WaniCTF 2020 ALLIGATOR_02 Writeup Using Volatility 3

Volatility 3 から cmdscan と consoles が無くなった。

と言っても Volatility 2 を使ったとしても Windows 10 のメモリからは， Windows 7 のように typeした結果が見えたりはしない。
Windows 7 の終焉とともに  Volatility 2 もその役目を終えるはずだ。

現在は過渡期ではあるが，今後は Volatility 2 にとって代わるであろう Volatility 3 で WaniCTF 2020 ALLIGATOR_02 にチャレンジした。

まずはお約束 plist

```
$ python3 vol.py -f ALLIGATOR.raw windows.pslist
Volatility 3 Framework 1.0.1
Progress:  100.00               PDB scanning finished
PID     PPID    ImageFileName   Offset(V)       Threads Handles SessionId       Wow64   CreateTime      ExitTime       File output

4       0       System  0x83d3ac58      82      541     N/A     False   2020-10-26 19:00:20.000000      N/A     Disabled252     4       smss.exe        0x84429020      2       32      N/A     False   2020-10-26 19:00:20.000000      N/A    Disabled
328     320     csrss.exe       0x84a54ab0      9       411     0       False   2020-10-26 19:00:23.000000      N/A    Disabled
364     320     wininit.exe     0x843da208      3       77      0       False   2020-10-26 19:00:23.000000      N/A    Disabled
376     356     csrss.exe       0x84a66030      8       145     1       False   2020-10-26 19:00:23.000000      N/A    Disabled
408     356     winlogon.exe    0x849c0220      3       110     1       False   2020-10-26 19:00:23.000000      N/A    Disabled
460     364     services.exe    0x84a5c7a8      6       211     0       False   2020-10-26 19:00:23.000000      N/A    Disabled
476     364     lsass.exe       0x84a89850      7       601     0       False   2020-10-26 19:00:23.000000      N/A    Disabled
484     364     lsm.exe 0x84a5f250      10      170     0       False   2020-10-26 19:00:23.000000      N/A     Disabled596     460     svchost.exe     0x84aa58b8      9       354     0       False   2020-10-26 19:00:24.000000      N/A    Disabled
660     460     VBoxService.ex  0x84abc030      12      116     0       False   2020-10-26 19:00:24.000000      N/A    Disabled
712     460     svchost.exe     0x84ac6810      8       276     0       False   2020-10-26 03:00:25.000000      N/A    Disabled
768     460     svchost.exe     0x84aded20      20      455     0       False   2020-10-26 03:00:25.000000      N/A    Disabled
880     460     svchost.exe     0x84b11710      18      414     0       False   2020-10-26 03:00:25.000000      N/A    Disabled
920     460     svchost.exe     0x84b22030      16      344     0       False   2020-10-26 03:00:25.000000      N/A    Disabled
944     460     svchost.exe     0x84aa0448      34      962     0       False   2020-10-26 03:00:25.000000      N/A    Disabled
1008    768     audiodg.exe     0x84b2fd20      6       122     0       False   2020-10-26 03:00:25.000000      N/A    Disabled
1040    460     svchost.exe     0x84b35030      7       135     0       False   2020-10-26 03:00:25.000000      N/A    Disabled
1164    460     svchost.exe     0x84c5a9d8      16      365     0       False   2020-10-26 03:00:26.000000      N/A    Disabled
1300    460     spoolsv.exe     0x84c9e668      13      294     0       False   2020-10-26 03:00:26.000000      N/A    Disabled
1340    460     svchost.exe     0x84cad2c8      18      309     0       False   2020-10-26 03:00:26.000000      N/A    Disabled
1444    460     taskhost.exe    0x84ce78f0      8       163     1       False   2020-10-26 03:00:26.000000      N/A    Disabled
1544    880     dwm.exe 0x84d05570      3       68      1       False   2020-10-26 03:00:26.000000      N/A     Disabled1564    1532    explorer.exe    0x84d12be0      18      644     1       False   2020-10-26 03:00:26.000000      N/A    Disabled
1572    460     svchost.exe     0x84d14a80      10      144     0       False   2020-10-26 03:00:26.000000      N/A    Disabled
1628    460     svchost.exe     0x84d3d798      12      216     0       False   2020-10-26 03:00:26.000000      N/A    Disabled
1840    460     cygrunsrv.exe   0x84dbbd20      6       101     0       False   2020-10-26 03:00:27.000000      N/A    Disabled
1880    1564    VBoxTray.exe    0x84dc8a38      12      142     1       False   2020-10-26 03:00:27.000000      N/A    Disabled
2024    460     wlms.exe        0x84e024e8      4       46      0       False   2020-10-26 03:00:27.000000      N/A    Disabled
1772    1840    cygrunsrv.exe   0x84dc8030      0       -       0       False   2020-10-26 03:00:28.000000      2020-10-26 03:00:28.000000      Disabled
336     328     conhost.exe     0x84aeab70      2       33      0       False   2020-10-26 03:00:28.000000      N/A    Disabled
856     1772    sshd.exe        0x84aa1510      4       100     0       False   2020-10-26 03:00:28.000000      N/A    Disabled
1908    460     sppsvc.exe      0x84d1d458      4       146     0       False   2020-10-26 03:00:29.000000      N/A    Disabled
2052    460     svchost.exe     0x84e7f258      5       92      0       False   2020-10-26 03:00:29.000000      N/A    Disabled
2332    460     SearchIndexer.  0x84f0d9c0      11      688     0       False   2020-10-26 03:00:33.000000      N/A    Disabled
2400    2332    SearchProtocol  0x84f32030      6       279     0       False   2020-10-26 03:00:33.000000      N/A    Disabled
2676    2656    csrss.exe       0x8448eb18      7       218     2       False   2020-10-26 03:01:39.000000      N/A    Disabled
2700    2656    winlogon.exe    0x84a22710      3       107     2       False   2020-10-26 03:01:39.000000      N/A    Disabled
2884    460     taskhost.exe    0x84a4bd20      10      250     2       False   2020-10-26 03:01:43.000000      N/A    Disabled
2948    880     dwm.exe 0x84f49300      3       72      2       False   2020-10-26 03:01:43.000000      N/A     Disabled2964    2932    explorer.exe    0x84435030      34      1091    2       False   2020-10-26 03:01:43.000000      N/A    Disabled
3108    2964    VBoxTray.exe    0x84dd8030      13      143     2       False   2020-10-26 03:01:43.000000      N/A    Disabled
3632    2964    evil.exe        0x84dd6b28      1       21      2       False   2020-10-26 03:01:55.000000      N/A    Disabled
3728    2964    cmd.exe 0x8494c030      1       19      2       False   2020-10-26 03:02:09.000000      N/A     Disabled3736    2676    conhost.exe     0x83eb8d20      2       53      2       False   2020-10-26 03:02:09.000000      N/A    Disabled
3912    460     svchost.exe     0x8493e578      13      379     0       False   2020-10-26 03:02:30.000000      N/A    Disabled
1108    596     WmiPrvSE.exe    0x84e6a910      7       161     0       False   2020-10-26 03:03:16.000000      N/A    Disabled
2212    944     wuauclt.exe     0x83ee7d20      5       93      2       False   2020-10-26 03:03:31.000000      N/A    Disabled
2660    2332    SearchFilterHo  0x83f211a8      5       99      0       False   2020-10-26 03:03:33.000000      N/A    Disabled
3376    596     WmiPrvSE.exe    0x83f3ac68      8       117     0       False   2020-10-26 03:04:27.000000      N/A    Disabled
3740    2964    MRCv120.exe     0x83f52d20      16      356     2       False   2020-10-26 03:04:32.000000      N/A    Disabled
```

