Metasploitable/Volatile Data Investigation - Revision history

Admin: /* Prepare Environment */

2016-03-31T17:13:23Z

Prepare Environment

← Older revision		Revision as of 17:13, 31 March 2016
Line 6:		Line 6:

	More info on tools here: http://www.forensicswiki.org/wiki/Tools:Memory_Imaging		More info on tools here: http://www.forensicswiki.org/wiki/Tools:Memory_Imaging

			==Toolz==

			In order to perform volatile data investigation, you'll need (at least) 2 things:

			1) jump drive number 1 - this will contain the memory dump, so it needs more capacity than the memory of the machine you're analyzing

			2) jump drive number 2 - this will contain trusted binaries of tools, compiled for the architecture of the machine you're analyzing

	==Prepare Environment==		==Prepare Environment==

Admin: /* Remote dump memory */

2016-03-31T17:07:45Z

Remote dump memory

← Older revision		Revision as of 17:07, 31 March 2016
Line 52:		Line 52:

	To remotely dump memory, you can use fmem and pipe the output to netcat.		To remotely dump memory, you can use fmem and pipe the output to netcat.

			NOTE: This will generate lots of network traffic, and will therefore flush any saved buffer information in the network device being used. Make sure and recover that information first, if needed.

	Start a netcat listener on the command-and-control server,		Start a netcat listener on the command-and-control server,

Admin: /* Remote dump memory */

2016-03-31T06:31:24Z

Remote dump memory

← Older revision		Revision as of 06:31, 31 March 2016
Line 51:		Line 51:
	==Remote dump memory==		==Remote dump memory==

	To remotely dump memory, you can use fmem and pipe the output to netcat:		To remotely dump memory, you can use fmem and pipe the output to netcat.

			Start a netcat listener on the command-and-control server,

			<pre>
			$ nc -l 4444 > phys_mem
			</pre>

			In another window on the command-and-control server, monitor the size of the file. It should start to grow, and continue growing steadily, until it reaches the size of the memory on the machine. Monitor the size via:

	<pre>		<pre>
	$ ~~dd if=~~/~~dev~~/~~fmem \| nc 10.0.0.32~~		$ watch -lahg /opt/data/phys_mem
	</pre>		</pre>

			Now, on the victim, get fmem on-board (using techniques shown above). Then pipe the memory dump to netcat.

			<pre>
			$ dd if=/dev/fmem \| nc 10.0.0.32 4444
			</pre>

			Use control-C to stop the process once the file size has stopped growing.

	==Collect system state==		==Collect system state==

Admin: /* Collect system state */

2016-03-31T06:26:11Z

Collect system state

← Older revision		Revision as of 06:26, 31 March 2016
Line 48:		Line 48:

	Alternative tools?		Alternative tools?

			==Remote dump memory==

			To remotely dump memory, you can use fmem and pipe the output to netcat:

			<pre>
			$ dd if=/dev/fmem \| nc 10.0.0.32
			</pre>

	==Collect system state==		==Collect system state==

Admin: /* System */

2016-03-31T06:21:22Z

System

@@ Line 91: / Line 91: @@
 $ users
-$ # Process data
+$ # Process data:
 $ lsof -l
 $ ps -e
-$ ps -ef
+$ ps -ef # Simple list
-$ ps aux
+$ ps aux # Temporal
 $ top -n 1 -b
 $ pstree -a
@@ Line 101: / Line 101: @@
 $ ps -eafww
 $ ps auxww
-$ pmap -x PID
+$ pmap -x PID # proc mem map
 </pre>

Admin: /* System */

2016-03-31T06:17:30Z

System

← Older revision		Revision as of 06:17, 31 March 2016
Line 76:		Line 76:
	$ cat /proc/version		$ cat /proc/version
	$ cat /proc/cpuinfo		$ cat /proc/cpuinfo
	~~</pre>~~

	~~<pre>~~
	$ # Record kernel boot:		$ # Record kernel boot:
	$ cat /proc/cmdline		$ cat /proc/cmdline

Admin: /* Collect system state */

2016-03-31T06:17:11Z

Collect system state

← Older revision		Revision as of 06:17, 31 March 2016
Line 50:		Line 50:

	==Collect system state==		==Collect system state==

			===Network===

	We'll want to capture network activity.		We'll want to capture network activity.
Line 58:		Line 60:
	$ netstat -inet -naov		$ netstat -inet -naov
	</pre>		</pre>

