-
Notifications
You must be signed in to change notification settings - Fork 0
/
search.xml
2152 lines (2052 loc) · 248 KB
/
search.xml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<?xml version="1.0" encoding="utf-8"?>
<search>
<entry>
<title>铁三-WP</title>
<url>/2021/01/01/%E9%93%81%E4%B8%89-WP/</url>
<content><![CDATA[<h1 id="取证题目"><a href="#取证题目" class="headerlink" title="取证题目"></a>取证题目</h1><ol>
<li>在 /var/log/httpd/access.log 文件中有蚁剑连接php记录 ，在202011月的log中 有</li>
</ol>
<p>两个ip 192.168.232.1 和 192.168.232.201(?记不清了)</p>
<ol start="2">
<li>有一个ip是扫描路径 对其User-Agent 过滤并计数</li>
<li>跳过</li>
<li>在www中 db_connect 找到数据库密码 在mysql数据库找到admin用户名密码admin：admin123</li>
<li>跳过</li>
<li>在www中找到manage_user.php 找到操作为 ajax.php?action=（忘了），在log中在m啥啥啥.log中相应的数据包 hacker：hacker2333</li>
<li>同上，www中 site_啥啥啥.php I Got Your Site</li>
<li>好像是查看webshell文件时间 通过log 找到相应文件 用 ll –full-time 查看</li>
<li>查看蚁剑流量,把流量解码就可以,但是这VNC我不会复制出来，没法解码，那怎么办嘛。<h1 id="企业渗透"><a href="#企业渗透" class="headerlink" title="企业渗透"></a>企业渗透</h1></li>
</ol>
<p>Web2 扫描发现ftp弱口令 ftp:123456 登录后发现flag2 和web的登录账号密码。</p>
<p>Web3 访问80端口，发现是原题，时hack the box的题目，访问 cdn-cgi/login,查看源代码发现flag3，利用修改session登录超级管理员权限，然后上传webshell，发现有flag.php 得到flag4</p>
]]></content>
<categories>
<category>WP</category>
</categories>
<tags>
<tag>WP</tag>
</tags>
</entry>
<entry>
<title>volatility</title>
<url>/2020/11/09/Volatility/</url>
<content><![CDATA[<h3 id="自用总结"><a href="#自用总结" class="headerlink" title="自用总结"></a>自用总结</h3><h3 id="简单描述"><a href="#简单描述" class="headerlink" title="简单描述#"></a>简单描述<a href="https://wiki.wgpsec.org/knowledge/ctf/Volatility.html#%E7%AE%80%E5%8D%95%E6%8F%8F%E8%BF%B0">#</a></h3><p>Volatility是一款开源内存取证框架，能够对导出的内存镜像进行分析，通过获取内核数据结构，使用插件获取内存的详细情况以及系统的运行状态。</p>
<p>特点：</p>
<ul>
<li>开源：Python编写，易于和基于python的主机防御框架集成。</li>
<li>支持多平台：Windows，Mac，Linux全支持</li>
<li>易于扩展：通过插件来扩展Volatility的分析能力<h3 id="项目地址"><a href="#项目地址" class="headerlink" title="项目地址#"></a>项目地址<a href="https://wiki.wgpsec.org/knowledge/ctf/Volatility.html#%E9%A1%B9%E7%9B%AE%E5%9C%B0%E5%9D%80">#</a></h3><—more—><br><a href="https://github.com/volatilityfoundation/volatility">https://github.com/volatilityfoundation/volatility</a></li>
</ul>
<h3 id="Kali安装"><a href="#Kali安装" class="headerlink" title="Kali安装#"></a>Kali安装<a href="https://wiki.wgpsec.org/knowledge/ctf/Volatility.html#kali%E5%AE%89%E8%A3%85">#</a></h3><figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">sudo apt-get install volatility</span><br><span class="line">volatility -h</span><br><span class="line"># 部分报错可能kali版本过低</span><br></pre></td></tr></table></figure>
<h3 id="常用模块"><a href="#常用模块" class="headerlink" title="常用模块#"></a>常用模块<a href="https://wiki.wgpsec.org/knowledge/ctf/Volatility.html#%E5%B8%B8%E7%94%A8%E6%A8%A1%E5%9D%97">#</a></h3><table>
<thead>
<tr>
<th align="left">插件名称</th>
<th align="left">功能</th>
</tr>
</thead>
<tbody><tr>
<td align="left">amcache</td>
<td align="left">查看AmCache应用程序痕迹信息</td>
</tr>
<tr>
<td align="left">apihooks</td>
<td align="left">检测内核及进程的内存空间中的API hook</td>
</tr>
<tr>
<td align="left">atoms</td>
<td align="left">列出会话及窗口站atom表</td>
</tr>
<tr>
<td align="left">atomscan</td>
<td align="left">Atom表的池扫描(Pool scanner)</td>
</tr>
<tr>
<td align="left">auditpol</td>
<td align="left">列出注册表HKLMSECURITYPolicyPolAdtEv的审计策略信息</td>
</tr>
<tr>
<td align="left">bigpools</td>
<td align="left">使用BigPagePoolScanner转储大分页池(big page pools)</td>
</tr>
<tr>
<td align="left">bioskbd</td>
<td align="left">从实时模式内存中读取键盘缓冲数据(早期电脑可以读取出BIOS开机密码)</td>
</tr>
<tr>
<td align="left">cachedump</td>
<td align="left">获取内存中缓存的域帐号的密码哈希</td>
</tr>
<tr>
<td align="left">callbacks</td>
<td align="left">打印全系统通知例程</td>
</tr>
<tr>
<td align="left">clipboard</td>
<td align="left">提取Windows剪贴板中的内容</td>
</tr>
<tr>
<td align="left">cmdline</td>
<td align="left">显示进程命令行参数</td>
</tr>
<tr>
<td align="left">cmdscan</td>
<td align="left">提取执行的命令行历史记录（扫描_COMMAND_HISTORY信息）</td>
</tr>
<tr>
<td align="left">connections</td>
<td align="left">打印系统打开的网络连接(仅支持Windows XP 和2003)</td>
</tr>
<tr>
<td align="left">connscan</td>
<td align="left">打印TCP连接信息</td>
</tr>
<tr>
<td align="left">consoles</td>
<td align="left">提取执行的命令行历史记录（扫描_CONSOLE_INFORMATION信息）</td>
</tr>
<tr>
<td align="left">crashinfo</td>
<td align="left">提取崩溃转储信息</td>
</tr>
<tr>
<td align="left">deskscan</td>
<td align="left">tagDESKTOP池扫描(Poolscaner)</td>
</tr>
<tr>
<td align="left">devicetree</td>
<td align="left">显示设备树信息</td>
</tr>
<tr>
<td align="left">dlldump</td>
<td align="left">从进程地址空间转储动态链接库</td>
</tr>
<tr>
<td align="left">dlllist</td>
<td align="left">打印每个进程加载的动态链接库列表</td>
</tr>
<tr>
<td align="left">driverirp</td>
<td align="left">IRP hook驱动检测</td>
</tr>
<tr>
<td align="left">drivermodule</td>
<td align="left">关联驱动对象至内核模块</td>
</tr>
<tr>
<td align="left">driverscan</td>
<td align="left">驱动对象池扫描</td>
</tr>
<tr>
<td align="left">dumpcerts</td>
<td align="left">提取RAS私钥及SSL公钥</td>
</tr>
<tr>
<td align="left">dumpfiles</td>
<td align="left">提取内存中映射或缓存的文件</td>
</tr>
<tr>
<td align="left">dumpregistry</td>
<td align="left">转储内存中注册表信息至磁盘</td>
</tr>
<tr>
<td align="left">editbox</td>
<td align="left">查看Edit编辑控件信息 (Listbox正在实验中)</td>
</tr>
<tr>
<td align="left">envars</td>
<td align="left">显示进程的环境变量</td>
</tr>
<tr>
<td align="left">eventhooks</td>
<td align="left">打印Windows事件hook详细信息</td>
</tr>
<tr>
<td align="left">evtlogs</td>
<td align="left">提取Windows事件日志（仅支持XP/2003)</td>
</tr>
<tr>
<td align="left">filescan</td>
<td align="left">提取文件对象（file objects）池信息</td>
</tr>
<tr>
<td align="left">gahti</td>
<td align="left">转储用户句柄（handle）类型信息</td>
</tr>
<tr>
<td align="left">gditimers</td>
<td align="left">打印已安装的GDI计时器(timers)及回调(callbacks)</td>
</tr>
<tr>
<td align="left">gdt</td>
<td align="left">显示全局描述符表(Global Deor Table)</td>
</tr>
<tr>
<td align="left">getservicesids</td>
<td align="left">获取注册表中的服务名称并返回SID信息</td>
</tr>
<tr>
<td align="left">getsids</td>
<td align="left">打印每个进程的SID信息</td>
</tr>
<tr>
<td align="left">handles</td>
<td align="left">打印每个进程打开的句柄的列表</td>
</tr>
<tr>
<td align="left">hashdump</td>
<td align="left">转储内存中的Windows帐户密码哈希(LM/NTLM)</td>
</tr>
<tr>
<td align="left">hibinfo</td>
<td align="left">转储休眠文件信息</td>
</tr>
<tr>
<td align="left">hivedump</td>
<td align="left">打印注册表配置单元信息</td>
</tr>
<tr>
<td align="left">hivelist</td>
<td align="left">打印注册表配置单元列表</td>
</tr>
<tr>
<td align="left">hivescan</td>
<td align="left">注册表配置单元池扫描</td>
</tr>
<tr>
<td align="left">hpakextract</td>
<td align="left">从HPAK文件（Fast Dump格式）提取物理内存数据</td>
</tr>
<tr>
<td align="left">hpakinfo</td>
<td align="left">查看HPAK文件属性及相关信息</td>
</tr>
<tr>
<td align="left">idt</td>
<td align="left">显示中断描述符表(Interrupt Deor Table)</td>
</tr>
<tr>
<td align="left">iehistory</td>
