猜测dump文件的profile值
root@kali:~/CTF# volatility -f mem.vmem imageinfo Volatility Foundation Volatility Framework 2.6 INFO : volatility.debug : Determining profile based on KDBG search... Suggested Profile(s) : WinXPSP2x86, WinXPSP3x86 (Instantiated with WinXPSP2x86) AS Layer1 : IA32PagedMemoryPae (Kernel AS) AS Layer2 : FileAddressSpace (/root/CTF/mem.vmem) PAE type : PAE DTB : 0xb18000L KDBG : 0x80546ae0L Number of Processors : 1 Image Type (Service Pack) : 3 KPCR for CPU 0 : 0xffdff000L KUSER_SHARED_DATA : 0xffdf0000L Image date and time : 2016-05-03 04:41:19 UTC+0000 Image local date and time : 2016-05-03 12:41:19 +0800 root@kali:~/CTF
看到,profile可能是WinXPSP2x86
直接获取volshell
shell的命令: dt("内核关键数据结构名称"") 如: dt("_PEB") root@kali:~/CTF# volatility -f mem.vmem --profile=WinXPSP2x86 volshell Volatility Foundation Volatility Framework 2.6 Current context: System @ 0x821b9830, pid=4, ppid=0 DTB=0xb18000 Welcome to volshell! Current memory image is: file:///root/CTF/mem.vmem To get help, type 'hh()' >>> dt("_PEB") '_PEB' (528 bytes) 0x0 : InheritedAddressSpace ['unsigned char'] 0x1 : ReadImageFileExecOptions ['unsigned char'] 0x2 : BeingDebugged ['unsigned char'] 0x3 : SpareBool ['unsigned char'] 0x4 : Mutant ['pointer', ['void']] 0x8 : ImageBaseAddress ['pointer', ['void']] 0xc : Ldr ['pointer', ['_PEB_LDR_DATA']] 0x10 : ProcessParameters ['pointer', ['_RTL_USER_PROCESS_PARAMETERS']] 0x14 : SubSystemData ['pointer', ['void']] 0x18 : ProcessHeap ['pointer', ['void']] 0x1c : FastPebLock ['pointer', ['_RTL_CRITICAL_SECTION']] 0x20 : FastPebLockRoutine ['pointer', ['void']] 0x24 : FastPebUnlockRoutine ['pointer', ['void']] 0x28 : EnvironmentUpdateCount ['unsigned long'] 0x2c : KernelCallbackTable ['pointer', ['void']] 0x30 : SystemReserved ['array', 1, ['unsigned long']] 0x34 : AtlThunkSListPtr32 ['unsigned long'] 0x38 : FreeList ['pointer', ['_PEB_FREE_BLOCK']] 0x3c : TlsExpansionCounter ['unsigned long'] 0x40 : TlsBitmap ['pointer', ['void']] 0x44 : TlsBitmapBits ['array', 2, ['unsigned long']] 0x4c : ReadOnlySharedMemoryBase ['pointer', ['void']] 0x50 : ReadOnlySharedMemoryHeap ['pointer', ['void']] 0x54 : ReadOnlyStaticServerData ['pointer', ['pointer', ['void']]] 0x58 : AnsiCodePageData ['pointer', ['void']] 0x5c : OemCodePageData ['pointer', ['void']] 0x60 : UnicodeCaseTableData ['pointer', ['void']] 0x64 : NumberOfProcessors ['unsigned long'] 0x68 : NtGlobalFlag ['unsigned long'] 0x70 : CriticalSectionTimeout ['_LARGE_INTEGER'] 0x78 : HeapSegmentReserve ['unsigned long'] 0x7c : HeapSegmentCommit ['unsigned long'] 0x80 : HeapDeCommitTotalFreeThreshold ['unsigned long'] 0x84 : HeapDeCommitFreeBlockThreshold ['unsigned long'] 0x88 : NumberOfHeaps ['unsigned