Volatility This Practical Walks You Through the Forensic Analysis
Total Page：16
File Type：pdf, Size：1020Kb
Computer Security & Forensics ! Forensics Practical Two : Volatility! This practical walks you through the forensic analysis process used to solve an online forensics challenge. It uses the volatility tool and some standard command line applications to inspect and analyse the memory captured from a PC that was suspected of being compromised via a PDF exploit. Static analysis of a suspect machine can be very useful since we can take our time over the analysis process and can do it on a separate uninfected computer. Ideally your first action on examining a live suspect computer will be to take a snapshot of the memory and save it to removable media. You can then proceed to perform a more dynamic analysis with the knowledge that you have an alternative to fall !back on should anything go wrong. ! ! Operating System Version! You have learnt about checksums and viewing files with a hex editor in the previous !practical, we will now move on to analysing a sample memory dump. ! One of the first things you will want to check is the type and version of the operating system that your sample was taken from. Open up a command prompt and change directory to your forensics folder that you created last week. Make sure you have a connection to the networked drive \\wsv.cs.stir.ac.uk\Security (it is assumed that you mapped the ’S’ drive in the following examples). Now type the following to extract the !version information (it may take a couple of minutes):! !tools\volatility imageinfo -f S:\forensics\lab.mem > lab-info.txt The ‘> lab-info.txt’ part of this command will redirect the output into the file lab-info.txt so that you do not have to keep regenerating it. If you view your home forensics directory in Explorer, you should see this file listed there and can open it with a text editor (e.g. Notepad). You should observe that the image is from a Windows XP machine running !service pack 3 and aimed at an x86 architecture. ! The syntax for the volatility command is reasonably straightforward, you type volatility followed by the particular scan command you wish to run (e.g. imageinfo) and then indicate the file that is to be scanned via the -f <file> option. If you type volatility on its own, you will get a list of the types of actions that this tool can perform. If you wish to save the output to a text file, just add > textfilename.txt at the end where textfilename.txt is the !name of a file you wish to save the results to.! Viewing Processes! The next step is to look at the processes that were running on the PC at the time the memory snapshot was taken. This may enable us to spot if anything unusual was running !at the time we obtained our snapshot. To get this list of processes, type:! !tools\volatility pslist -f S:\forensics\lab.mem > lab-pslist.txt This will produce a list of the processes that were running on the machine at the time the !snapshot was taken (at least those that were recorded in the kernel process list). ! ! "1 ! ! A sample of the output is shown below and you will see that it includes the memory offset of each process, its name, ID, its parent process ID (i.e. the process that started it - a very useful piece of information) and the time it was started (again very useful if you want to trace a chain of events such as cross checking a process starting with communication over the network). You can also see the number of internal threads initiated by a given process !and a count of the handles it has on OS resources.! Offset(V) Name PID PPID Thds Hnds Time ---------- -------------------- ------ ------ ------ ------ ----- 0x81bcaa00 System 4 0 72 300 1970-01-01 00:00:00 0x8193ab10 smss.exe 612 4 3 19 2011-08-31 09:45:09 0x81929b10 csrss.exe 664 612 13 435 2011-08-31 09:45:11 !...! We can display the above information in a more structured way using the pstree option which will show you the process hierarchy. This makes it easier to see which processes own and started other processes and also the sequence which led to each one starting. Type:# # !tools\volatility pstree -f S:\forensics\lab.mem > lab-pstree.txt !and look at the output, a sample of which is shown below:! Name Pid PPid Thds Hnds Time 0x81BCAA00:System 4 0 72 300 1970-01-01 00:00:00 . 0x8193AB10:smss.exe 612 4 3 19 2011-08-31 09:45:09 .. 0x81929B10:csrss.exe 664 612 13 435 2011-08-31 09:45:11 .. 0x8198B020:winlogon.exe 688 612 22 602 2011-08-31 09:45:12 ... 0x81894DA0:lsass.exe 744 688 22 354 2011-08-31 09:45:12 ... 0x8188D628:services.exe 732 688 16 359 2011-08-31 09:45:12 ! !...! You should be able to see that in the PPid (Parent Process ID) column, there are a number of processes that were started by the same parent and you can check in the PiD column (Process ID) what that process was (easily visible via the indentation used to group processes). You should also observe that the process tree appear to broken down into two major groups - the System processes under process 4 and a group of explorer related processes that effectively belong to a login session (with a non visible parent process of 364). In this later group, you can see the terminal session that was created !(cmd.exe) and the win32dd.exe process started within it to capture the memory snapshot.! This process tree should enable you to understand the standard Windows boot process and what happens when a machine starts up and then a user logs on. Given that we have a relatively minimal set up in this case, you can use this lab image as a reference point in cases where you have a more complex memory image with a larger number of user !processes and background services active. ! It is worth noting that some root kits attempt to hide themselves from the standard kernel process list by altering their links in this list such that they are bypassed. Fortunately they are still forced to maintain process data in a structure which can be searched for. There is "2 a volatility command called psscan which will scan for all process structures in memory, irrespective of whether they are in the main process list. This will reveal processes that have either terminated normally or have tried to hide themselves. If you compare the list that you get from running pslist with that from psscan, you can then check through the additional processes and work out if they terminated normally or are abnormal processes worthy of further investigation (see later for details on analysing process executables). Try !this now for the lab.mem image by typing:! !tools\volatility psscan -f S:\forensics\lab.mem > lab-scan.txt Viewing Network Connections! The next step in the analysis is to examine if there were any listening ports and open network connections at the time the memory snapshot was taken. We can achieve this !with volatility via two related commands. To get the list of open network sockets, type:! !tools\volatility connscan -f S:\forensics\lab.mem > lab-sock.txt! Note that this can take a long time to run (10 minutes or more), so please be patient (while you are waiting for this process to complete, you can open a second DOS window and continue on with the rest of the practical). When this process completes, it will produce a list of the open sockets, both active and listening at the time the memory snapshot was !taken, saving the output in labsock.txt. This file should contain the following entries:# Offset Local Address Remote Address Pid ---------- ------------------- ---------------- ------ 0x01257588 127.0.0.1:1034 127.0.0.1:1033 3028 0x01257e68 127.0.0.1:1033 127.0.0.1:1034 3028 0x01269cf8 139.153.253.116:1046 2.20.183.163:80 3028 0x0128ccf8 139.153.253.116:1050 212.58.227.137:80 3028 0x0128f008 139.153.253.116:1037 212.58.246.108:80 3028 0x0129f788 139.153.253.116:1057 77.72.115.68:80 3028 !...! The above information can often provide clues to services that are waiting to receive input and you should check them to ensure the relevant process is the type of application you would expect to see using a network connection. For example, you should be deeply suspicious of a process such as Notepad if it appears to be listening on a socket. From the above, you would be able to see on what port it was listening and the instructions below !would tell you how to find information on an IP address it had made a connection to.! !To get just the list of active connections, you can type:! tools\volatility connections -f S:\forensics\lab.mem > lab- !conn.txt "3 This will produce output similar to the following and should enable us to examine which processes have initiated connections and the IP addresses of the source and destination !of these connections. ! Offset(V) Local Address Remote Address Pid ---------- ------------------------- ------------------ ------ 0xff9e5dd0 139.153.253.116:1069 212.58.246.91:80 3028 0xff9e5dd0 139.153.253.116:1042 212.58.246.91:80 3028 0x81925af8 139.153.253.116:1058 77.72.115.68:80 3028 0x81aa75d0 139.153.253.116:1057 77.72.115.68:80 3028! !...! For each address you can also see the port number used to make the connection.