Hope you are all doing awesome. As always, today we’re agin going to learn something from the basics of cybersecurity world, where a seemingly harmless string of characters can become our nightmare. Yes, you guessed it—we’re talking about default passwords. Not only that We also learn how we can use a tool called Passhunt on our Kali Linux system and find loopholes on various devices.

Why Default Passwords Are So Dangerous?

Now, imagine we’re working on our own home or office. We’ve got all these trusty devices—like routers, webcams, printers—keeping our connection the world and running our work smoothly. But here’s the catch: many of these devices come with default usernames and passwords straight out of the box.

At first glance, default passwords might seem like a easy shortcut. After all, who wants to spend time to set up a new password when we can just use the one that’s already there, right? Wrong! Default passwords are like leaving the front door of our system wide open for bad characters. Devices with default credentials aren’t just in danger—they are the danger. Anybody can enter the system without knocking the door.

Let we have a look how default passwords can lead to some serious cyber attacks on us.

• Network Nets: Imagine that—we’ve got our brand new router up and running, blissfully unaware that it’s still using the default password. Along comes a crafty bad attacker who sniffs out our router’s vulnerability faster than we can type “password123.” With access to our router, the attacker can wreak havoc on our entire network—slowing down our internet, eavesdropping on our data, or even launching full-blown cyber attacks. It’s like handing over the keys to our system on a silver platter!
• Web Woes: Next up, we’ve got webcams. These little things might seem innocent enough, but with default passwords, they’re serious trouble makers. Imagine a attacker gaining access to our webcam without we even knowing it. They could spy on our every move, invade our privacy, or even use the footage for blackmail. It’s like having an unwanted guest lurking in the shadows of our home, and nobody wants that!
• Printer Predicaments: Last but not least, let’s talk about printers. Yes, even these humble machines aren’t safe from the perils of default passwords. With access to our printer, a attacker could intercept sensitive documents, manipulate print jobs, or even launch a good old-fashioned printer hack (yes, that’s a thing!), gaining unauthorized access to sensitive documents stored on the printer’s memory. It’s like turning your trusty printer into a cyber tool, ready to strike at a moment’s notice.

So, what’s the moral of the story? It’s simple: always, always, always change default passwords. Whether it’s for our router, our webcam, our printer, or any other device in our supervision, we shouldn’t take shortcuts when it comes to security. Humans are the most weakest point in any security system. Humans are normally stupid, not really, a better word would ignorant, they don’t aware how stuff works. We just want that our router runs perfectly for Netflix and chill.

Hunting down default passwords using Passhunt

Enough talking about layman’s who ever reading this considers as a cyber security expert and we cyber security experts didn’t came here to learn those above things. We wanna test these kind of vulnerabilities due to human errors. Passhunt is a Python script which is going to help us on this matter.

This Passhunt tool originally created by Viral Maniar which can search through 523 vendors and their 2084 default passwords. It works like a database. Passhunt was giving some issues on newer Python and Kali Linux version. We have updated this script and removed some unwanted lines to run it on our Kali Linux system.

Let’s fire up our Kali Linux Terminal and type following command to clone Passhunt from Github:

git clone https://github.com/jaykali/Passhunt

After pressing Enter ↲ button on our keyboard Passhunt will be downloaded on our system as we can see in the following screenshot.

Now we are going to use cd command to go to the Passhunt directory. The command will be following:

cd Passhunt

Now we need to install required dependencies to run Passhunt and the command will be following:

pip3 install -r requirements.txt

It may take some seconds depending on our internet speed and system configuration. In the following screenshot we can see the output of above commands.

Now we are going to run Passhunt by using following command:

python passhunt.py

Now our password hunter Passhunt is ready and running as we can see in the following screenshot.

In the above screenshot we can see that there are 3 options only on the main menu.