<td align="left">重建IE缓存及访问历史记录</td>
</tr>
<tr>
<td align="left">imagecopy</td>
<td align="left">将物理地址空间导出原生DD镜像文件</td>
</tr>
<tr>
<td align="left">imageinfo</td>
<td align="left">查看/识别镜像信息</td>
</tr>
<tr>
<td align="left">impscan</td>
<td align="left">扫描对导入函数的调用</td>
</tr>
<tr>
<td align="left">joblinks</td>
<td align="left">打印进程任务链接信息</td>
</tr>
<tr>
<td align="left">kdbgscan</td>
<td align="left">搜索和转储潜在KDBG值</td>
</tr>
<tr>
<td align="left">kpcrscan</td>
<td align="left">搜索和转储潜在KPCR值</td>
</tr>
<tr>
<td align="left">ldrmodules</td>
<td align="left">检测未链接的动态链接DLL</td>
</tr>
<tr>
<td align="left">lsadump</td>
<td align="left">从注册表中提取LSA密钥信息（已解密）</td>
</tr>
<tr>
<td align="left">machoinfo</td>
<td align="left">转储Mach-O 文件格式信息</td>
</tr>
<tr>
<td align="left">malfind</td>
<td align="left">查找隐藏的和插入的代码</td>
</tr>
<tr>
<td align="left">mbrparser</td>
<td align="left">扫描并解析潜在的主引导记录(MBR)</td>
</tr>
<tr>
<td align="left">memdump</td>
<td align="left">转储进程的可寻址内存</td>
</tr>
<tr>
<td align="left">memmap</td>
<td align="left">打印内存映射</td>
</tr>
<tr>
<td align="left">messagehooks</td>
<td align="left">桌面和窗口消息钩子的线程列表</td>
</tr>
<tr>
<td align="left">mftparser</td>
<td align="left">扫描并解析潜在的MFT条目</td>
</tr>
<tr>
<td align="left">moddump</td>
<td align="left">转储内核驱动程序到可执行文件的示例</td>
</tr>
<tr>
<td align="left">modscan</td>
<td align="left">内核模块池扫描</td>
</tr>
<tr>
<td align="left">modules</td>
<td align="left">打印加载模块的列表</td>
</tr>
<tr>
<td align="left">multiscan</td>
<td align="left">批量扫描各种对象</td>
</tr>
<tr>
<td align="left">mutantscan</td>
<td align="left">对互斥对象池扫描</td>
</tr>
<tr>
<td align="left">notepad</td>
<td align="left">查看记事本当前显示的文本</td>
</tr>
<tr>
<td align="left">objtypescan</td>
<td align="left">扫描窗口对象类型对象</td>
</tr>
<tr>
<td align="left">patcher</td>
<td align="left">基于页面扫描的补丁程序内存</td>
</tr>
<tr>
<td align="left">poolpeek</td>
<td align="left">可配置的池扫描器插件</td>
</tr>
<tr>
<td align="left">printkey</td>
<td align="left">打印注册表项及其子项和值</td>
</tr>
<tr>
<td align="left">privs</td>
<td align="left">显示进程权限</td>
</tr>
<tr>
<td align="left">procdump</td>
<td align="left">进程转储到一个可执行文件示例</td>
</tr>
<tr>
<td align="left">pslist</td>
<td align="left">按照EPROCESS列表打印所有正在运行的进程</td>
</tr>
<tr>
<td align="left">psscan</td>
<td align="left">进程对象池扫描</td>
</tr>
<tr>
<td align="left">pstree</td>
<td align="left">以树型方式打印进程列表</td>
</tr>
<tr>
<td align="left">psxview</td>
<td align="left">查找带有隐藏进程的所有进程列表</td>
</tr>
<tr>
<td align="left">qemuinfo</td>
<td align="left">转储Qemu 信息</td>
</tr>
<tr>
<td align="left">raw2dmp</td>
<td align="left">将物理内存原生数据转换为windbg崩溃转储格式</td>
</tr>
<tr>
<td align="left">screenshot</td>
<td align="left">基于GDI Windows的虚拟屏幕截图保存</td>
</tr>
<tr>
<td align="left">servicediff</td>
<td align="left">Windows服务列表(ala Plugx)</td>
</tr>
<tr>
<td align="left">sessions</td>
<td align="left">_MM_SESSION_SPACE的详细信息列表(用户登录会话)</td>
</tr>
<tr>
<td align="left">shellbags</td>
<td align="left">打印Shellbags信息</td>
</tr>
<tr>
<td align="left">shimcache</td>
<td align="left">解析应用程序兼容性Shim缓存注册表项</td>
</tr>
<tr>
<td align="left">shutdowntime</td>
<td align="left">从内存中的注册表信息获取机器关机时间</td>
</tr>
<tr>
<td align="left">sockets</td>
<td align="left">打印已打开套接字列表</td>
</tr>
<tr>
<td align="left">sockscan</td>
<td align="left">TCP套接字对象池扫描</td>
</tr>
<tr>
<td align="left">ssdt</td>
<td align="left">显示SSDT条目</td>
</tr>
<tr>
<td align="left">strings</td>
<td align="left">物理到虚拟地址的偏移匹配(需要一些时间，带详细信息)</td>
</tr>
<tr>
<td align="left">svcscan</td>
<td align="left">Windows服务列表扫描</td>
</tr>
<tr>
<td align="left">symlinkscan</td>
<td align="left">符号链接对象池扫描</td>
</tr>
<tr>
<td align="left">thrdscan</td>
<td align="left">线程对象池扫描</td>
</tr>
<tr>
<td align="left">threads</td>
<td align="left">调查_ETHREAD 和_KTHREADs</td>
</tr>
<tr>
<td align="left">timeliner</td>
<td align="left">创建内存中的各种痕迹信息的时间线</td>
</tr>
<tr>
<td align="left">timers</td>
<td align="left">打印内核计时器及关联模块的DPC</td>
</tr>
<tr>
<td align="left">truecryptmaster</td>
<td align="left">恢复TrueCrypt 7.1a主密钥</td>
</tr>
<tr>
<td align="left">truecryptpassphrase</td>
<td align="left">查找并提取TrueCrypt密码</td>
</tr>
<tr>
<td align="left">truecryptsummary</td>
<td align="left">TrueCrypt摘要信息</td>
</tr>
<tr>
<td align="left">unloadedmodules</td>
<td align="left">打印卸载的模块信息列表</td>
</tr>
<tr>
<td align="left">userassist</td>
<td align="left">打印注册表中UserAssist相关信息</td>
</tr>
<tr>
<td align="left">userhandles</td>
<td align="left">转储用户句柄表</td>
</tr>
<tr>
<td align="left">vaddump</td>
<td align="left">转储VAD数据为文件</td>
</tr>
<tr>
<td align="left">vadinfo</td>
<td align="left">转储VAD信息</td>
</tr>
<tr>
<td align="left">vadtree</td>
<td align="left">以树形方式显示VAD树信息</td>
</tr>
<tr>
<td align="left">vadwalk</td>
<td align="left">显示遍历VAD树</td>
</tr>
<tr>
<td align="left">vboxinfo</td>
<td align="left">转储Virtualbox信息（虚拟机）</td>
</tr>
<tr>
<td align="left">verinfo</td>
<td align="left">打印PE镜像中的版本信息</td>
</tr>
<tr>
<td align="left">vmwareinfo</td>
<td align="left">转储VMware VMSS/VMSN 信息</td>
</tr>
<tr>
<td align="left">volshell</td>
<td align="left">内存镜像中的shell</td>
</tr>
<tr>
<td align="left">windows</td>
<td align="left">打印桌面窗口(详细信息)</td>
</tr>
<tr>
<td align="left">wintree</td>
<td align="left">Z顺序打印桌面窗口树</td>
</tr>
<tr>
<td align="left">wndscan</td>
<td align="left">池扫描窗口站</td>
</tr>
<tr>
<td align="left">yarascan</td>
<td align="left">以Yara签名扫描进程或内核内存</td>
</tr>
</tbody></table>
<h3 id="常用命令"><a href="#常用命令" class="headerlink" title="常用命令#"></a>常用命令<a href="https://wiki.wgpsec.org/knowledge/ctf/Volatility.html#%E5%B8%B8%E7%94%A8%E5%91%BD%E4%BB%A4">#</a></h3><table>
<thead>
<tr>
<th align="left">功能</th>
<th align="left">命令行及参数</th>
</tr>
</thead>
<tbody><tr>
<td align="left">查看进程列表</td>
<td align="left">Vol.exe -f Win7_SP1_x86.vmem –profile=Win7SP1x86 pslist</td>
</tr>
<tr>
<td align="left">查看进程列表（树形）</td>
<td align="left">Vol.exe -f Win7_SP1_x86.vmem –profile=Win7SP1x86 pstree</td>
</tr>
<tr>
<td align="left">查看进程列表(psx视图)</td>
<td align="left">Vol.exe -f Win7_SP1_x86.vmem –profile=Win7SP1x86 psxview</td>
</tr>
<tr>
<td align="left">查看网络通讯连接</td>
<td align="left">Vol.exe -f Win7_SP1_x86.vmem –profile=Win7SP1x86 netscan</td>
</tr>
<tr>
<td align="left">查看加载的动态链接库</td>
<td align="left">Vol.exe -f Win7_SP1_x86.vmem –profile=Win7SP1x86 dlllist</td>
</tr>
<tr>
<td align="left">查看SSDT表</td>
<td align="left">Vol.exe -f Win7_SP1_x86.vmem –profile=Win7SP1x86 ssdt</td>
</tr>
<tr>
<td align="left">查看UserAssist痕迹</td>
<td align="left">Vol.exe -f Win7_SP1_x86.vmem –profile=Win7SP1x86 userassist</td>
</tr>
<tr>
<td align="left">查看ShimCache痕迹</td>
<td align="left">Vol.exe -f Win7_SP1_x86.vmem –profile=Win7SP1x86 shimcache</td>
</tr>
<tr>
<td align="left">查看ShellBags</td>
<td align="left">Vol.exe -f Win7_SP1_x86.vmem –profile=Win7SP1x86 shellbags</td>
