=Win7SP0x86 envars

ou

 # ./vol.py -f ch2.dmp --profile Win7SP1x86 printkey -K "ControlSet001\Control\ComputerName\ActiveComputerName"

Trouver les hashs

Afficher les ruches:

 ./vol.py -f /tmp/e3a902d4d44e0f7bd9cb29865e0a15de.dmp --profile Win7SP1x86 hivelist
 Volatile Systems Volatility Framework 2.1
 Virtual    Physical   Name
 ---------- ---------- ----
 0x8ee66740 0x141c0740 \SystemRoot\System32\Config\SOFTWARE
 0x90cab9d0 0x172ab9d0 \SystemRoot\System32\Config\DEFAULT
 0x9670e9d0 0x1ae709d0 \??\C:\Users\John Doe\ntuser.dat
 0x9670f9d0 0x04a719d0 \??\C:\Users\John Doe\AppData\Local\Microsoft\Windows\UsrClass.dat
 0x9aad6148 0x131af148 \SystemRoot\System32\Config\SAM
 0x9ab25008 0x14a61008 \SystemRoot\System32\Config\SECURITY
 0x9aba79d0 0x11a259d0 \??\C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
 0x9abb1720 0x0a7d4720 \??\C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
 0x82b6b140 0x02b6b140 [no name]
 0x8b20c008 0x039e1008 [no name]
 0x8b21c008 0x039ef008 \REGISTRY\MACHINE\SYSTEM
 0x8b23c008 0x02ccf008 \REGISTRY\MACHINE\HARDWARE
 0x8ee66008 0x141c0008 \Device\HarddiskVolume1\Boot\BCD

Extraction des pass NTLM

 ./vol.py -f /tmp/e3a902d4d44e0f7bd9cb29865e0a15de.dmp --profile Win7SP1x86 hashdump -y 0x8b21c008 -s 0x9aad6148
 Volatile Systems Volatility Framework 2.1
 Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
 Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
 John Doe:1000:aad3b435b51404eeaad3b435b51404ee:b9f917853e3dbf6e6831ecce60725930:::

Variables d'environnement

Location du dump mémoire

 export VOLATILITY_LOCATION=file:///$(pwd)/dump/dump

Profile du dump

 export VOLATILITY_PROFILE=Win7SP1x64