long'] 0x8c : MaximumNumberOfHeaps ['unsigned long'] 0x90 : ProcessHeaps ['pointer', ['array', <function <lambda> at 0x7f88d57decf8>, ['pointer', ['_HEAP']]]] 0x94 : GdiSharedHandleTable ['pointer', ['void']] 0x98 : ProcessStarterHelper ['pointer', ['void']] 0x9c : GdiDCAttributeList ['unsigned long'] 0xa0 : LoaderLock ['pointer', ['void']] 0xa4 : OSMajorVersion ['unsigned long'] 0xa8 : OSMinorVersion ['unsigned long'] 0xac : OSBuildNumber ['unsigned short'] 0xae : OSCSDVersion ['unsigned short'] 0xb0 : OSPlatformId ['unsigned long'] 0xb4 : ImageSubsystem ['unsigned long'] 0xb8 : ImageSubsystemMajorVersion ['unsigned long'] 0xbc : ImageSubsystemMinorVersion ['unsigned long'] 0xc0 : ImageProcessAffinityMask ['unsigned long'] 0xc4 : GdiHandleBuffer ['array', 34, ['unsigned long']] 0x14c : PostProcessInitRoutine ['pointer', ['void']] 0x150 : TlsExpansionBitmap ['pointer', ['void']] 0x154 : TlsExpansionBitmapBits ['array', 32, ['unsigned long']] 0x1d4 : SessionId ['unsigned long'] 0x1d8 : AppCompatFlags ['_ULARGE_INTEGER'] 0x1e0 : AppCompatFlagsUser ['_ULARGE_INTEGER'] 0x1e8 : pShimData ['pointer', ['void']] 0x1ec : AppCompatInfo ['pointer', ['void']] 0x1f0 : CSDVersion ['_UNICODE_STRING'] 0x1f8 : ActivationContextData ['pointer', ['void']] 0x1fc : ProcessAssemblyStorageMap ['pointer', ['void']] 0x200 : SystemDefaultActivationContextData ['pointer', ['void']] 0x204 : SystemAssemblyStorageMap ['pointer', ['void']] 0x208 : MinimumStackCommit ['unsigned long'] >>>
查看进程:
root@kali:~/CTF# root@kali:~/CTF# volatility -f mem.vmem --profile=WinXPSP2x86 pslist Volatility Foundation Volatility Framework 2.6 Offset(V) Name PID PPID Thds Hnds Sess Wow64 Start Exit ---------- -------------------- ------ ------ ------ -------- ------ ------ ------------------------------ ------------------------------ 0x821b9830 System 4 0 62 253 ------ 0 0x81fb9210 smss.exe 552 4 3 19 ------ 0 2016-05-03 04:32:10 UTC+0000 0x81c14da0 csrss.exe 616 552 10 328 0 0 2016-05-03 04:32:12 UTC+0000 0x81f81880 winlogon.exe 640 552 18 449 0 0 2016-05-03 04:32:12 UTC+0000 0x8208fda0 services.exe 684 640 16 260 0 0 2016-05-03 04:32:12 UTC+0000 0x81c32b10 lsass.exe 696 640 18 333 0 0 2016-05-03 04:32:12 UTC+0000 0x820a19a0 vmacthlp.exe 852 684 1 25 0 0 2016-05-03 04:32:13 UTC+0000 0x81c30458 svchost.exe 864 684 18 201 0 0 2016-05-03 04:32:13 UTC+0000 0x81c67020 svchost.exe 948 684 11 238 0 0 2016-05-03 04:32:13 UTC+0000 0x81ce7da0 svchost.exe 1040 684 55 1103 0 0 2016-05-03 04:32:13 UTC+0000 0x81c25020 svchost.exe 1096 684 4 66 0 0 2016-05-03 04:32:13 UTC+0000 0x82002b28 svchost.exe 1256 684 13 194 0 0 2016-05-03 04:32:14 UTC+0000 0x81f6c988 explorer.exe 1464 1448 12 329 0 0 2016-05-03 04:32:14 