</tr>
<tr>
<td align="left">查看服务列表</td>
<td align="left">Vol.exe -f Win7_SP1_x86.vmem –profile=Win7SP1x86 svcscan</td>
</tr>
<tr>
<td align="left">查看Windows帐户hash</td>
<td align="left">Vol.exe -f Win7_SP1_x86.vmem –profile=Win7SP1x86 hashdump</td>
</tr>
<tr>
<td align="left">查看最后关机时间</td>
<td align="left">Vol.exe -f Win7_SP1_x86.vmem –profile=Win7SP1x86 shutdowntime</td>
</tr>
<tr>
<td align="left">查看IE历史记录</td>
<td align="left">Vol.exe -f Win7_SP1_x86.vmem –profile=Win7SP1x86 iehistory</td>
</tr>
<tr>
<td align="left">提取注册表数据</td>
<td align="left">Vol.exe -f Win7_SP1_x86.vmem –profile=Win7SP1x86 dumpregistry</td>
</tr>
<tr>
<td align="left">解析MFT记录</td>
<td align="left">Vol.exe -f Win7_SP1_x86.vmem –profile=Win7SP1x86 mftparser</td>
</tr>
<tr>
<td align="left">导出MFT记录,恢复文件</td>
<td align="left">Vol.exe -f Win7_SP1_x86.vmem –profile=Win7SP1x86 mftparser –output-file=mftverbose.txt -D mftoutput</td>
</tr>
<tr>
<td align="left">获取TrueCrypt密钥信息</td>
<td align="left">Vol.exe -f Win7_SP1_x86.vmem –profile=Win7SP1x86 truecryptmaster</td>
</tr>
<tr>
<td align="left">获取TrueCrypt密码信息</td>
<td align="left">Vol.exe -f Win7_SP1_x86.vmem –profile=Win7SP1x86 truecryptpassphras</td>
</tr>
</tbody></table>
<h2 id="参考文章"><a href="#参考文章" class="headerlink" title="参考文章#"></a>参考文章<a href="https://wiki.wgpsec.org/knowledge/ctf/Volatility.html#%E5%8F%82%E8%80%83%E6%96%87%E7%AB%A0">#</a></h2><h2 id=""><a href="#" class="headerlink" title=""></a></h2><p>Volatility入门指令篇：</p>
<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">volatility -f name imageinfo</span><br><span class="line">volatility -f name pslist --profile=WinXPSP2x86 </span><br><span class="line">列举进程：</span><br><span class="line">volatility -f name --profile=Win7SP1x64 volshell</span><br><span class="line">dt("_PEB") </span><br><span class="line">查看进程环境块境块</span><br></pre></td></tr></table></figure>
<p><strong>hivedump打印出注册表中的数据 ：</strong></p>
<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">volatility -f name --profile=Win7SP1x64 hivelist</span><br><span class="line">列举缓存在内存的注册表</span><br><span class="line">volatility -f name --profile=WinXPSP2x86 hivedump -o 注册表的 virtual 地址</span><br><span class="line">volatility -f windows.vmem --profile=Win7SP1x64 dumpregistry -o 注册表的 virtual 地址-D .</span><br><span class="line"></span><br></pre></td></tr></table></figure>
<p><strong>显示每个进程的加载dll列表</strong></p>
<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">Volatility -f name -profile = Win7SP0x86 dlllist> dlllist.txt</span><br></pre></td></tr></table></figure>
<p><strong>获取SAM表中的用户：</strong></p>
<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">volatility -f name --profile=WinXPSP2x86 printkey -K "SAM\Domains\Account\Users\Names"</span><br></pre></td></tr></table></figure>
<p><strong>登陆账户系统</strong></p>
<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">volatility -f name --profile=WinXPSP2x86 printkey -K "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"</span><br></pre></td></tr></table></figure>
<p><strong>userassist键值包含系统或桌面执行文件的信息，如名称、路径、执行次数、最后一次执行时间等</strong></p>
<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">volatility -f name --profile=WinXPSP2x86 userassist</span><br></pre></td></tr></table></figure>
<p><strong>将内存中的某个进程数据以 dmp 的格式保存出来</strong></p>
<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">volatility -f name --profile=WinXPSP2x86 -p [PID] -D [dump 出的文件保存的目录]</span><br></pre></td></tr></table></figure>
<p><strong>提取内存中保留的 cmd 命令使用情况</strong></p>
<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">volatility -f name --profile=WinXPSP2x86 cmdscan</span><br></pre></td></tr></table></figure>
<p><strong>获取到当时的网络连接情况</strong></p>
<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">volatility -f name --profile=WinXPSP2x86 netscan</span><br></pre></td></tr></table></figure>
<p>获取 IE 浏览器的使用情况 ：</p>
<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">volatility -f name --profile=WinXPSP2x86 iehistory</span><br></pre></td></tr></table></figure>
<p><strong>获取内存中的系统密码，可以使用 hashdump 将它提取出来</strong></p>
<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">volatility -f name --profile=WinXPSP2x86 hashdump -y （注册表 system 的 virtual 地址 ）-s （SAM 的 virtual 地址）</span><br><span class="line">volatility -f WIN-BU6IJ7FI9RU-20190927-152050.raw--profile=Win7SP1x86_23418 hashdump -y 0x93fb7440 -s 0x93fc41e8 </span><br><span class="line">0x93fc41e8 0x030cf1e8 \SystemRoot\System32\Config\SAM</span><br><span class="line"></span><br><span class="line">volatility -f name --profile=WinXPSP2x86 hashdump -y 0xe1035b60 -s 0xe16aab60</span><br><span class="line">volatility -f name --profile=WinXPSP2x86 timeliner</span><br></pre></td></tr></table></figure>
<p><strong>对文件查找及dumo提取某个进程：</strong></p>
<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">volatility -f name --profile=Win7SP1x64 memdump -D . -p 2872</span><br><span class="line">strings -e l ./2872.dmp | grep flag</span><br><span class="line">volatility attachment.vmem -f Win7SP1x64--profile=Win7SP0x64 dumpfiles -Q 0xfffffa8002ffe550 -n --dump-dir=./</span><br></pre></td></tr></table></figure>
<p>0xfffffa8002f8f7c0 1148 0xc 0x100020 File \Device\HarddiskVolume1\Windows\System32<br>0xfffffa8002f9adf0 1148 0xd4 0x100001 File \Device\KsecDD</p>
<p>0xfffffa80032e6e90 1148 0x16c 0x100080 File \Device\Nsi</p>
<p>0xfffffa80032e3f20 1148 0x1c0 0x120089 File \Device\HarddiskVolume1\Windows\Registration\R000000000006.clb</p>
<p>0xfffffa80032e9f20 1148 0x1e8 0x12019f File \Device\00000040</p>
<p>0xfffffa80032f4970 1148 0x2d8 0x120089 File \Device\HarddiskVolume1\Windows\System32\zh-CN\KernelBase.dll.mui</p>
<p>0xfffffa8003429c80 1148 0x3f8 0x16019f File \Device\Afd\Endpoint</p>
<p>0xfffffa8002ffe550 1148 0x4dc 0x12019f File \Device\NamedPipe\wkssvc</p>
<p><strong>HASH匹配用户账户名密码：</strong></p>
<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">Hash, 然后使用john filename --format=NT破解</span><br></pre></td></tr></table></figure>
<p><strong>安全进程扫描</strong></p>
<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">volatility -f name --profile=Win7SP1x64 psscan</span><br></pre></td></tr></table></figure>
<p><strong>Flag字符串扫描：</strong></p>
<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">strings -e l 2616.dmp | grep flag</span><br></pre></td></tr></table></figure>
<p><strong>查找图片：</strong></p>
<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">volatility -f name--profile=Win7SP1x64 filescan | grep -E 'jpg|png|jpeg|bmp|gif</span><br><span class="line">volatility -f name --profile=Win7SP1x64 netscan</span><br></pre></td></tr></table></figure>
<p><strong>注册表解析</strong></p>
