Skip to main content

Posts

Creating Linux Profiles for Volatility3

Generated with deepai.org Linux Profile for Volatility3 On the last article, I talked on how to create a profile for volatility2, click here to check. Now we are doing the same task, but this time, let's update the process to our new memory analysis framework: volatility3 [1]. Running similar steps, we assume that no information was disclosed about the host where acquisition was captured from. Using the banners plugin in volatility3, check the kernel information: $ ./vol.py -f /Cases/memory.raw banners Volatility 3 Framework 2.4.0 Progress:  100.00               PDB scanning finished Offset  Banner 0x7d600200      Linux version 5.10.0-19-amd64 (debian-kernel@lists.debian.org) (gcc-10 (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2) #1 SMP Debian 5.10.149-2 (2022-10-21) With that information, we can jump to a docker environment and download the necessary packages, compile, and zip our image prof...
Post a Comment
Read more
Recent posts

Creating Linux Profiles for Volatility2

Generated with deepai.org Case Brief Imagine the following scenario, you have been given a linux memory dump file and need to proceed with a forensic analysis with your favorite "old" memory forensics framework: volatility2 [1] . No additional information was given what linux distro or version the dump was acquired from, and of course, you need to create your own linux profile for an image because volatility profile list does not include the version of the unknown linux system. Kernel Version We'll use grep with the combination with few tweaks to identify the necessary information. Open terminal and type: $ grep -aib "linux version" memory.raw ... 2125328745:��3-�usbc189:132Ѡ�3�usbc189:132��3%�usbc189:132���Linux version 5.10.0-19-amd64 (debian-kernel@lists.debian.org) (gcc-10 (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2) #1 SMP Debian 5.10.149-2 (2022-10-21)���Command line: BOOT_IMAGE=/boot/vmlinuz-5.10.0-19-amd64 root=...
Post a Comment
Read more

Parsing .bash_history with CyberChef

No time to waste: Open cyberchef: https://gchq.github.io/CyberChef/ Cook the following recipe: Fork('\\n','\\n',false) Conditional_Jump('#',true,'end',10) Find_/_Replace({'option':'Regex','string':'#'},'',true,false,true,false) From_UNIX_Timestamp('Seconds (s)') Label('end')
Post a Comment
Read more

Quebrando senha API com Hydra

Neste domingo eu estava aproveitando para estudar um poucos sobre protocolo HTTP e autenticação web. Eu estava analisando as portas que estavam escutando no meu gateway wifi. Após alguma pesquisa no google, encontrei o manual do produto e algumas informações importantes. Percebi que além do IP 192.168.0.1 o roteador também tinha uma interface adicional 192.168.100.1 . Quais portas estão este roteador está escutando? Temos o nmap pra isso: # nmap -sS -p1-65535 -r 192.168.0.1 Starting Nmap 7.80 ( https://nmap.org ) at 2020-10-25 19:50 EDT Nmap scan report for 192.168.0.1 Host is up (0.046s latency). Not shown: 65528 closed ports PORT STATE SERVICE 22/tcp filtered ssh 80/tcp open http 1990/tcp open stun-p1 4700/tcp open netxms-agent 5431/tcp open park-agent 5523/tcp filtered unknown 8848/tcp open unknown Nmap done: 1 IP address (1 host up) scanned in 31.66 seconds # nmap -sS -p1-65535 -r 192.168.100.1 Starting Nmap 7.80 ( https://nmap.org ) at 2020-10-25...
Post a Comment
Read more