UTC+0000 0x82085550 spoolsv.exe 1576 684 13 140 0 0 2016-05-03 04:32:14 UTC+0000 0x81f64560 vmtoolsd.exe 1712 1464 5 145 0 0 2016-05-03 04:32:15 UTC+0000 0x820a3528 ctfmon.exe 1736 1464 1 78 0 0 2016-05-03 04:32:15 UTC+0000 0x81f7d3c0 vmtoolsd.exe 2020 684 7 273 0 0 2016-05-03 04:32:23 UTC+0000 0x8207db28 TPAutoConnSvc.e 512 684 5 99 0 0 2016-05-03 04:32:25 UTC+0000 0x81c26da0 alg.exe 1212 684 6 105 0 0 2016-05-03 04:32:26 UTC+0000 0x81f715c0 wscntfy.exe 1392 1040 1 39 0 0 2016-05-03 04:32:26 UTC+0000 0x81e1f520 TPAutoConnect.e 1972 512 1 72 0 0 2016-05-03 04:32:26 UTC+0000 0x81f9d3e8 TrueCrypt.exe 2012 1464 2 139 0 0 2016-05-03 04:33:36 UTC+0000 root@kali:~/CTF#
查看缓存在内存的注册表
root@kali:~/CTF# volatility -f mem.vmem --profile=WinXPSP2x86 hivelist Volatility Foundation Volatility Framework 2.6 Virtual Physical Name ---------- ---------- ---- 0xe1e9f9d8 0x0bf169d8 DeviceHarddiskVolume1Documents and SettingsAdministratorLocal SettingsApplication DataMicrosoftWindowsUsrClass.dat 0xe1cee5d0 0x0be075d0 DeviceHarddiskVolume1Documents and SettingsAdministratorNTUSER.DAT 0xe1b99b60 0x0ae0ab60 DeviceHarddiskVolume1Documents and SettingsLocalServiceLocal SettingsApplication DataMicrosoftWindowsUsrClass.dat 0xe1b95008 0x0adc6008 DeviceHarddiskVolume1Documents and SettingsLocalServiceNTUSER.DAT 0xe1a7c2a8 0x0a76b2a8 DeviceHarddiskVolume1Documents and SettingsNetworkServiceLocal SettingsApplication DataMicrosoftWindowsUsrClass.dat 0xe1a72b60 0x0a6e1b60 DeviceHarddiskVolume1Documents and SettingsNetworkServiceNTUSER.DAT 0xe146c398 0x084a3398 DeviceHarddiskVolume1WINDOWSsystem32configsoftware 0xe1699758 0x08246758 DeviceHarddiskVolume1WINDOWSsystem32configdefault 0xe166faa8 0x05e7eaa8 DeviceHarddiskVolume1WINDOWSsystem32configSECURITY 0xe16aab60 0x082a6b60 DeviceHarddiskVolume1WINDOWSsystem32configSAM 0xe12e9008 0x02d7f008 [no name] 0xe1035b60 0x02b08b60 DeviceHarddiskVolume1WINDOWSsystem32configsystem 0xe102e008 0x02b02008 [no name] root@kali:~/CTF#
hivedump 打印出注册表中的数据 :
root@kali:~/CTF# volatility -f mem.vmem --profile=WinXPSP2x86 hivedump -o 0xe16aab60 Volatility Foundation Volatility Framework 2.6 Last Written Key 2016-05-03 03:41:48 UTC+0000 SAM 2016-05-03 03:41:48 UTC+0000 SAMSAM 2016-05-03 03:41:48 UTC+0000 SAMSAMDomains 2016-05-03 03:51:02 UTC+0000 SAMSAMDomainsAccount 2016-05-03 03:50:51 UTC+0000 SAMSAMDomainsAccountAliases 2016-05-03 03:51:02 UTC+0000 SAMSAMDomainsAccountAliases 00003E9 2016-05-03 03:51:02 UTC+0000 SAMSAMDomainsAccountAliasesMembers 2016-05-03 03:51:02 UTC+0000 SAMSAMDomainsAccountAliasesMembersS-1-5-21-1844237615-1677128483-1801674531 2016-05-03 03:51:02 UTC+0000 SAMSAMDomainsAccountAliasesMembersS-1-5-21-1844237615-1677128483-1801674531