1. List supported vendors: By pressing 1 and Enter we can see all the supported vendors (brands) names list.
2. Search Default Password: We can Hit 2 and Enter to search for a Vendor’s default credentials.
3. Exit: To quit this tool we just need to type 3 and hit Enter.

Now assume we have encountered with a D-Link device, and we are thinking to try default passwords login on this then we can search for it on Passhunt by pressing 2 and hit Enter ⤶.

Then it will prompt for vendor’s name we can use D-Link in our case. After that we are able to see the list of D-Link devices and their default credentials. Here we can choose our target device as we can see in the following screenshot:

This is how we can search for default password database using Passhunt on our Kali Linux system. Nowadays default password devices are rare every device have it’s own default password written on somewhere in the packets. But there are some web services which are old and not updated for a while even offices, universities, households use very old model routers for saving some bucks. Humans are 

Humans are ignorant they really don’t care about these online security. They uses same passwords on internet banking, social media even in shopping sites also. They don’t change the default passwords of devices. Those things are really scary.

One more thing, If our target device is a router and it have a WPS button (ultra modern routers usually don’t have WPS button, others may have) then we can also try Pixie Dust Attack to crack it.

That is it for today. We already knows that default passwords are very risky and learn something new i.e using Passhunt on our Kali Linux system and search for default passwords and credentials.

Love our article? Make sure to follow us on Twitter and GitHub, we post article updates there. To join our KaliLinuxIn family, join our Telegram Group & Whatsapp Channel We are trying to build a community for Linux and Cybersecurity. For anything we always happy to help everyone on the comment section. As we know our comment section is always open to everyone. We read each and every comment and we always reply.

Becoming anonymous is a very good way to hide ourself form all kind of surveillance. But we get only few option because VPN is really bad, specially those free one. Free VPN’s keeps logs and we can be traced.

We can use TOR network, not the browser only. Tor can’t be traced easily it is very hard (practically close to impossible). Read our detailed article on Tor network.

We can use Tor as a default gateway for our network. Then all the traffic on our PC will transfer via Tor network and it’s not possible to trace us. We can do this manually with a server but manual configuration of this will consume a lot of time and hard work. Automated tools will help us.

This is not the first, previously we made an article on AnonSurf, but that tool is not updated in last 3 years and we got a lot of issues.

In today’s article we gonna talking about Nipe. This perl script enables us to directly route all our traffic from our computer to the Tor network through which we can use the internet anonymously without having to worry about tracked or traced back.

First of all we need to clone this repository from GitHub by using following command:

git clone https://github.com/htrgouvea/nipe

Then it will copied to our system we can go inside the directory using cd command:

cd nipe

The screenshot of the above commands is following:

Now we need to install libraries and dependencies by using following command:

sudo cpan install Try::Tiny Config::Simple JSON

Now for new comers cpan might be a strange command, cpan helps to install packages or modules for Perl. In simple words we can say ‘Python have pip‘ & ‘Perl have cpan‘.

After this we can install this Perl script using following command:

sudo perl nipe.pl install

Then the installation process will start. After the installation we got a notification that some services need to restart, here we press “TAB” button and select OK by pressing ENTER, as we can see in the following screenshot:

After this we can say that our installation process is done. Now we are ready to ROCK.

First of all we check the status of NIPE tool by applying following command:

sudo perl nipe.pl status

The screenshot of the command is following:

In the above screenshot we can see that NIPE is disabled here but we can start it using following command:

sudo perl nipe.pl start

After applying these command NIPE services will be started, now again if we can check the status by applying sudo perl nipe.pl status command then, we can see the output as the following screenshot:

Now we need to test our IP by opening dnsleaktest website to make sure that our original IP address is hided. Checking this will be a good test for NIPE tool beneficial for everyone.

When we are done we can off this Tor gateway and get back to our original IP address by applying following command:

sudo perl nipe.pl stop

After applying the above command NIPE will stop and we get back our original IP. We can check the status, as we did in the following screenshot:

NIPE makes Tor network our default gateway. This is how we can anonymise our total Kali Linux system. This process is enough secure. Practically cracking Tor is close to impossible but as we know theoretically everything is possible.

