Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!
Other ways to support HackTricks:
If you want to see your company advertised in HackTricks or download HackTricks in PDF Check the SUBSCRIPTION PLANS!
Get the official PEASS & HackTricks swag
Discover The PEASS Family, our collection of exclusive NFTs
Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
Share your hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.
RootedCON is the most relevant cybersecurity event in Spain and one of the most important in Europe. With the mission of promoting technical knowledge, this congress is a boiling meeting point for technology and cybersecurity professionals in every discipline.
If you want something fast and crazy that will launch several Volatility plugins on parallel you can use: https://github.com/carlospolop/autoVolatility
python autoVolatility.py -f MEMFILE -d OUT_DIRECTORY -e /home/user/tools/volatility/vol.py # It will use the most important plugins (could use a lot of space depending on the size of the memory)Installation
volatility3
git clone https://github.com/volatilityfoundation/volatility3.gitcd volatility3python3 setup.py installpython3 vol.py —hvolatility2
Download the executable from https://www.volatilityfoundation.org/26git clone https://github.com/volatilityfoundation/volatility.gitcd volatilitypython setup.py installVolatility Commands
Access the official doc in Volatility command reference
A note on “list” vs. “scan” plugins
Volatility has two main approaches to plugins, which are sometimes reflected in their names. “list” plugins will try to navigate through Windows Kernel structures to retrieve information like processes (locate and walk the linked list of _EPROCESS structures in memory), OS handles (locating and listing the handle table, dereferencing any pointers found, etc). They more or less behave like the Windows API would if requested to, for example, list processes.
That makes “list” plugins pretty fast, but just as vulnerable as the Windows API to manipulation by malware. For instance, if malware uses DKOM to unlink a process from the _EPROCESS linked list, it won’t show up in the Task Manager and neither will it in the pslist.
“scan” plugins, on the other hand, will take an approach similar to carving the memory for things that might make sense when dereferenced as specific structures. psscan for instance will read the memory and try to make_EPROCESS objects out of it (it uses pool-tag scanning, which is searching for 4-byte strings that indicate the presence of a structure of interest). The advantage is that it can dig up processes that have exited, and even if malware tampers with the _EPROCESS linked list, the plugin will still find the structure lying around in memory (since it still needs to exist for the process to run). The downfall is that “scan” plugins are a bit slower than “list” plugins, and can sometimes yield false positives (a process that exited too long ago and had parts of its structure overwritten by other operations).
From: http://tomchop.me/2016/11/21/tutorial-volatility-plugins-malware-analysis/
OS Profiles
Volatility3
As explained inside the readme you need to put the symbol table of the OS you want to support inside volatility3/volatility/symbols.Symbol table packs for the various operating systems are available for download at:
Volatility2
External Profile
You can get the list of supported profiles doing:
./volatility_2.6_lin64_standalone --info | grep "Profile"If you want to use a new profile you have downloaded (for example a linux one) you need to create somewhere the following folder structure: plugins/overlays/linux and put inside this folder the zip file containing the profile. Then, get the number of the profiles using:
./vol --plugins=/home/kali/Desktop/ctfs/final/plugins --infoVolatility Foundation Volatility Framework 2.6Profiles--------LinuxCentOS7_3_10_0-123_el7_x86_64_profilex64 - A Profile for Linux CentOS7_3.10.0-123.el7.x86_64_profile x64VistaSP0x64 - A Profile for Windows Vista SP0 x64VistaSP0x86 - A Profile for Windows Vista SP0 x86You can download Linux and Mac profiles from https://github.com/volatilityfoundation/profiles
In the previous chunk you can see that the profile is called LinuxCentOS7_3_10_0-123_el7_x86_64_profilex64, and you can use it to execute something like:
./vol -f file.dmp --plugins=. --profile=LinuxCentOS7_3_10_0-123_el7_x86_64_profilex64 linux_netscanDiscover Profile
volatility imageinfo -f file.dmpvolatility kdbgscan -f file.dmpDifferences between imageinfo and kdbgscan
From here: As opposed to imageinfo which simply provides profile suggestions, kdbgscan is designed to positively identify the correct profile and the correct KDBG address (if there happen to be multiple). This plugin scans for the KDBGHeader signatures linked to Volatility profiles and applies sanity checks to reduce false positives. The verbosity of the output and the number of sanity checks that can be performed depends on whether Volatility can find a DTB, so if you already know the correct profile (or if you have a profile suggestion from imageinfo), then make sure you use it from .
