- Volatility
Linux phiên bản trước 20.x:
$ sudo apt-get install volatility
Linux phiên bản sau 20.x:
$ sudo apt update && sudo apt full-upgrade -y
$ sudo apt install -y python2 python-dev dwarfdump build-essential yara zip
$ wget https://raw.githubusercontent.com/pypa/get-pip/master/get-pip.py
$ sudo python2 get-pip.py
$ sudo pip2 install pycrypto yara-python distorm3==3.4.4
$ git clone https://github.com/volatilityfoundation/volatility.git
$ cd volatility/
$ sudo python2 setup.py install
Plugin cho volatility:
- Chrome history
$ git clone https://github.com/superponible/volatility-plugins.git
2. Mimikatz
$ git clone https://github.com/volatilityfoundation/community/blob/master/FrancescoPicasso/mimikatz.py
Các module khác cho công cụ cứ đặt trong thư mục volatility-plugins là được.
Export các tham số:
$ export VOLATILITY_PROFILE=Win10x64
$ export VOLATILITY_LOCATION=file://file.raw
Chạy công cụ :
$ python vol.py --plugins ./volatility-plugins/ chromehistory
hoặc
$ volatility --plugins ./volatility-plugins/ chromehistory
$volatility --plugins="volatility-plugins/" -f file.raw --profile=Win10x64 chromehistory