Using Forensic Tools Offensively
This should not be a surprise to people who use forensic tools on a daily basis, but it is a good reminder. I just noticed two great posts, Dumping Memory to extract Password Hashes Part 1 and Dumping Memory to extract Password Hashes Part 2, on the Attack Research blog. They show how to exploit a system with Metasploit, upload the Meterpreter, upload Mantech's MDD memory dumper, dump memory, download it to an attacker's system, and then follow instructions from Forensiczone to use Moyix's volreg extensions to the Volatility Framework to extract passwords. I would be curious to see if intruders are really using methodologies like this. One way to identify such activity would be to watch for files being exfiltrated from the enterprise that match common memory sizes, such as 512 MB, 1 GB, 2 GB, 4 GB, and so on.
Richard Bejtlich is teaching new classes in Europe and Las Vegas in 2009. Online Europe registration ends by 1 Apr, and seats are filling. "Super Early" Las Vegas registration ends 15 Mar.
Comments
A quick Google search revealed the following page has a good example of how to use this:
http://www.pauldotcom.com/wiki/index.php/Episode106
Look under the section entitled "Tech Segment: Probe, Exploit, and Crack for Free"
The hashdump feature requires Admin/SYSTEM access to the box to work. The article doesn't mention what access MDD requires, but I would assume it would also be Admin/SYSTEM access.
Are there any other potential benefits from obtaining a complete memory dump for an attacker? I suppose you could also use the memory dump to add strings to a custom password cracking dictionary (perhaps an insecure app with manually synched password has left its plain text password in memory). The memory could also contain confidential information....
Good point -- I show that in my classes. I just wanted to show that some people are looking at forensics tools with an offensive eye these days.
Yes, all the references I have seen to memory analysis over the last year or so since its been really popular have been focused on the IR/Digital forensics uses of the tools. Seeing discussion on uses of memory dumps for attack is certainly an interesting change. Im wondering on how long it will take for some Volatility style memory analysis tools to be written from the offensive perspective. I know I will certainly be giving it some thought in future...
The potential for detecting this by checking for traffic in memory sized lumps is also a good idea. You could perhaps also create IDS signatures for common patterns that appear in memory dumps as well (such as the Windows lsass.exe process)