Always take a look at the number of processes that kdbgscan has found. Sometimes imageinfo and kdbgscan can find more than one suitable profile but only the valid one will have some process related (This is because to extract processes the correct KDBG address is needed)
# GOODPsActiveProcessHead : 0xfffff800011977f0 (37 processes)PsLoadedModuleList : 0xfffff8000119aae0 (116 modules)# BADPsActiveProcessHead : 0xfffff800011947f0 (0 processes)PsLoadedModuleList : 0xfffff80001197ac0 (0 modules)KDBG
The kernel debugger block, referred to as KDBG by Volatility, is crucial for forensic tasks performed by Volatility and various debuggers. Identified as KdDebuggerDataBlock and of the type _KDDEBUGGER_DATA64, it contains essential references like PsActiveProcessHead. This specific reference points to the head of the process list, enabling the listing of all processes, which is fundamental for thorough memory analysis.
OS Information
#vol3 has a plugin to give OS information (note that imageinfo from vol2 will give you OS info)./vol.py -f file.dmp windows.info.InfoThe plugin banners.Banners can be used in vol3 to try to find linux banners in the dump.
Hashes/Passwords
Extract SAM hashes, domain cached credentials and lsa secrets.
./vol.py -f file.dmp windows.hashdump.Hashdump #Grab common windows hashes (SAM+SYSTEM)./vol.py -f file.dmp windows.cachedump.Cachedump #Grab domain cache hashes inside the registry./vol.py -f file.dmp windows.lsadump.Lsadump #Grab lsa secretsvolatility --profile=Win7SP1x86_23418 hashdump -f file.dmp #Grab common windows hashes (SAM+SYSTEM)volatility --profile=Win7SP1x86_23418 cachedump -f file.dmp #Grab domain cache hashes inside the registryvolatility --profile=Win7SP1x86_23418 lsadump -f file.dmp #Grab lsa secretsMemory Dump
The memory dump of a process will extract everything of the current status of the process. The procdump module will only extract the code.
volatility -f file.dmp --profile=Win7SP1x86 memdump -p 2168 -D conhost/
RootedCON is the most relevant cybersecurity event in Spain and one of the most important in Europe. With the mission of promoting technical knowledge, this congress is a boiling meeting point for technology and cybersecurity professionals in every discipline.
Processes
List processes
Try to find suspicious processes (by name) or unexpected child processes (for example a cmd.exe as a child of iexplorer.exe).It could be interesting to compare the result of pslist with the one of psscan to identify hidden processes.
python3 vol.py -f file.dmp windows.pstree.PsTree # Get processes tree (not hidden)python3 vol.py -f file.dmp windows.pslist.PsList # Get process list (EPROCESS)python3 vol.py -f file.dmp windows.psscan.PsScan # Get hidden process list(malware)volatility --profile=PROFILE pstree -f file.dmp # Get process tree (not hidden)volatility --profile=PROFILE pslist -f file.dmp # Get process list (EPROCESS)volatility --profile=PROFILE psscan -f file.dmp # Get hidden process list(malware)volatility --profile=PROFILE psxview -f file.dmp # Get hidden process listDump proc
./vol.py -f file.dmp windows.dumpfiles.DumpFiles --pid <pid> #Dump the .exe and dlls of the process in the current directoryvolatility --profile=Win7SP1x86_23418 procdump --pid=3152 -n --dump-dir=. -f file.dmpCommand line
Anything suspicious was executed?