<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">volatility -f name --profile=Win7SP1x64hivelist</span><br><span class="line">volatility -f name --profile=Win7SP1x64 -o 0xfffff8a000024010 printkey -K "ControlSet001\Control;"</span><br><span class="line">hivedump打印出注册表中的数据 ：</span><br><span class="line">volatility -f name --profile=WinXPSP2x86 hivedump -o 注册表的 virtual 地址</span><br></pre></td></tr></table></figure>
<p><strong>复制、剪切版：</strong></p>
<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">volatility -f name --profile=Win7SP1x64 clipboard</span><br><span class="line">volatility -f name --profile=Win7SP1x64 dlllist -p 3820</span><br></pre></td></tr></table></figure>
<p><strong>Dump所有进程：</strong></p>
<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">volatility -f name --profile=Win7SP1x64 memdump -n chrome -D .</span><br><span class="line">利用字符串查找download</span><br><span class="line">python vol.py -f name --profile=Win7SP1x86 shimcache</span><br></pre></td></tr></table></figure>
<p><strong>svcscan查看服务</strong></p>
<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">python vol.py -f name --profile=Win7SP1x86 svcscan</span><br></pre></td></tr></table></figure>
<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">modules 查看内核驱动</span><br><span class="line">modscan、driverscan 可查看一些隐藏的内核驱动</span><br><span class="line">ShimCache来识别应用程序兼容性问题。跟踪文件路径，大小，最后修改时间和最后“执行”时间.</span><br></pre></td></tr></table></figure>
<p>volatility -f memory–profile=WinXPSP2x86 dumpfiles -Q 0x00000000053e9658 –dump-dir=./</p>
<p>mftparser：扫描内存中潜在的主文件表（MFT）条目（使用“FILE”和“BAAD”签名），并打印出当前某些属性的信息：$ FILE_NAME($ FN)，$ STANDARD_INFORMATION($ SI)，$FN和$SI属性来自$ATTRIBUTE_LIST，$OBJECT_ID(仅限默认输出)和常驻$DATA</p>
<h2 id="参考文章-1"><a href="#参考文章-1" class="headerlink" title="参考文章#"></a>参考文章<a href="https://wiki.wgpsec.org/knowledge/ctf/Volatility.html#%E5%8F%82%E8%80%83%E6%96%87%E7%AB%A0">#</a></h2><p><a href="http://www.secist.com/archives/2076.html">DumpIt.exe 进程(opens new window)</a></p>
<p><a href="https://www.freebuf.com/articles/system/26763.html">Volatility基本介绍(opens new window)</a></p>
<p><a href="https://www.cnblogs.com/sesefadou/p/11804566.html">基本命令(opens new window)</a></p>
<p><a href="https://blog.csdn.net/Kevinhanser/article/details/80013033?utm_source=blogxgwz5">组合命令(opens new window)</a></p>
<p><a href="https://www.cnblogs.com/0x4D75/p/11161822.html">进阶命令(opens new window)</a></p>
<p><a href="https://cloud.tencent.com/developer/article/1378638">基础题型和基本取证(opens new window)</a></p>
<p><a href="https://www.freebuf.com/sectool/124690.html">利用Volatility进行Windows内存取证分析(opens new window)</a></p>
<p><a href="https://www.sohu.com/a/350272484_100124117">windows取证(opens new window)</a></p>
<p><a href="https://blog.csdn.net/cqupt_chen/article/details/7771417">内存取证(opens new window)</a></p>
<h2 id="从题目学习Volatility取证"><a href="#从题目学习Volatility取证" class="headerlink" title="从题目学习Volatility取证#"></a>从题目学习Volatility取证<a href="https://wiki.wgpsec.org/knowledge/ctf/Volatility.html#%E4%BB%8E%E9%A2%98%E7%9B%AE%E5%AD%A6%E4%B9%A0volatility%E5%8F%96%E8%AF%81">#</a></h2><h3 id="四川省高校CTF大赛-安恒杯-Play-with-Cookie"><a href="#四川省高校CTF大赛-安恒杯-Play-with-Cookie" class="headerlink" title="四川省高校CTF大赛[安恒杯] - Play with Cookie#"></a>四川省高校CTF大赛[安恒杯] - Play with Cookie<a href="https://wiki.wgpsec.org/knowledge/ctf/Volatility.html#%E5%9B%9B%E5%B7%9D%E7%9C%81%E9%AB%98%E6%A0%A1ctf%E5%A4%A7%E8%B5%9B-%E5%AE%89%E6%81%92%E6%9D%AF-play-with-cookie">#</a></h3><p>文件描述：得到了master key file 的和靶机镜像文件，需要找到里面的flag</p>
<h4 id="了解基本架构"><a href="#了解基本架构" class="headerlink" title="了解基本架构#"></a>了解基本架构<a href="https://wiki.wgpsec.org/knowledge/ctf/Volatility.html#%E4%BA%86%E8%A7%A3%E5%9F%BA%E6%9C%AC%E6%9E%B6%E6%9E%84">#</a></h4><figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">sudo volatility -f Cookie.raw imageinfo</span><br></pre></td></tr></table></figure>
<p>得到的关键信息</p>
<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">Win7SP1x86</span><br><span class="line">mage date and time : 2020-02-11 12:11:51 UTC+0000</span><br></pre></td></tr></table></figure>
<p>关键看Suggested Profile(s)项，这里是工具判断该镜像的架构，同时也会提供相应架构的命令用于分析该镜像，本题中可能性最大的架构是Win7SP1x86，然后在调用命令时加上–profile=Win7SP1x86就可以了</p>
<h4 id="敏感信息获取"><a href="#敏感信息获取" class="headerlink" title="敏感信息获取#"></a>敏感信息获取<a href="https://wiki.wgpsec.org/knowledge/ctf/Volatility.html#%E6%95%8F%E6%84%9F%E4%BF%A1%E6%81%AF%E8%8E%B7%E5%8F%96">#</a></h4><p><code>获取所有使用的进程号的信息</code></p>
<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">sudo volatility -f Cookie.raw --profile=Win7SP1x86 pslist > pslist.txt </span><br></pre></td></tr></table></figure>
<p><code>查看一下是否含有flag文件</code></p>
<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">volatility -f Cookie.raw --profile=Win7SP1x86 filescan | grep "doc|docx|rtf"</span><br></pre></td></tr></table></figure>
<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">volatility -f Cookie.raw --profile=Win7SP1x86 filescan | grep "jpg|jpeg|png|tif|gif|bmp"</span><br></pre></td></tr></table></figure>
<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">volatility -f Cookie.raw --profile=Win7SP1x86 filescan | grep 'flag|ctf'</span><br></pre></td></tr></table></figure>
<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">volatility -f Cookie.raw --profile=Win7SP1x86 filescan | grep "Desktop"</span><br></pre></td></tr></table></figure>
<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">C:\home\kali\桌面> volatility -f Cookie.raw --profile=Win7SP1x86 filescan | grep "Desktop"</span><br><span class="line">Volatility Foundation Volatility Framework 2.6</span><br><span class="line">0x000000003e423038 1 0 R--rwd \Device\HarddiskVolume1\Users\Cookie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini</span><br><span class="line">0x000000003e486038 1 0 R--rwd \Device\HarddiskVolume1\Users\Cookie\Desktop\desktop.ini</span><br><span class="line">0x000000003e4ebb08 1 0 R--rwd \Device\HarddiskVolume1\Users\Public\Desktop\desktop.ini</span><br><span class="line">0x000000003e51c3a0 1 0 R--rwd \Device\HarddiskVolume1\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini</span><br><span class="line">0x000000003e5789e0 1 1 R--rw- \Device\HarddiskVolume1\Users\Cookie\Desktop</span><br><span class="line">0x000000003e5f1668 2 1 R--rwd \Device\HarddiskVolume1\Users\Cookie\Desktop</span><br><span class="line">0x000000003e628400 1 0 R--rwd \Device\HarddiskVolume1\Users\root\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini</span><br><span class="line">0x000000003e663160 1 0 R--rwd \Device\HarddiskVolume1\Windows\assembly\Desktop.ini</span><br><span class="line">0x000000003e66a228 1 1 RW-rw- \Device\HarddiskVolume1\Users\Cookie\Desktop\WIN-I0396FOVLRF-20200211-121148.raw</span><br><span class="line">0x000000003e671d28 