Memory Forensics Investigation using Volatility (Part 1)

Our focus today is on the Volatility framework, on its capability of analyzing process activity.
The Volatility framework is an open source tool that is used to analyze volatile memory for a host of things. This framework comes with various plugins that can be used by the investigators to get an idea of what was going on in the machine when it was being used. Volatile memory is the primary storage of most computers, by primary storage I’m referring to the RAM.
If live acquisition is done for a piece of evidence, an image of the volatile memory can hold various clues that can help an investigation, for instance: passwords, services, network activity, processes, etc. All these can be acquired from live memory.
In another instance, after an incident, volatility can be used to uncover the cause. It has plugins that let you sift through the primary storage and pinpoint suspicious processes that might have been running at the time of the incident or might have led up to it.
This framework is available for both Windows and Linus, for this demonstration we will be using Volatility in Kali Linux, it comes preinstalled and can be found under the Forensics menu.
We have used Dumpit to create the .raw file for 2 GB of RAM from a machine running Windows 10.

All you need to do it download the program, run it and press “y” and it does the rest.


Navigate to the address given in front of the Destination, as it is shown in the image above and you will find the .raw file that contains the information copied from the RAM, this can now be subjected to the Volatility framework.


For ease of usage, create a folder by the name of “Volatility” on the Kali desktop and place the .raw file we crated in it. Right click anywhere in the folder and choose “Open in Terminal”.
Let’s fire up Volatility in Kali, navigate to the Forensics menu or, in the terminal type ‘volatility –h”.


This command will show you a host of plugins that are available in Volatility and the usage pattern. We will be using a different .raw file that we acquired earlier, so don’t be thrown off by the change in file name.
As an investigator, one is working under the pretense that this is a file we have no prior knowledge about so, we must start from scratch.
The first thing to ascertain is the profile, that is, the operating system that that this was most probably derived from.
Type “volatility –f name of file.raw imageinfo”. A breakdown of the command for further reference:
-f is to tell declare the target file.
Imageinfo is used to get the basic details about the file, including the profile. The plugin uses the kernel debugger data block to guess the profile.


In the image above we can see that Volatility is telling us that this image is most probably belongs to the Win10*64_10586 profile. The guessing aspect of the plugin bases it’s functionality on another plugin called kdbgscan. The kdbgscan analyses the data structures present in the NT kernel module, there are numeric values that denote the minor and major build numbers and service pack level.
To illustrate, let’s run the kdbgscan.
Type “volatility –f name of file.raw kdbgscan”.


The result for the profile that we will be using is this one.
The data given below tells us that the file belongs to a 64-Bit version of Windows 10, has no installed service pack, has a total of 177 loaded modules and 82 active processes.


Volatility gives us the option to manually override the profile (--profile) while using plugins as the automatic OS detection can be misled due to accidental or intended tampering of the kernel by malware, this gives us a higher rate of accuracy in the operations we perform. We will be using this override function throughout combined with the plugins.
The machine might have been running certain processes, the plugin we will be using is pslist.  
Type “volatility –f name of file.raw --profile Win10*64_10586 pslist”


The scan will show us the following results. We can see OneDrive and Skype being run on the machine so we can infer that it is most probably a client or workstation rather than a server. All the system processes are running on session 0 and 1, which infers that only 1 user was logged on.


The pstree plugin is used to see the parent child relationship between processes, it takes the output from the pslist and depicts it in a tree view format.
Type “volatility –f name of file.raw --profile Win10*64_10586 pstree”


If you were to start a program from the desktop by double clicking an icon, its parent would be explorer.exe, that’s the windows explorer.
The reason way pstree makes its relevance in forensics can be thought of in the following way: if you see chrome.exe being executed by command shell (cmd.exe) that is a potential flag. It could have been executed by a hacker who has access to the machine.
In the result shown, we can see that wininit.exe started services.exe, which in turn started svchost.exe.


The psscan plugin is uses the ­_EPROCESS objects, it can be used to determine hidden and terminated processes.
Type the following “volatility –f name of file.raw --profile Win10*64_10586 psscan”


The scan shows us the one of the processes by the name of TabTip.exe started and stopped within a second, it’s a process that is used by windows touch screen devices for touch keyboard and handwriting, by this we can infer the device did not have touch screen capabilities. Not the most potent of discoveries but it helps build a profile for further investigation.
The offset is the displacement between the beginning of the data object to a certain point.