python3 vol.py -f file.dmp windows.cmdline.CmdLine #Display process command-line argumentsvolatility --profile=PROFILE cmdline -f file.dmp #Display process command-line argumentsvolatility --profile=PROFILE consoles -f file.dmp #command history by scanning for _CONSOLE_INFORMATIONCommands executed in cmd.exe are managed by conhost.exe (or csrss.exe on systems before Windows 7). This means that if cmd.exe is terminated by an attacker before a memory dump is obtained, it's still possible to recover the session's command history from the memory of conhost.exe. To do this, if unusual activity is detected within the console's modules, the memory of the associated conhost.exe process should be dumped. Then, by searching for strings within this dump, command lines used in the session can potentially be extracted.
Environment
Get the env variables of each running process. There could be some interesting values.
python3 vol.py -f file.dmp windows.envars.Envars [--pid <pid>] #Display process environment variablesvolatility --profile=PROFILE envars -f file.dmp [--pid <pid>] #Display process environment variablesvolatility --profile=PROFILE -f file.dmp linux_psenv [-p <pid>] #Get env of process. runlevel var means the runlevel where the proc is initated Token privileges
Check for privileges tokens in unexpected services.It could be interesting to list the processes using some privileged token.
#Get enabled privileges of some processespython3 vol.py -f file.dmp windows.privileges.Privs [--pid <pid>]#Get all processes with interesting privilegespython3 vol.py -f file.dmp windows.privileges.Privs | grep "SeImpersonatePrivilege\|SeAssignPrimaryPrivilege\|SeTcbPrivilege\|SeBackupPrivilege\|SeRestorePrivilege\|SeCreateTokenPrivilege\|SeLoadDriverPrivilege\|SeTakeOwnershipPrivilege\|SeDebugPrivilege"#Get enabled privileges of some processesvolatility --profile=Win7SP1x86_23418 privs --pid=3152 -f file.dmp | grep Enabled#Get all processes with interesting privilegesvolatility --profile=Win7SP1x86_23418 privs -f file.dmp | grep "SeImpersonatePrivilege\|SeAssignPrimaryPrivilege\|SeTcbPrivilege\|SeBackupPrivilege\|SeRestorePrivilege\|SeCreateTokenPrivilege\|SeLoadDriverPrivilege\|SeTakeOwnershipPrivilege\|SeDebugPrivilege"SIDs
Check each SSID owned by a process.It could be interesting to list the processes using a privileges SID (and the processes using some service SID).
./vol.py -f file.dmp windows.getsids.GetSIDs [--pid <pid>] #Get SIDs of processes./vol.py -f file.dmp windows.getservicesids.GetServiceSIDs #Get the SID of servicesvolatility --profile=Win7SP1x86_23418 getsids -f file.dmp #Get the SID owned by each processvolatility --profile=Win7SP1x86_23418 getservicesids -f file.dmp #Get the SID of each serviceHandles
Useful to know to which other files, keys, threads, processes... a process has a handle for (has opened)
vol.py -f file.dmp windows.handles.Handles [--pid <pid>]volatility --profile=Win7SP1x86_23418 -f file.dmp handles [--pid=<pid>]DLLs
./vol.py -f file.dmp windows.dlllist.DllList [--pid <pid>] #List dlls used by each./vol.py -f file.dmp windows.dumpfiles.DumpFiles --pid <pid> #Dump the .exe and dlls of the process in the current directory processvolatility --profile=Win7SP1x86_23418 dlllist --pid=3152 -f file.dmp #Get dlls of a procvolatility --profile=Win7SP1x86_23418 dlldump --pid=3152 --dump-dir=. -f file.dmp #Dump dlls of a procStrings per processes
Volatility allows us to check which process a string belongs to.