8 0 R--r-d \Device\HarddiskVolume1\Users\Cookie\Desktop\DumpIt.exe</span><br><span class="line">0x000000003e69ef80 1 0 R--rwd \Device\HarddiskVolume1\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini</span><br><span class="line">0x000000003e6a9d28 2 1 R--rwd \Device\HarddiskVolume1\Users\Public\Desktop</span><br><span class="line">0x000000003e6aacb8 1 0 R--rwd \Device\HarddiskVolume1\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini</span><br><span class="line">0x000000003e6ff950 8 0 R--r-d \Device\HarddiskVolume1\Users\Cookie\Desktop\DumpIt.exe</span><br><span class="line">0x000000003e70d308 1 0 R--rwd \Device\HarddiskVolume1\Windows\Media\Desktop.ini</span><br><span class="line">0x000000003e73af80 1 0 R--rwd \Device\HarddiskVolume1\Users\Cookie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini</span><br><span class="line">0x000000003e90e718 1 0 R--rwd \Device\HarddiskVolume1\Users\Cookie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini</span><br><span class="line">0x000000003e919910 1 0 R--rwd \Device\HarddiskVolume1\Users\Cookie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini</span><br><span class="line">0x000000003e93f578 1 0 R--rwd \Device\HarddiskVolume1\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini</span><br><span class="line">0x000000003e95bc98 1 0 R--rwd \Device\HarddiskVolume1\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini</span><br><span class="line">0x000000003eb33bc8 2 1 R--rwd \Device\HarddiskVolume1\Users\Cookie\Desktop</span><br><span class="line">0x000000003f3f55c0 2 1 R--rwd \Device\HarddiskVolume1\Users\Public\Desktop</span><br><span class="line">0x000000003f9871d8 1 0 R--rwd \Device\HarddiskVolume1\Users\root\Desktop\desktop.ini</span><br><span class="line">0x000000003fca7630 1 0 R--rwd \Device\HarddiskVolume1\Users\Cookie\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini</span><br></pre></td></tr></table></figure>
<p>这是查看raw文件中的桌面文件，没有得到有用的信息，只得知了是Cookie用户</p>
<p><code>查看一下他的电脑截图</code></p>
<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">volatility -f Cookie.rwa --profile=Win7SP1x86 screenshot --dump-dir=./</span><br></pre></td></tr></table></figure>
<p>只得到了一个页面信息，提示正在使用的进程是DUMpit.exe</p>
<p><code>看一下用户信息</code></p>
<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">volatility -f Cookie.raw --profile=Win7SP1x86 printkey -K "SAM\Domains\Account\Users\Names"</span><br></pre></td></tr></table></figure>
<p>只有基本的几个用户</p>
<p><code>看一下他的命令行输出了什么</code></p>
<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">volatility -f Cookie.raw --profile=Win7SP1x86 cmdline</span><br></pre></td></tr></table></figure>
<p>可以看到一些cmd信息和进程号</p>
<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">Volatility Foundation Volatility Framework 2.6</span><br><span class="line">************************************************************************</span><br><span class="line">System pid: 4</span><br><span class="line">************************************************************************</span><br><span class="line">smss.exe pid: 272</span><br><span class="line">Command line : \SystemRoot\System32\smss.exe</span><br><span class="line">************************************************************************</span><br><span class="line">csrss.exe pid: 360</span><br><span class="line">Command line : %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16</span><br><span class="line">************************************************************************</span><br><span class="line">wininit.exe pid: 412</span><br><span class="line">Command line : wininit.exe</span><br><span class="line">************************************************************************</span><br><span class="line">csrss.exe pid: 420</span><br><span class="line">Command line : %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16</span><br><span class="line">************************************************************************</span><br><span class="line">winlogon.exe pid: 480</span><br><span class="line">Command line : winlogon.exe</span><br><span class="line">************************************************************************</span><br><span class="line">services.exe pid: 520</span><br><span class="line">Command line : C:\Windows\system32\services.exe</span><br><span class="line">************************************************************************</span><br><span class="line">lsass.exe pid: 528</span><br><span class="line">Command line : C:\Windows\system32\lsass.exe</span><br><span class="line">************************************************************************</span><br><span class="line">lsm.exe pid: 536</span><br><span class="line">Command line : C:\Windows\system32\lsm.exe</span><br><span class="line">************************************************************************</span><br><span class="line">svchost.exe pid: 636</span><br><span class="line">Command line : C:\Windows\system32\svchost.exe -k DcomLaunch</span><br><span class="line">************************************************************************</span><br><span class="line">svchost.exe pid: 716</span><br><span class="line">Command line : C:\Windows\system32\svchost.exe -k RPCSS</span><br><span class="line">************************************************************************</span><br><span class="line">svchost.exe pid: 808</span><br><span class="line">Command line : C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted</span><br><span class="line">************************************************************************</span><br><span class="line">svchost.exe pid: 844</span><br><span class="line">Command line : C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted</span><br><span class="line">************************************************************************</span><br><span class="line">svchost.exe pid: 876</span><br><span class="line">Command line : C:\Windows\system32\svchost.exe -k netsvcs</span><br><span class="line">************************************************************************</span><br><span class="line">audiodg.exe pid: 956</span><br><span class="line">Command line : C:\Windows\system32\AUDIODG.EXE 0x2e8</span><br><span class="line">************************************************************************</span><br><span class="line">svchost.exe pid: 1036</span><br><span class="line">Command line : C:\Windows\system32\svchost.exe -k LocalService</span><br><span class="line">************************************************************************</span><br><span class="line">svchost.exe pid: 1132</span><br><span class="line">Command line : C:\Windows\system32\svchost.exe -k