The last plugin we will be utilizing will be psxview. This plugin is useful for uncovering malicious processes, the way it assists in this is by locating processes that are using alternative listings. The list can then be cross-referenced with different sources of information to pinpoint discrepancies.
Type the following “volatility –f name of file.raw --profile Win10*64_10586 psxview”


The psxview enumerates every single process by Process Object scanning, thread scanning, CSRSS handle table, PspCid table, Sessions processes, Desktop threads and Active Processes Linked list. That’s 7 ways of enumeration.
The 7 things mentioned above can be understood as:
Process Object Scanning: is listing all the process objects that use the proc tag and are allocated nt!ps, there are process subsystems of the NT module.
Thread Scanning: this can be used backtrack to the originating process because each process must have one active thread.
CSRSS Handle Table: post execution is responsible for every process and creation and can help identify all _EPROCESS objects.
PspCid Table: holds reference to all process and thread objects and is located in the kernel memory.
Sessions Processes: associates all processes that belong to a single users logon.
Desktop Threads: structures that hold a list of all threads attached to each desktop, useful for finding the owing process of a thread.
Active Processes Linked List: list of running processes, each element comprising of data and a reference to the next element
This plugin is very useful and efficient at finding rootkits. One of the things that it focuses on it that, being able to successfully weaponize a process that is not hidden is far more practical and efficient than to hide a process 7 different ways.


Volatility is a very robust framework, it gives us the ability to further apply various filters to our scan results and generate reports. To make it more comprehensive in its usage and approach, its capabilities have been designed based on reverse engineering. It has capabilities far surpass even that of Microsoft’s own kernel debugger.
The tools provides a wealth of insights into the working of a machine, helping the investigator make accurate and coherent profiles, every bit of information gets the forensic process one step closer to uncovering the truth.

Have fun and stay ethical.

About The Author
Abhimanyu Dev is a Certified Ethical Hacker, penetration tester, information security analyst and researcher. Connect with him here

Forensic Investigation of Nmap using Wireshark

Hello friends!! Today we are discussing about how to read hexadecimal bytes from an IP Packet that help a network admin to identify various types of NMAP scanning. But before moving ahead please read our previous both articles “Network packet forensic” and “NMAP scanning with Wirehsark” it will help you in better understanding of this article.

Requiremnt
Attacking tool: Namp
Analyis tool: wireshark

We are going to calculate hexadecimal bytes of wireshark using given below table and as we know wireshark capture network packet mainly of 4 layers which is describd below in table as per OSI layer model and TCP/IP layer model.



Let’s  start!!

NMAP ARP Scanning

Hopefully reader must be aware of basic NMAP scanning techniques if not then read it from here, now open the terminal and execute given below command which known as “HOST SCAN” to idenfiy live host in network.
nmap -sn 192.168.1.100
Nmap uses the –sP/-sn flag for host scans and broadcast ARP request packet to identify which IP is allocated to particular host machine. From given below image you can observe that “1 host up” message.
Working of ARP Scan for Live Host
         i.            Send ARP request for MAC address

       ii.            Receive MAC address though ARP Reply packet


Step to Identify NMAP ARP Scan

  1. Collect Ethernet Header details
Here we used wireshark to capture the network packet coming from victim’s network and in order to analysis only ARP packet we have applied filter “ip.addr == VICTIM IP || arp” as shown in given below image. Here you will find 2 arp packets, basically the 1st arp packet is broadcasting IP for asking MAC address of that network and the 2nd packet is unicast contains Answer of IP query.

Now let’s read Hex value of Ethernet header for identifying source and destination Mac addresses along with that we can also enumerated the bytes used for encapsulated packet, in order to identifying Ether type is being used here.



There should’nt be any uncertainty in conercn with source Mac address who is responsible for sending packet but if we talk about Destination Mac address then we got ff:ff:ff:ff:ff:ff:ff which means exact Destination is machine is not available here. Further moving ahead we found Ether type 0x0806 highlighted in yellow color is used for ARP protocol.
Hence from Ethernet header we can conclude it as ARP broadcast packet asking for destination Mac address.