Love our articles? Make sure to follow us on Twitter and GitHub, we post article updates there. To join our KaliLinuxInfamily, join our Whatsapp Channel & Telegram Group. We are trying to build a community for Linux and Cybersecurity. For anything we always happy to help everyone on the comment section. As we know our comment section is always open to everyone. We read each and every comment and we always reply.

In our today’s article we discuss about how we can run C and C++ programs in Kali Linux system.

Sometimes we counter with C and C++ programs, now we are using Kali Linux as primary installation then how to run them?

Well this is very easy. This tutorial is also going to be useful for other Debian based distributions like Ubuntu, Mint etc.

Without wasting valuable time let’s get started.

Running C Programs in Kali Linux

First we need to have a C program in our Kali Linux system. Let’s write it.

To write a C program we choose notepad++ in our Kali Linux system. Oh it’s not comes with Kali Linux (Notepad++ supports Windows only) but we shows how we have installed Windows programs in Kali Linux.

After opening Notepad++ we wrote a simple ‘hello world’ script on C and save it with hello-world.c name on our desktop, as we can see in the following screenshot:

Now we just need to open our Terminal window in Kali Linux system and navigate to our Desktop directory by using cd command:

cd Desktop

To run any C programs we need to have GCC in our Linux system. GCC is a C compiler for Linux or UNIX based system. It’s comes pre-installed with Kali Linux but if we need to install or update gcc we can run following command in our terminal:

sudo apt-get install gcc

The screenshot of the command is following:

Let we are going to run our C program by using following command:

gcc hello-world.c

It will run as we can see in the following screenshot:

After running this command we can’t see nothing output. No worry, it is not given any output now but created a a.out file in our current directory. We can see it by using ls command:

ls

In the above screenshot we can see the a.out file. This is an executable file for Mac or Linux. If we use GCC in Windows system then it will create a exe file.

Now as we know this a.out file is executable we can execute this by using following command:

./a.out

The screenshot is following. Here we successfully run our C program.

If we need we can do with another name using -o flag. If we need the output called ‘hello’ in the place of ‘a.out’ then we can use following command:

gcc -o hello hello-world.c

Then we got a file called hello and we run it using ./hello command.

Here we learned how we can run C programs in Kali Linux system.

Running C++ Programs in Kali Linux

Running C++ programming in Kali Linux is very similar to run C programs. Here in the place of GCC we need to use G++ compiler. To install/update G++ in our Kali Linux we ca use following command:

sudo apt-get install g++

Then we can compile a C++ program. We have a C++ program (“Hello World!” file named hello.cpp for example).

Using G++ is very similar to GCC we can use -o flag to create another named file instead ‘a.out’.

g++ -o hello-world hello.cpp

Then we can use following command to run our compiled file and get the output.

./hello-world

As we can see in the following screenshot:

This is how we can run C++ program in our Kali Linux system. In this article we learned how we can run C and C++ programs in our Kali Linux or any other Linux distributation. Hope this article helps our fellow Kali Linux users. Really love our articles? Make sure to follow us to get all our articles directly on notification. We are also available on Twitter and GitHub, we post article updates there. To join our KaliLinuxIn family, join our Whatsapp Channel & Telegram Group. We are trying to build a community for Linux and Cybersecurity. For anything we always happy to help everyone on the comment section. As we know our comment section is always open to everyone. We read each and every comment and we always reply

In our installation of Kali Linux 2023.3 (also in older version) we can see that if we see other language in browser then it is not readable easily. 

The occurrence of this issue is attributed to the absence of fonts for other languages in our Kali Linux system. In this tutorial, we will address the language and font problem in Kali Linux. Resolving this matter is a simple process – all that is required is downloading the fonts for the relevant languages and placing them in the correct location. That’s it.