NetworkService</span><br><span class="line">************************************************************************</span><br><span class="line">spoolsv.exe pid: 1280</span><br><span class="line">Command line : C:\Windows\System32\spoolsv.exe</span><br><span class="line">************************************************************************</span><br><span class="line">svchost.exe pid: 1376</span><br><span class="line">Command line : C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork</span><br><span class="line">************************************************************************</span><br><span class="line">VGAuthService. pid: 1560</span><br><span class="line">Command line : "C:\Program Files\VMware\VMware Tools\VMware VGAuth\VGAuthService.exe"</span><br><span class="line">************************************************************************</span><br><span class="line">vmtoolsd.exe pid: 1584</span><br><span class="line">Command line : "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe"</span><br><span class="line">************************************************************************</span><br><span class="line">svchost.exe pid: 1824</span><br><span class="line">Command line : C:\Windows\system32\svchost.exe -k bthsvcs</span><br><span class="line">************************************************************************</span><br><span class="line">dllhost.exe pid: 128</span><br><span class="line">Command line : C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}</span><br><span class="line">************************************************************************</span><br><span class="line">msdtc.exe pid: 596</span><br><span class="line">Command line : C:\Windows\System32\msdtc.exe</span><br><span class="line">************************************************************************</span><br><span class="line">WmiPrvSE.exe pid: 920</span><br><span class="line">Command line : C:\Windows\system32\wbem\wmiprvse.exe</span><br><span class="line">************************************************************************</span><br><span class="line">taskhost.exe pid: 2096</span><br><span class="line">Command line : "taskhost.exe"</span><br><span class="line">************************************************************************</span><br><span class="line">dwm.exe pid: 2188</span><br><span class="line">Command line : "C:\Windows\system32\Dwm.exe"</span><br><span class="line">************************************************************************</span><br><span class="line">explorer.exe pid: 2216</span><br><span class="line">Command line : C:\Windows\Explorer.EXE</span><br><span class="line">************************************************************************</span><br><span class="line">vm3dservice.ex pid: 2404</span><br><span class="line">Command line : "C:\Windows\System32\vm3dservice.exe" -u</span><br><span class="line">************************************************************************</span><br><span class="line">vmtoolsd.exe pid: 2412</span><br><span class="line">Command line : "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr</span><br><span class="line">************************************************************************</span><br><span class="line">SearchIndexer. pid: 2584</span><br><span class="line">Command line : C:\Windows\system32\SearchIndexer.exe /Embedding</span><br><span class="line">************************************************************************</span><br><span class="line">WmiPrvSE.exe pid: 2764</span><br><span class="line">Command line : C:\Windows\system32\wbem\wmiprvse.exe</span><br><span class="line">************************************************************************</span><br><span class="line">svchost.exe pid: 3224</span><br><span class="line">Command line : C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation</span><br><span class="line">************************************************************************</span><br><span class="line">sppsvc.exe pid: 3272</span><br><span class="line">Command line : C:\Windows\system32\sppsvc.exe</span><br><span class="line">************************************************************************</span><br><span class="line">svchost.exe pid: 3344</span><br><span class="line">Command line : C:\Windows\System32\svchost.exe -k secsvcs</span><br><span class="line">************************************************************************</span><br><span class="line">taskhost.exe pid: 2924</span><br><span class="line">Command line : taskhost.exe $(Arg0)</span><br><span class="line">************************************************************************</span><br><span class="line">SearchProtocol pid: 3520</span><br><span class="line">Command line : "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe5_ Global\UsGthrCtrlFltPipeMssGthrPipe5 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" </span><br><span class="line">************************************************************************</span><br><span class="line">SearchFilterHo pid: 2692</span><br><span class="line">Command line : "C:\Windows\system32\SearchFilterHost.exe" 0 532 536 544 65536 540 </span><br><span class="line">************************************************************************</span><br><span class="line">DumpIt.exe pid: 3632</span><br><span class="line">Command line : "C:\Users\Cookie\Desktop\DumpIt.exe" </span><br><span class="line">************************************************************************</span><br><span class="line">conhost.exe pid: 1684</span><br><span class="line">Command line : \??\C:\Windows\system32\conhost.exe</span><br><span class="line">************************************************************************</span><br><span class="line">dllhost.exe pid: 3552</span><br></pre></td></tr></table></figure>
<p>也没有得到关键的信息<br><code>看一下连接过的网络</code></p>
<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">volatility -f Cookie.raw --profile=Win7SP1x86 netscan</span><br></pre></td></tr></table></figure>
<p>看到在3分钟之后是未知的，回到进程查看一下他干了什么</p>
<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">sudo volatility -f Cookie.raw --profile=Win7SP1x86 pslist</span><br><span class="line">0x87da3d40 sppsvc.exe 3272 520 4 159 0 0 2020-02-11 12:03:00 UTC+0000 </span><br><span class="line">0x87cdbd40 svchost.exe 3344 520 9 310 0 0 2020-02-11 12:03:00 UTC+0000 </span><br><span class="line">0x87d65030 taskhost.exe 2924 520 8 181 0 0 2020-02-11 12:09:55 UTC+0000 </span><br><span class="line">0x87f2a550 SearchProtocol 3520 2584 7 320 0 0 2020-02-11 12:10:35 UTC+0000 </span><br></pre></td></tr></table></figure>
<p>这一段3~9分钟之间发生了一些事情让出题人等待了一下，上网查一下这些进程的含义以及使用的用途</p>