  1. Collect ARP Header (Request/Reply)
In order to identify ARP scan you need to investigate some important parameters which could help a network admin to make correct assumption in concern of ARP scann.
Try to collect following details as given below:
·         Opcode (Request/Reply)
·         Source Mac
·         Source IP
·         Destination MAC
·         Destination IP 








Now execute given below command which known as “HOST SCAN” to identify live host in network by sending Ping request with the help of ICMP packet.

nmap -sn 192.168.1.100 –disable-arp-ping

Now above command will send ICMP request packet instead of ARP request for identifying live host in network.
Working of NMAP ICMP Ping when host is live:
         i.            Send ICMP echo request packet.
       ii.            Receive ICMP echo reply.
      iii.            Send TCP SYN packet on any TCP port (this port must be rarely blocked by network admin).
     iv.            Receive TCP RST-ACK from target’s Network.

As a result NMAP give “HOST UP” message as shown in given below image.



1.       Collect IP Header Details  for Protocol version

For reading data of Ethernet head visit to our previous article “Network packet forensic”.
NOTE: Ether type for IPv4 is 0x0800
Since we know ICMP is Layer 3 protocol according to OSI model therefore we need to focus on following details for ICMP forensic with help of IP Header of a packet.

Try to collect following details as given below:
·         Ip header length 20 Bytes (5bits*4=20 bytes)
·         Protocol (01 for ICMP)
·         Source IP
·         Destination IP



From given below image you can observe Hexadecimal information of IP header field and using given table you can study these value to obtain their original value.



The IP header length is always given in form of bit and here it is 5 bit which is also minimum IP header length and to make it 20 bytes multiple 5 with 4 i.e. 5*4 bytes =20 bytes.


  1. Identify ICMP Message type  (Request /Reply)
Now we had discussed above according to Nmap ICMP scanning technique the 1st packet is should be ICMP echo request packet and 2nd packet is should be of ICMP echo reply packet.


Now with help of following table you can read hex vaule highlighted in above and below image for ICMP Request and Reply packets  respectively.





  1. Identify TCP Flags
AS discussed above after ICMP reply, the 3rd packet should be of TCP-SYN packet and 4th should be of TCP-RST/ACK.  We had seen in our previous article the hex value of all TCP-Flags are different from each other, so if we are talking for TCP-SYN flag then its Hex value should 0x02.

From given below table you can observe the sequence of TCP flag and how bits of these flag are set for sending packet to destination port.

For example if you found TCP SYN packet then the bit for SYN flag is set 1 for which the binary value will be 000000010 and its hexadecimal will be 0x02.

NS
CWR
ECE
URG
ACK
PSH
RST
SYN
FIN
0
0
0
0
0
0
0
1
0


Sometime you will get combination of two or more flag in TCP header, so in that scenario take the help of following table to read the Hex value of such packet to identify TCP flags bits are being set 1.

For example if you found TCP SYN/ACK packets then indicates that SYN & ACK flags are set 1 for which the binary value will be 000010010 and its hexadecimal will be 0x12

NS
CWR
ECE
URG
ACK
PSH
RST
SYN
FIN
0
0
0
0
1
0
0
1
0

Therefore I design below table to let you know more about of Hex value when  two or more than two flags are set 1.




The image given above contains the hex value of TCP-SYN packets and the image given below contains the hex value of TCP-RST/ACK packet from which we can calculate the source port and the destination port of the packet respectively like one given below.


Conclusion! So as stated above regarding the working of NMAP ICMP scan we had obtain the hex value for every packet in same sequence.
Obtaining the hex value for every packet in such sequence gives indication to the Penetration tester that Someone has Choose NMAP ICMP scan for Network enumeration.


Default NMAP Scan (Stealth Scan)
Here we are going  with default scan method to enumerate “open”state of any specific port
nmap -p 80 192.168.1.100
Working of Default Scan for open port:
         i.            Send TCP-SYN packet
       ii.            Receive TCP-SYN/ACK
  1. Send TCP-RST packet
It is also known as half Open TCP Scan as it does not send ACK packet after receive SYN/ACK packet .


Step to Identify NMAP Default Scan (Stealth Scan)

1.       Collect IP Header Details  for Protocol Version

For reading data of Ethernet head visit to our previous article “Network packet forensic”.
NOTE: Ether type for IPv4 is 0x0800.
Try to collect following details as given below:
·         Ip header length 20 Bytes (5bits*4=20 bytes)
·         Protocol (6 for TCP)
·         Source IP
·         Destination IP

From given below image you can observe Hexadecimal information of IP header field and using given table you can study these value to obtain their original value.





  1. Analysis TCP Header  Details
Since from above image we had obtain Source and Destination IP and protocol used for communication i.e. TCP, now we need to identify source and Destination port and TCP Flag used for establishing connection between two system.
In image we have highlighted source port in “Light brown” color and destination port in “yellow color”, you can use given below table to read the hex value of given image.