First of all we need to download the language and fonts from the internet. We can copy the fonts from other Operating systems (Ubuntu and even from Windows).

We just uploaded the files as a zip file. It can be downloaded from this Google Drive link.

We have downloaded the file file as we can see in the following screenshot:

Now we unzip this by using right click and choose “Extract Here“.

After finishing we can see that a folder called “Fonts” in our directory.

Now we just need to open the folder called “Fonts”, and we got all the files into the directory as we can see in the following screenshot:

We need to copy and paste these all files into /usr/share/fonts directory. For becoming a non-root user we can’t paste these files directly on the directory. We need to open the file manager with root permission.

So we need to close everything, and open a terminal. We need to type following command to open our file manager with root permission:

sudo thunar

After giving our sudo password we can see that our Thunar file manager opens with root permission.

Then we just need to go into the “Fonts” directory and select all and copy everything. We can use keyboard shortcuts CTRL+A and CTRL+C for this. 

Then we need to go to the /usr/share/fonts directory, and paste everything here by using CTRL+V (or anyway). That’s all.

We are done. Now we can open again Google’s homepage and see if it works or not?

We can see that font problem is fixed now

It worked.

We also can copy these font files from a Windows computer. Those font files will be located on C:/Windows/Fonts directory. We can copy them on a USB drive and paste on Kali Linux it also will work.

Love our articles? Make sure to follow us to get all our articles directly on notification. We are also available on Twitter and GitHub, we post article updates there. To join our KaliLinuxIn family, join our Whatsapp Channel & Telegram Group. We are trying to build a community for Linux and Cybersecurity. For anything we always happy to help everyone on the comment section. As we know our comment section is always open to everyone. We read each and every comment and we always reply.

WhatsApp is the most widely used messenger in the world. It has more than two billion active user base which is great. We have adopted WhatsApp in our life and we use this for our very personal works, like personal media shearing and chats. But there is a catch.

Why we can’t trust Whatsapp?

While WhatsApp is a popular messaging platform known for its end-to-end encryption, which theoretically provides a high level of security for private chats, there are still some reasons why individuals might have concerns about trusting the platform completely. Here are a few factors to consider:

Ownership by Facebook: WhatsApp is owned by Facebook, and there have been concerns about how user data is shared between the two platforms. While WhatsApp messages are end-to-end encrypted and Facebook claims not to have access to them, there have been changes to the privacy policy that allow for some data sharing between WhatsApp and Facebook.

Privacy Policy Changes: WhatsApp has updated its privacy policy in the past, leading to controversy and concerns about how user data is handled. While the end-to-end encryption remains intact, other data such as metadata, contacts, and account information may be collected and shared for various purposes.

Government Access: In some cases, governments may request access to user data for legal or security reasons. While WhatsApp claims not to have a backdoor for such access, the legal landscape can vary, and there have been instances of government requests for data.

So that’s pretty much clear that we need another platform from for our private message. Telegram and Signal is good alternative of Whatsapp. In this detailed article we are going to discuss how we can install Signal and Telegram on our Linux System, we are using Kali Linux here. But we can use the same method on any Debian based Linux distribution (Ubuntu, Mint, Elementary etc).

Signal

Signal is an open-source privacy focused software for private/group messaging and calls. It can be the perfect alternative to WhatsApp. Signal has almost the same interface like WhatsApp. It has encryption and a lot of more privacy than WhatsApp. Even Edward Snowden and Elon Musk recommended using Signal.

Use Signal

— Elon Musk (@elonmusk) January 7, 2021

Signal is available on various platforms. It is available for mobile devices Android and iOS. It also has desktop applications for Windows, Mac and Linux. We don’t give any link for Linux Download. We will show the process here.

How to install Signal on Linux

To install Signal on Linux we can use the following method.