<p>把这个位置的进程dump出来加以分析一下</p>
<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">volatility -f Cookie.raw --profile=Win7SP1x86 memdump -p 2924 --dump-dir=./</span><br></pre></td></tr></table></figure>
<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">C:\home\kali\桌面> volatility -f Cookie.raw --profile=Win7SP1x86 memdump -p 2924 --dump-dir=./</span><br><span class="line">Volatility Foundation Volatility Framework 2.6</span><br><span class="line">************************************************************************</span><br><span class="line">Writing taskhost.exe [ 2924] to 2924.dmp</span><br></pre></td></tr></table></figure>
<p>得到一个2924.dmp文<br><code>关键字文件查找</code></p>
<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">strings 2924.dmp | grep flag{ ;strings 2924.dmp | grep DASCTF{ ;strings 2924.dmp | grep ctf{</span><br></pre></td></tr></table></figure>
<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">C:\home\kali\桌面> strings 2924.dmp | grep flag{ ;strings 2924.dmp | grep DASCTF{ ;strings 2924.dmp | grep ctf{</span><br><span class="line">$value = "flag{528c8870778d2336fdf512652b74a8aa}";</span><br></pre></td></tr></table></figure>
<p>得到flag</p>
<p>看一下文件里面是什么</p>
<h3 id="V-amp-N2020-公开赛-内存取证"><a href="#V-amp-N2020-公开赛-内存取证" class="headerlink" title="[V&N2020 公开赛]内存取证#"></a>[V&N2020 公开赛]内存取证<a href="https://wiki.wgpsec.org/knowledge/ctf/Volatility.html#v-n2020-%E5%85%AC%E5%BC%80%E8%B5%9B-%E5%86%85%E5%AD%98%E5%8F%96%E8%AF%81">#</a></h3><h4 id="查看基本文件架构"><a href="#查看基本文件架构" class="headerlink" title="查看基本文件架构#"></a>查看基本文件架构<a href="https://wiki.wgpsec.org/knowledge/ctf/Volatility.html#%E6%9F%A5%E7%9C%8B%E5%9F%BA%E6%9C%AC%E6%96%87%E4%BB%B6%E6%9E%B6%E6%9E%84">#</a></h4><h4 id="获取有利信息"><a href="#获取有利信息" class="headerlink" title="获取有利信息#"></a>获取有利信息<a href="https://wiki.wgpsec.org/knowledge/ctf/Volatility.html#%E8%8E%B7%E5%8F%96%E6%9C%89%E5%88%A9%E4%BF%A1%E6%81%AF">#</a></h4><p>扫描 记事本文件</p>
<figure class="highlight plain"><table><tr><td class="code"><pre><span class="line">kali@kali:~/桌面$ volatility -f mem.raw --profile=Win7SP0x86 filescan | grep not </span><br><span class="line">Volatility Foundation Volatility Framework 2.6 </span><br><span class="line">0x000000001de89cb8 6 0 R--r-d \Device\HarddiskVolume2\Windows\System32\notepad.exe</span><br></pre></td></tr></table></figure>
<p>dump进程查看文件，发现文件可能被删除</p>
<h4 id="删除数据恢复"><a href="#删除数据恢复" class="headerlink" title="删除数据恢复#"></a>删除数据恢复<a href="https://wiki.wgpsec.org/knowledge/ctf/Volatility.html#%E5%88%A0%E9%99%A4%E6%95%B0%E6%8D%AE%E6%81%A2%E5%A4%8D">#</a></h4><p>使用命令恢复数据</p>
<p>得到百度网盘链接和提取码，下载下来一个加密文件</p>
<p>寻找加密进程</p>
<p>dump进程下来 使用EFDD解密vol文件</p>
<p><code>得到密码:uOjFdKu1jsbWI8N51jsbWI8N5</code></p>
<p>再使用得到的密码TrueCrypt挂载上去解密</p>
<p>得到一个加密的flag压缩包</p>
<h4 id="GIMP还原"><a href="#GIMP还原" class="headerlink" title="GIMP还原#"></a>GIMP还原<a href="https://wiki.wgpsec.org/knowledge/ctf/Volatility.html#gimp%E8%BF%98%E5%8E%9F">#</a></h4><p>把 mspaint.exe (pid 2648) dump下来，使用GIMP还原</p>
<p><code>得到密码 :1YxfCQ6goYBD6Q</code></p>
<p>打开加密zip文件得到flag</p>
<p><code>RoarCTF{wm_D0uB1e_TC-cRypt}</code></p>
]]></content>
<categories>
<category>MISC</category>
</categories>
<tags>
<tag>MISC</tag>
<tag>forensic</tag>
</tags>
</entry>
<entry>
<title>文件检测</title>
<url>/2019/06/11/cnblog_11001628/</url>
<content><![CDATA[<h1 id="这是👉文件检测👈的摘要"><a href="#这是👉文件检测👈的摘要" class="headerlink" title="这是👉文件检测👈的摘要"></a><a href="../../../../2019/06/11/cnblog_11001628/">这是👉文件检测👈的摘要</a></h1><a id="more"></a>
<pre><code># -*- coding: utf-8 -*-
#use: python file_check.py ./
import os
import hashlib
import shutil
import ntpath
import time
CWD = os.getcwd()
FILE_MD5_DICT = {} # 文件MD5字典
ORIGIN_FILE_LIST = []
# 特殊文件路径字符串
Special_path_str = 'drops_JWI96TY7ZKNMQPDRUOSG0FLH41A3C5EXVB82'
bakstring = 'bak_EAR1IBM0JT9HZ75WU4Y3Q8KLPCX26NDFOGVS'
logstring = 'log_WMY4RVTLAJFB28960SC3KZX7EUP1IHOQN5GD'
webshellstring = 'webshell_WMY4RVTLAJFB28960SC3KZX7EUP1IHOQN5GD'
difffile = 'diff_UMTGPJO17F82K35Z0LEDA6QB9WH4IYRXVSCN'
Special_string = 'drops_log' # 免死金牌
UNICODE_ENCODING = "utf-8"
INVALID_UNICODE_CHAR_FORMAT = r"\?%02x"
# 文件路径字典
spec_base_path = os.path.realpath(os.path.join(CWD, Special_path_str))
Special_path = {
'bak' : os.path.realpath(os.path.join(spec_base_path, bakstring)),
'log' : os.path.realpath(os.path.join(spec_base_path, logstring)),
'webshell' : os.path.realpath(os.path.join(spec_base_path, webshellstring)),
'difffile' : os.path.realpath(os.path.join(spec_base_path, difffile)),
}
def isListLike(value):
return isinstance(value, (list, tuple, set))
# 获取Unicode编码
def getUnicode(value, encoding=None, noneToNull=False):
if noneToNull and value is None:
return NULL
if isListLike(value):
value = list(getUnicode(_, encoding, noneToNull) for _ in value)
return value
if isinstance(value, unicode):
return value
elif isinstance(value, basestring):
while True:
try:
return unicode(value, encoding or UNICODE_ENCODING)
except UnicodeDecodeError, ex:
try:
return unicode(value, UNICODE_ENCODING)
except:
value = value[:ex.start] + "".join(INVALID_UNICODE_CHAR_FORMAT % ord(_) for _ in value[ex.start:ex.end]) + value[ex.end:]
else:
try:
return unicode(value)
except UnicodeDecodeError:
return unicode(str(value), errors="ignore")
# 目录创建
def mkdir_p(path):
import errno
try:
os.makedirs(path)
except OSError as exc:
if exc.errno == errno.EEXIST and os.path.isdir(path):
pass
else: raise
# 获取当前所有文件路径
def getfilelist(cwd):
filelist = []
for root,subdirs, files in os.walk(cwd):
for filepath in files:
originalfile = os.path.join(root, filepath)
if Special_path_str not in originalfile:
filelist.append(originalfile)
return filelist
# 计算机文件MD5值
def calcMD5(filepath):
try:
with open(filepath,'rb') as f:
md5obj = hashlib.md5()
md5obj.update(f.read())
hash = md5obj.hexdigest()
return hash
except Exception, e:
print u'[!] getmd5_error : ' + getUnicode(filepath)
print getUnicode(e)
try:
ORIGIN_FILE_LIST.remove(filepath)
FILE_MD5_DICT.pop(filepath, None)
except KeyError, e:
pass
# 获取所有文件MD5
def getfilemd5dict(filelist = []):
filemd5dict = {}
for ori_file in filelist:
if Special_path_str not in ori_file:
md5 = calcMD5(os.path.realpath(ori_file))
if md5:
filemd5dict[ori_file] = md5
return filemd5dict
# 备份所有文件
def backup_file(filelist=[]):
# if len(os.listdir(Special_path['bak'])) == 0:
for filepath in filelist:
if Special_path_str not in filepath:
shutil.copy2(filepath, Special_path['bak'])
if __name__ == '__main__':
print u'---------start------------'
for value in Special_path:
mkdir_p(Special_path[value])
# 获取所有文件路径，并获取所有文件的MD5，同时备份所有文件
ORIGIN_FILE_LIST = getfilelist(CWD)
FILE_MD5_DICT = getfilemd5dict(ORIGIN_FILE_LIST)
backup_file(ORIGIN_FILE_LIST) # TODO 备份文件可能会产生重名BUG
print u'[*] pre work end!'