So we come to know that here TCP-SYN packet is used for sending connection request on Port 80.


Again we read next packet then here we found hex value 12 indicates that TCP-SYN/ACK has been send from port 80.



Take the help given above table to read the hex vaule of given image. Hex value 12 for TCP flag is used for SYN + ACK as explained above,  and we get 0x12 by adding Hex value “ 0x02 of SYN” and “0x10 of ACK”. 


In the image given below we come to know that TCP-RST packet is used for sending Reset connection to Port 80.



Conclusion! So as declared above regarding the working of NMAP default scan or NMAP stealth scan we had obtain the hex value for every packet in same sequence.
Obtaining the hex value for every packet in such sequence gives indication to the Penetration tester that Someone has Choose NMAP Default scan for Network enumeration.


NMAP TCP Scan
Here we are going  with TCP scan to enumerate state of any specific port
nmap  -sT  -p 80 192.168.1.100
Working of Default Scan for open port:
         i.            Send TCP-SYN packet
       ii.            Receive TCP-SYN/ACK
  1. Send TCP-ACK packet
  2. Send TCP-RST/ACK packet

Step to Identify NMAP TCP Scan  

1.       Collect IP Header Details  for Protocol Version

For reading data of Ethernet head visit to our previous article “Network packet forensic”.
NOTE: Ether type for IPv4 is 0x0800.

Try to collect following details as given below:
·         Ip header length 20 bytes (5bits*4=20 bytes)
·         Protocol (06 for TCP)
·         Source IP
·         Destination IP



It is quite similar as NMAP stealth Scan and using given table you can study these values to obtain their original value.


  1. Analysis TCP Header  Details
NMAP TCP Scan follow 3 way handshak of TCP connection for enumeration open port. Identfying source and destination port along with Flag hex value (TCP-SYN) is similar as above.



So we come to know that here TCP-SYN packet is used for sending connection request on Port 80.


Again we read next packet then here we found hex value 12 indicates that TCP-SYN/ACK has been send via port 80.




The only difference between Stealth Scan and TCP scan is that here packet of ACK flag is send by source machine who intiate the TCP communication.  Again we read next packet then here we found hex value 0x10 indicates that TCP- ACK has been send via port 80.



Conclusion!
So as stated above regarding the working of NMAP TCP scan we had obtain the hex value for every packet in same sequence.
Obtaining the hex value for every packet in such sequence gives indication to the Penetration tester that Someone has Choose NMAP Default scan for Network enumeration.
NOTE:  For  packet TCP-RST/ACK the hex value will be “ 0x14” send by the attacker machine


NMAP FIN Scan
Here we are going  with TCP-FIN scan to enumerate “OPEN” state of a particular port in any Linux based system therfore excute given below command.
nmap  -sF  -p 22 192.168.1.104

Working of FIN Scan for open port: Send  2 packets of TCP-FIN on a specific port

FIN is part TCP flag and NMAP used FIN flag to intiat TCP communication instead of following three way handshak communication.


Step to Identify NMAP FIN Scan  

1.       Collect IP Header Details  for Protocol Version

For reading data of Ethernet head visit to our previous article “Network packet forensic”.
NOTE: Ether type for IPv4 is 0x0800

Try to collect following details as given below:
·         Ip header length 20 Bytes (5bits*4=20 bytes)
·         Protocol (06 for TCP)
·         Source IP
·         Destination IP

It is quite similar as NMAP above Scan and using given below table you can study these values to obtain their original value.




  1. Analysis TCP Header  Details
Now lets Identfying source and destination port along with Flag hex value (TCP-FIN) is similar as above.



So through given below image and with help of table we came to know that here TCP-FIN packet is used for sending connection request on Port 22.

Conclusion! So as declared above regarding the working of NMAP FIN scan we had obtain the hex value for every packet in same sequence.
Obtaining the hex value for every packet in such sequence gives indication to the Penetration tester that Someone has Choose NMAP FIN scan for Network enumeration.
NOTE:  If  you found 1st FIN packet (0x01) and 2nd RST packet (0x04) then indicates “Closed Port” on tagered network.


NMAP NULL Scan
Here we are going  with TCP Null scan to enumerate “OPEN” state of any specific port in any Linux based system.
nmap  -sN  -p 22 192.168.1.104

Working of Null Scan for open port: Send  2 packets of TCP-NONE on specific port

Here NMAP used NONE flag  (No flag) to initiate TCP communication and bit of each flag is set “0”instead of following three-way handshake communication.