strings file.dmp > /tmp/strings.txt./vol.py -f /tmp/file.dmp windows.strings.Strings --strings-file /tmp/strings.txtstrings file.dmp > /tmp/strings.txtvolatility -f /tmp/file.dmp windows.strings.Strings --string-file /tmp/strings.txtvolatility -f /tmp/file.dmp --profile=Win81U1x64 memdump -p 3532 --dump-dir .strings 3532.dmp > strings_fileIt also allows to search for strings inside a process using the yarascan module:
./vol.py -f file.dmp windows.vadyarascan.VadYaraScan --yara-rules "https://" --pid 3692 3840 3976 3312 3084 2784./vol.py -f file.dmp yarascan.YaraScan --yara-rules "https://"volatility --profile=Win7SP1x86_23418 yarascan -Y "https://" -p 3692,3840,3976,3312,3084,2784UserAssist
Windows keeps track of programs you run using a feature in the registry called UserAssist keys. These keys record how many times each program is executed and when it was last run.
./vol.py -f file.dmp windows.registry.userassist.UserAssistvolatility --profile=Win7SP1x86_23418 -f file.dmp userassist
RootedCON is the most relevant cybersecurity event in Spain and one of the most important in Europe. With the mission of promoting technical knowledge, this congress is a boiling meeting point for technology and cybersecurity professionals in every discipline.
Services
./vol.py -f file.dmp windows.svcscan.SvcScan #List services./vol.py -f file.dmp windows.getservicesids.GetServiceSIDs #Get the SID of services#Get services and binary pathvolatility --profile=Win7SP1x86_23418 svcscan -f file.dmp#Get name of the services and SID (slow)volatility --profile=Win7SP1x86_23418 getservicesids -f file.dmpNetwork
./vol.py -f file.dmp windows.netscan.NetScan#For network info of linux use volatility2volatility --profile=Win7SP1x86_23418 netscan -f file.dmpvolatility --profile=Win7SP1x86_23418 connections -f file.dmp#XP and 2003 onlyvolatility --profile=Win7SP1x86_23418 connscan -f file.dmp#TCP connections volatility --profile=Win7SP1x86_23418 sockscan -f file.dmp#Open socketsvolatility --profile=Win7SP1x86_23418 sockets -f file.dmp#Scanner for tcp socket objectsvolatility --profile=SomeLinux -f file.dmp linux_ifconfigvolatility --profile=SomeLinux -f file.dmp linux_netstatvolatility --profile=SomeLinux -f file.dmp linux_netfiltervolatility --profile=SomeLinux -f file.dmp linux_arp #ARP tablevolatility --profile=SomeLinux -f file.dmp linux_list_raw #Processes using promiscuous raw sockets (comm between processes)volatility --profile=SomeLinux -f file.dmp linux_route_cacheRegistry hive
Print available hives
./vol.py -f file.dmp windows.registry.hivelist.HiveList #List roots./vol.py -f file.dmp windows.registry.printkey.PrintKey #List roots and get initial subkeysvolatility --profile=Win7SP1x86_23418 -f file.dmp hivelist #List rootsvolatility --profile=Win7SP1x86_23418 -f file.dmp printkey #List roots and get initial subkeysGet a value
./vol.py -f file.dmp windows.registry.printkey.PrintKey --key "Software\Microsoft\Windows NT\CurrentVersion"volatility --profile=Win7SP1x86_23418 printkey -K "Software\Microsoft\Windows NT\CurrentVersion" -f file.dmp# Get Run binaries registry valuevolatility -f file.dmp --profile=Win7SP1x86 printkey -o 0x9670e9d0 -K 'Software\Microsoft\Windows\CurrentVersion\Run'Dump
#Dump a hivevolatility --profile=Win7SP1x86_23418 hivedump -o 0x9aad6148 -f file.dmp #Offset extracted by hivelist#Dump all hivesvolatility --profile=Win7SP1x86_23418 hivedump -f file.dmpFilesystem
Mount
#See vol2volatility --profile=SomeLinux -f file.dmp linux_mountvolatility --profile=SomeLinux -f file.dmp linux_recover_filesystem #Dump the entire filesystem (if possible)Scan/dump