あやしいのは cmd.exe
ダンプして，strings をかける。

```
$ python3 vol.py -f ALLIGATOR.raw windows.pslist --pid 3728 --dump
Volatility 3 Framework 1.0.1
Progress:  100.00               PDB scanning finished
PID     PPID    ImageFileName   Offset(V)       Threads Handles SessionId       Wow64   CreateTime      ExitTime       File output

3728    2964    cmd.exe 0x8494c030      1       19      2       False   2020-10-26 03:02:09.000000      N/A     pid.3728.0x49f20000.dmp

$ strings -a pid.3728.0x49f20000.dmp > ascii.txt
$ strings -a -el pid.3728.0x49f20000.dmp > unicode.txt
```

なんかいいもの発見！
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/1163572/6f9d0ce9-a99f-05ee-6fd2-bd9bda3a55d7.png)
メモリの中に flag.txt は存在するか？

```
$ python3 vol.py -f ALLIGATOR.raw windows.filescan | grep -i flag
0x3fcffab8 100.0\Users\ALLIGATOR\Desktop\flag.txt       128
```

ビンゴ

あとは取り出すだけ

```
$ python3 vol.py -f ALLIGATOR.raw windows.dumpfiles --physaddr 0x3fcffab8
Volatility 3 Framework 1.0.1
Progress:  100.00               PDB scanning finished
Cache   FileObject      FileName        Result

DataSectionObject       0x3fcffab8      flag.txt        file.0x3fcffab8.0x84ae8c80.DataSectionObject.flag.txt.dat
```

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/1163572/c7d5595f-9424-e353-0fee-7382e4425153.png)

参考としたサイト（ありがとうございました。）

https://qiita.com/ninja400/items/f3dd1e6eb80fd5b39ba9

https://github.com/wani-hackase/wanictf2020-writeup/tree/master/forensics/ALLIGATOR_02#alligator_02