while True:
file_list = getfilelist(CWD)
# 移除新上传文件
diff_file_list = list(set(file_list) ^ set(ORIGIN_FILE_LIST))
if len(diff_file_list) != 0:
# import pdb;pdb.set_trace()
for filepath in diff_file_list:
try:
f = open(filepath, 'r').read()
except Exception, e:
break
if Special_string not in f:
try:
print u'[*] webshell find : ' + getUnicode(filepath)
shutil.move(filepath, os.path.join(Special_path['webshell'], ntpath.basename(filepath) + '.txt'))
except Exception as e:
print u'[!] move webshell error, "%s" maybe is webshell.'%getUnicode(filepath)
try:
f = open(os.path.join(Special_path['log'], 'log.txt'), 'a')
f.write('newfile: ' + getUnicode(filepath) + ' : ' + str(time.ctime()) + '\n')
f.close()
except Exception as e:
print u'[-] log error : file move error: ' + getUnicode(e)
# 防止任意文件被修改,还原被修改文件
md5_dict = getfilemd5dict(ORIGIN_FILE_LIST)
for filekey in md5_dict:
if md5_dict[filekey] != FILE_MD5_DICT[filekey]:
try:
f = open(filekey, 'r').read()
except Exception, e:
break
if Special_string not in f:
try:
print u'[*] file had be change : ' + getUnicode(filekey)
shutil.move(filekey, os.path.join(Special_path['difffile'], ntpath.basename(filekey) + '.txt'))
shutil.move(os.path.join(Special_path['bak'], ntpath.basename(filekey)), filekey)
except Exception as e:
print u'[!] move webshell error, "%s" maybe is webshell.'%getUnicode(filekey)
try:
f = open(os.path.join(Special_path['log'], 'log.txt'), 'a')
f.write('diff_file: ' + getUnicode(filekey) + ' : ' + getUnicode(time.ctime()) + '\n')
f.close()
except Exception as e:
print u'[-] log error : done_diff: ' + getUnicode(filekey)
pass
time.sleep(2)
# print '[*] ' + getUnicode(time.ctime())
作者：Mr_Shadowalker
链接：https://www.jianshu.com/p/25535f0b98d4
來源：简书
简书著作权归作者所有，任何形式的转载都请联系作者获得授权并注明出处。</code></pre>
]]></content>
<categories>
<category>笔记</category>
</categories>
<tags>
<tag>博客园</tag>
<tag>搬家</tag>
</tags>
</entry>
<entry>
<title>bugku ctf 逆向题</title>
<url>/2019/05/16/cnblog_10875920/</url>
<content><![CDATA[<h1 id="这是👉bugku-ctf-逆向题👈的摘要"><a href="#这是👉bugku-ctf-逆向题👈的摘要" class="headerlink" title="这是👉bugku ctf 逆向题👈的摘要"></a><a href="../../../../2019/05/16/cnblog_10875920/">这是👉bugku ctf 逆向题👈的摘要</a></h1><a id="more"></a>
<p>1.逆向入门</p>
<p><img src="https://img2018.cnblogs.com/blog/1619455/201905/1619455-20190518104126835-507743099.png"></p>
<p>2.Easy_vb</p>
<p>直接找出来。</p>
<p><img src="https://img2018.cnblogs.com/blog/1619455/201905/1619455-20190516151507043-1952365141.png"></p>
<p>3.easy_re</p>
<p><img src="https://img2018.cnblogs.com/blog/1619455/201905/1619455-20190520140107490-694324659.png"></p>
<p>4.游戏过关</p>
<p>摁着嗯着就出来了。。。</p>
<p>5.Timer{阿里ctf}</p>
<p>apk文件，不会搞。</p>
<p>6.逆向入门</p>
<p>发现是base64，直接转图片</p>
<p><img src="https://img2018.cnblogs.com/blog/1619455/201905/1619455-20190520140212958-1627325468.png"></p>
<p>7.love</p>
]]></content>
<categories>
<category>笔记</category>
</categories>
<tags>
<tag>博客园</tag>
<tag>搬家</tag>
</tags>
</entry>
<entry>
<title>ios快捷指令编程尝试</title>
<url>/2020/03/02/cnblog_12395416/</url>
<content><![CDATA[<h1 id="这是👉ios快捷指令编程尝试👈的摘要"><a href="#这是👉ios快捷指令编程尝试👈的摘要" class="headerlink" title="这是👉ios快捷指令编程尝试👈的摘要"></a><a href="../../../../2020/03/02/cnblog_12395416/">这是👉ios快捷指令编程尝试👈的摘要</a></h1><a id="more"></a>
<p>最近，，，啊好几个月了，发现这个ios的快捷指令很好玩</p>
<p>原生就提供了不少功能</p>
<p>用来练习编程思维是十分有用啊。。。）</p>
<p><img src="https://img2020.cnblogs.com/i-beta/1619455/202003/1619455-20200302140601174-724432380.png"></p>
<p>其次呢，还可以使用外接的功能对原有的功能进行拓展，比如api借口啊，ssh执行程序啊，之类的</p>
<p>之前呢，就找到了一个每天播报信息的指令，早上当作闹铃使用，又自己写了一点，自动给女朋友发信息emmm</p>
<p>今天突发奇想，想尝试做一个小爬虫，先拿自己的ftp服务器尝试了一下，过程有点费劲，这官方文档介绍太简洁了。。</p>
<pre><code>https://support.apple.com/zh-cn/guide/shortcuts/apdf22b0444c/ios</code></pre>
<p><img src="https://img2020.cnblogs.com/i-beta/1619455/202003/1619455-20200302141433281-354796698.png"></p>
<p> 但是呢，最终20个操作就成功完成了二级目录爬图片的操作。</p>
<p>这个使用ipad操作呢，，还是有点不熟练，感觉影响速度。</p>
]]></content>
<categories>
<category>笔记</category>
</categories>
<tags>
<tag>博客园</tag>
<tag>搬家</tag>
</tags>
</entry>
<entry>
<title>n赛 内存取证题解（已更新）</title>
<url>/2020/03/01/cnblog_12389284/</url>
<content><![CDATA[<h1 id="这是👉n赛-内存取证题解（已更新）👈的摘要"><a href="#这是👉n赛-内存取证题解（已更新）👈的摘要" class="headerlink" title="这是👉n赛 内存取证题解（已更新）👈的摘要"></a><a href="../../../../2020/03/01/cnblog_12389284/">这是👉n赛 内存取证题解（已更新）👈的摘要</a></h1><a id="more"></a>
<p>题目是一个raw的镜像文件</p>
<p>用volatility搜索一下进程</p>
<p>有正常的notepad，msprint，还有dumpit和truecrypt</p>
<pre><code>volatility -f mem.raw --profile=Win7SP1x86_23418 iehistory</code></pre>
<p>查看ie历史的时候有一个百度网盘的连接但是没有密码</p>
<p>提示放出了 记事本</p>
<p>但是查notepad实在是没有什么收获</p>
<p>上取证大师</p>
<p><img src="https://img2018.cnblogs.com/i-beta/1619455/202003/1619455-20200301123933213-888119838.png"></p>
<p> 这就很好用，恢复一下格式化了的数据，直接搜索txt后缀找到了提取码</p>
<p>本来以为这题目就差不多了</p>
<p>然后又下载下来一个加密文件VOL，扔到取证大师里显示truecrypt加密。</p>
<p>去找内存密钥，直接truecrypt加密程序应该就可以</p>
<p>在取证大师里同一个文件夹下找到了一个ky文件，试了试，解出来了</p>
<p><img src="https://img2018.cnblogs.com/i-beta/1619455/202003/1619455-20200301124839816-417341318.png"></p>
<p><img src="https://img2018.cnblogs.com/i-beta/1619455/202003/1619455-20200301124917531-968604686.png"></p>
<p> 拿到了key，但是后来有大佬告诉我直接EFDD就能解出key</p>
<p>然后手里拿着这个key懵了很久，以为是手动磁盘恢复，后来突然开了个脑洞，我拿key当作密码又重新解了一次truecrypt，竟然成功了</p>
<p><img src="https://img2018.cnblogs.com/i-beta/1619455/202003/1619455-20200301125500822-1277690857.png"></p>
<p> ok，一个加密的zip文件，密码不知道是啥。</p>
<p>又回去找密码，ie，记事本，dumpit都用到了</p>
<p>图片那里还没怎么用到，按照基本操作从内存恢复了几张图片</p>
<pre><code>volatility -f mem.raw --profile=Win7SP1x86_23418 filescan |grep -E 'jpg|png|jpeg|bmp|gif'</code></pre>
<p>没什么结果，还有一个姿势是用gimp看dump出来的msprint.exe的数据。</p>
<p>奈何我调不出来</p>