./vol.py -f file.dmp windows.filescan.FileScan #Scan for files inside the dump./vol.py -f file.dmp windows.dumpfiles.DumpFiles --physaddr <0xAAAAA> #Offset from previous commandvolatility --profile=Win7SP1x86_23418 filescan -f file.dmp #Scan for files inside the dumpvolatility --profile=Win7SP1x86_23418 dumpfiles -n --dump-dir=/tmp -f file.dmp #Dump all filesvolatility --profile=Win7SP1x86_23418 dumpfiles -n --dump-dir=/tmp -Q 0x000000007dcaa620 -f file.dmpvolatility --profile=SomeLinux -f file.dmp linux_enumerate_filesvolatility --profile=SomeLinux -f file.dmp linux_find_file -F /path/to/filevolatility --profile=SomeLinux -f file.dmp linux_find_file -i 0xINODENUMBER -O /path/to/dump/fileMaster File Table
# I couldn't find any plugin to extract this information in volatility3volatility --profile=Win7SP1x86_23418 mftparser -f file.dmpThe NTFS file system uses a critical component known as the master file table (MFT). This table includes at least one entry for every file on a volume, covering the MFT itself too. Vital details about each file, such as size, timestamps, permissions, and actual data, are encapsulated within the MFT entries or in areas external to the MFT but referenced by these entries. More details can be found in the official documentation.
SSL Keys/Certs
#vol3 allows to search for certificates inside the registry./vol.py -f file.dmp windows.registry.certificates.Certificates#vol2 allos you to search and dump certificates from memory#Interesting options for this modules are: --pid, --name, --sslvolatility --profile=Win7SP1x86_23418 dumpcerts --dump-dir=. -f file.dmpMalware
./vol.py -f file.dmp windows.malfind.Malfind [--dump] #Find hidden and injected code, [dump each suspicious section]#Malfind will search for suspicious structures related to malware./vol.py -f file.dmp windows.driverirp.DriverIrp #Driver IRP hook detection./vol.py -f file.dmp windows.ssdt.SSDT #Check system call address from unexpected addresses./vol.py -f file.dmp linux.check_afinfo.Check_afinfo #Verifies the operation function pointers of network protocols./vol.py -f file.dmp linux.check_creds.Check_creds #Checks if any processes are sharing credential structures./vol.py -f file.dmp linux.check_idt.Check_idt #Checks if the IDT has been altered./vol.py -f file.dmp linux.check_syscall.Check_syscall #Check system call table for hooks./vol.py -f file.dmp linux.check_modules.Check_modules #Compares module list to sysfs info, if available./vol.py -f file.dmp linux.tty_check.tty_check #Checks tty devices for hooksvolatility --profile=Win7SP1x86_23418 -f file.dmp malfind [-D /tmp] #Find hidden and injected code [dump each suspicious section]volatility --profile=Win7SP1x86_23418 -f file.dmp apihooks #Detect API hooks in process and kernel memoryvolatility --profile=Win7SP1x86_23418 -f file.dmp driverirp #Driver IRP hook detectionvolatility --profile=Win7SP1x86_23418 -f file.dmp ssdt #Check system call address from unexpected addressesvolatility --profile=SomeLinux -f file.dmp linux_check_afinfovolatility --profile=SomeLinux -f file.dmp linux_check_credsvolatility --profile=SomeLinux -f file.dmp linux_check_fopvolatility --profile=SomeLinux -f file.dmp linux_check_idtvolatility --profile=SomeLinux -f file.dmp linux_check_syscallvolatility --profile=SomeLinux -f file.dmp linux_check_modulesvolatility --profile=SomeLinux -f file.dmp linux_check_ttyvolatility --profile=SomeLinux -f file.dmp linux_keyboard_notifiers #KeyloggersScanning with yara
Use this script to download and merge all the yara malware rules from github: https://gist.github.com/andreafortuna/29c6ea48adf3d45a979a78763cdc7ce9Create the rules directory and execute it. This will create a file called malware_rules.yar which contains all the yara rules for malware.