			===System===

	Run a few essential commands to list system status:		Run a few essential commands to list system status:
Line 73:		Line 77:
	$ cat /proc/cpuinfo		$ cat /proc/cpuinfo
	</pre>		</pre>

	~~Record kernel boot:~~

	<pre>		<pre>
			$ # Record kernel boot:
	$ cat /proc/cmdline		$ cat /proc/cmdline
	~~</pre>~~

	Dump the routing table:		$ # Dump the routing table:
			$ netstat -nr

	~~<pre>~~		$ # Dump the ARP cache:
	$ ~~netstat~~ -nr		$ arp -a
	~~</pre>~~

	~~Dump the ARP cache~~:		$ # Logged-on users:
			$ who
			$ w
			$ users

	~~<pre>~~		$ # Process data
	$ ~~arp~~ -a		$ lsof -l
			$ ps -e
			$ ps -ef
			$ ps aux
			$ top -n 1 -b
			$ pstree -a
			$ pmap -d PID
			$ ps -eafww
			$ ps auxww
			$ pmap -x PID
	</pre>		</pre>

Admin: /* Linux 2.6 kernel */

2016-03-31T05:49:16Z

Linux 2.6 kernel

@@ Line 46: / Line 46: @@
 Capture memory for Linux 2.6 kernel. This method will use <code>fmem</code>, but will need to be configured to keep from modifying the system.
 =Flags=
 {{MetasploitableBlueTeamFlag}}

Admin: /* Volatile Data SYstem Investigation */

2016-03-31T05:42:57Z

Volatile Data SYstem Investigation

← Older revision		Revision as of 05:42, 31 March 2016
Line 1:		Line 1:
	=Volatile Data ~~SYstem~~ Investigation=		=Volatile Data System Investigation=

	These commands are forUnix and Linux systems.		These commands are forUnix and Linux systems.
Line 46:		Line 46:

	Capture memory for Linux 2.6 kernel. This method will use <code>fmem</code>, but will need to be configured to keep from modifying the system.		Capture memory for Linux 2.6 kernel. This method will use <code>fmem</code>, but will need to be configured to keep from modifying the system.







	=Flags=		=Flags=

	{{MetasploitableBlueTeamFlag}}		{{MetasploitableBlueTeamFlag}}

Admin: Created page with "=Volatile Data SYstem Investigation= These commands are forUnix and Linux systems. Volatile data like memory, network ports, and processes will change over time, so be caref..."

2016-03-31T05:42:43Z

Created page with "=Volatile Data SYstem Investigation= These commands are forUnix and Linux systems. Volatile data like memory, network ports, and processes will change over time, so be caref..."

New page

=Volatile Data SYstem Investigation=

These commands are forUnix and Linux systems.

Volatile data like memory, network ports, and processes will change over time, so be careful to make these backups as soon as possible after the incident. And be careful how you gather data! You can potentially flush valuable cached network interface data in the process of trying to recover it.

More info on tools here: http://www.forensicswiki.org/wiki/Tools:Memory_Imaging

==Prepare Environment==

Make available a trusted source of Linux tools in <code>/media</code> (a CD or USB drive).

Make a USB mount drive for volatile data collection at <code>/mount</code>.

You'll use removable storage, and your own tools, to make these backups.

===Prepare===

Invoke a trusted shell: this should be shellshock-patched and statically linked (making it invulnerable to attacks on shared libraries).

===Begin Logging===

Go to your working directory, and run the <code>script</code> command to begin logging activity on the machine. Once you exit the shell, an output file will be created.

==Dump Memory==

Document the date and time, for the output file:

<pre>
$ date
</pre>

===Linux 2.4 kernel===

Capture memory for Linux 2.4 kernel using memdump.

<pre>
$ /media/../dc3dd if=/dev/mem > /mount/../physical_mem_out

$ /media/../memdump > /mount/../physical_mem_out

$ /media/../dc3dd if=/proc/kcore of=/mount/../kcore_mem_out
</pre>

===Linux 2.6 kernel===

Capture memory for Linux 2.6 kernel. This method will use <code>fmem</code>, but will need to be configured to keep from modifying the system.

=Flags=

{{MetasploitableBlueTeamFlag}}