Step to Identify NMAP Null Scan  

1.       Collect IP Header Details  for Protocol Version

For reading data of Ethernet head visit to our previous article “Network packet forensic”.
NOTE: Ether type for IPv4 is 0x0800
Try to collect following details as given below:
·         Ip header length 20 Bytes (5bits*4=20 bytes)
·         Protocol (06 for TCP)
·         Source IP
·         Destination IP


It is quite similar as NMAP above Scan and using given table you can study these values to obtain their original value.




  1. Analysis TCP Header  Details
Now lets Identfying source and destination port along with Flag hex value (TCP-NONE) is similar as above.




So through given below image and with help of table we come to know that here TCP-NONE packet is used for sending connection request on Port 22.
Conclusion! So as stated above regarding the working of NMAP NONE scan we had obtain the hex value for every packet in same sequence.
Obtaining the hex value for every packet in such sequence gives indication to the Penetration tester that someone has Chosen NMAP NONE scan for Network enumeration.

NOTE:  If  you found 1st NONE packet (0x00) and 2nd RST packet (0x04) then indicates “Closed Port” on tagered network.


NMAP XMAS Scan
Here we are going with XMAS scan to enumerate “OPEN” state of any specific port in any Linux based system
nmap  -sX  -p 22 192.168.1.104

Working of XMAS Scan for open port: Send 2 packets of TCP Flags in combination of FIN, PSH, URG on specific port.

Here NMAP used 3 TCP flags (FIN, PSH, and URG) to initiate TCP communication and bit of each flag is set “1”instead of following three way handshake communications.


Step to Identify NMAP XMAS Scan  

1.       Collect IP Header Details  for Protocol Version

For reading data of Ethernet head visit to our previous article “Network packet forensic”.
NOTE: Ether type for IPv4 is 0x0800
Try to collect following details as given below:
·         Ip header length 20 Bytes (5bits*4=20 bytes)
·         Protocol (06 for TCP)
·         Source IP
·         Destination IP

It is quite similar as NMAP above Scan and using given table you can study these values to obtain their original value.





  1. Analysis TCP Header  Details
Now lets Identfying source and destination port along with Flag hex value (TCP-XMAS) is similar as above.




So through given below image and with help of table we come to know that here TCP flags {FIN,PSH,URG} packet is used for sending connection request on Port 22.
Conclusion! So as stated above regarding the working of NMAP XMAS scan we had obtain the hex value for every packet in same sequence.
Obtaining the hex value for every packet in such sequence gives indication to the Penetration tester that someone has Choose NMAP XMAS scanned for Network enumeration.

NOTE: 
·         If you found 1st {FIN, PSH, URG} packet (0x29) and 2nd RST packet (0x04) then indicates “Closed Port” on targeted network.
·         NMAP FIN, NMAP NULL and NMAP XMAS scan are only applicable on Linux based system


NMAP UDP Scan
Here we are going  with XMAS scan to enumerate state of any specific port in any Linux based system
nmap  -sU  -p 68 192.168.1.104
Working of XMAS Scan for open port: Send  2 packets of UDP on specific port

It is quite different from TCP communication process because here no Flag are used for establishing connection or initiate connection request with target’s network.


Step to Identify NMAP UDP Scan  

1.       Collect IP Header Details  for Protocol Version

For reading data of Ethernet head visit to our previous article “Network packet forensic”.
NOTE: Ether type for IPv4 is 0x0800
Try to collect following details as given below:
·         Ip header length 20 Bytes (5bits*4=20 bytes)  
·         Protocol (11 for UDP)
·         Source IP
·         Destination IP

It is quite similar as NMAP above Scan as “IP header” and “Ethernet header” information will be same either is TCP communication or UDP communication and using given table you can study these values to obtain their original value.




Basically 11 is hex value use for UDP protocol which is quite useful in identify NMAP UDP scan from remanding scanning method.


  1. Analysis UDP Header  Details
Now lets Identfying source and destination port a as done above inTCP Scanning.




Conclusion! Obtaining the hex value for every packet in such sequence gives indication to the Penetration tester that Someone has Choose NMAP UDP scan for Network enumeration.
NOTE:  If  you found 1st UDP packet and 2nd UDP with ICMP Message Port is unreachable then indicates “Closed Port” on tagered network.