wget https://gist.githubusercontent.com/andreafortuna/29c6ea48adf3d45a979a78763cdc7ce9/raw/4ec711d37f1b428b63bed1f786b26a0654aa2f31/malware_yara_rules.pymkdir rulespython malware_yara_rules.py#Only Windows./vol.py -f file.dmp windows.vadyarascan.VadYaraScan --yara-file /tmp/malware_rules.yar#All./vol.py -f file.dmp yarascan.YaraScan --yara-file /tmp/malware_rules.yarwget https://gist.githubusercontent.com/andreafortuna/29c6ea48adf3d45a979a78763cdc7ce9/raw/4ec711d37f1b428b63bed1f786b26a0654aa2f31/malware_yara_rules.pymkdir rulespython malware_yara_rules.pyvolatility --profile=Win7SP1x86_23418 yarascan -y malware_rules.yar -f ch2.dmp | grep "Rule:" | grep -v "Str_Win32" | sort | uniqMISC
External plugins
If you want to use external plugins make sure that the folders related to the plugins are the first parameter used.
./vol.py --plugin-dirs "/tmp/plugins/" [...] volatilitye --plugins="/tmp/plugins/" [...]Autoruns
Download it from https://github.com/tomchop/volatility-autoruns
volatility --plugins=volatility-autoruns/ --profile=WinXPSP2x86 -f file.dmp autorunsMutexes
./vol.py -f file.dmp windows.mutantscan.MutantScanvolatility --profile=Win7SP1x86_23418 mutantscan -f file.dmpvolatility --profile=Win7SP1x86_23418 -f file.dmp handles -p <PID> -t mutantSymlinks
./vol.py -f file.dmp windows.symlinkscan.SymlinkScanvolatility --profile=Win7SP1x86_23418 -f file.dmp symlinkscanBash
It's possible to read from memory the bash history. You could also dump the .bash_history file, but it was disabled you will be glad you can use this volatility module
./vol.py -f file.dmp linux.bash.Bashvolatility --profile=Win7SP1x86_23418 -f file.dmp linux_bashTimeLine
./vol.py -f file.dmp timeLiner.TimeLinervolatility --profile=Win7SP1x86_23418 -f timelinerDrivers
./vol.py -f file.dmp windows.driverscan.DriverScanvolatility --profile=Win7SP1x86_23418 -f file.dmp driverscanGet clipboard
#Just vol2volatility --profile=Win7SP1x86_23418 clipboard -f file.dmpGet IE history
#Just vol2volatility --profile=Win7SP1x86_23418 iehistory -f file.dmpGet notepad text
#Just vol2volatility --profile=Win7SP1x86_23418 notepad -f file.dmpScreenshot
#Just vol2volatility --profile=Win7SP1x86_23418 screenshot -f file.dmpMaster Boot Record (MBR)
volatility --profile=Win7SP1x86_23418 mbrparser -f file.dmpThe Master Boot Record (MBR) plays a crucial role in managing the logical partitions of a storage medium, which are structured with different file systems. It not only holds partition layout information but also contains executable code acting as a boot loader. This boot loader either directly initiates the OS's second-stage loading process (see second-stage boot loader) or works in harmony with the volume boot record (VBR) of each partition. For in-depth knowledge, refer to the MBR Wikipedia page.
References
RootedCON is the most relevant cybersecurity event in Spain and one of the most important in Europe. With the mission of promoting technical knowledge, this congress is a boiling meeting point for technology and cybersecurity professionals in every discipline.
Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!
Other ways to support HackTricks:
If you want to see your company advertised in HackTricks or download HackTricks in PDF Check the SUBSCRIPTION PLANS!
Get the official PEASS & HackTricks swag
Discover The PEASS Family, our collection of exclusive NFTs
Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
Share your hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.