First of all we need to Install Signal’s official public software signing key by using following commands one by one:

wget -O- https://updates.signal.org/desktop/apt/keys.asc |

sudo apt-key add -

The screenshot of the command is following:

This might take some time and ask for the root password.

After this we need to add Signal’s repository to our list of repositories by using following command:

echo "deb [arch=amd64] https://updates.signal.org/desktop/apt xenial main" |
  sudo tee -a /etc/apt/sources.list.d/signal-xenial.list

We can copy and paste this command to our terminal to add the repository.

Then we just need to update our system by using following command:

sudo apt-get update

After the updating process complete we can install Signal desktop app by using following command:

sudo apt install signal-desktop

This will take some time to download (111 MB) and install.

After finishing the process we can find Signal desktop applications on our application list.

Now we just need to link our phone’s Signal app with our PC by scanning the QR code. It’s not like the WhatsApp Web, because in WhatsApp Web our both devices need to connect to the internet. Here after scanning we can use our PC as a primary device.

Our chats are saved on our device not in their server (like WhatsApp) so we can’t see the mobile chats on the PC.

Telegram

Telegram is already a very popular messaging and media sharing platform. We don’t think it needs any special introduction. It also supports cross platform. It also has mobile and desktop versions.

It is also available for mobiles on Play store and app store. Also it is available for Windows, Mac and Linux (64bit and 32bit).

It is also open-source and the source code is available on their GitHub repository.

How to install Telegram on Linux

To download it on our Linux system we just need to download it from the official website. Then we can download it’s Linux version (we are in 64 bit).

It will download a tar.xz compressed file. After downloading it we can find it on our Downloads folder. We need to extract the compressed file and we got two binary files as we can see in the following screenshot:

Here, we just need to double click on the “Telegram” file and it will be started. We can use it as a separate Telegram account or we can link our mobile devices via QR code. It will show us desktop notification of new chats.

Note: This installation of Telegram does not “install” the app on our system, but it will add a ‘Telegram’ app shortcut to our system app launcher/app menu. Just remember to not delete the binary file it links to!

There are some more privacy messengers on the market (Wikr, Utopia), but these are the most wanted. So we discussed these and their installation on Linux. We usually prefer Signal more than Telegram. Tell us about personal choice in the comment section.

Love our articles? Make sure to follow us to get all our articles directly on notification. We are also available on Twitter and GitHub, we post article updates there. To join our KaliLinuxIn family, join our Whatsapp Channel & Telegram Group. We are trying to build a community for Linux and Cybersecurity. For anything we always happy to help everyone on the comment section. As we know our comment section is always open to everyone. We read each and every comment and we always reply.

In our some previous articles (Scalpel, Foremost etc) we have discussed how to can run digital forensics on hard disk drives. But data is not only stores there this included RAM and the swap partition, or paging, file, which is an area of the hard disk drive.

Now the issue is RAM’s data is very volatile, means the data in the RAM easily lost, when there are no electrical charge or current in the RAM chip. With the data on RAM being the most volatile, it ranks high in the order of volatility and must be forensically acquired and preserved as a matter of high priority.

Many types of data & forensics artifacts reside in Random Access Memory (RAM) and the paging file. They are might be login passwords, user information, running and hidden processes or even encrypted passwords are just some of the many types of interesting data that can be found when we run digital forensics test of RAM.

In our this article we use Volatility Framework to perform memory forensics on our Kali Linux system.

Volatility Framework is an open-source, cross-platform framework that comes with many useful plugins that provide us very good information from the snapshot of memory. This also known as memory dump.

The concept of Volatility is very old but it’s works like magic. Not only analyzing running and hidden processes, is also a very popular choice for malware analysis.

As we said Volatility Framework is a cross platform framework. It can be run on any OS (32 and 64 bit) that supports Python including:

• Windows XP, 7, 8,8.1, and Windows 10.
• Windows Server 2003, 2008, 2012/R2, and 2016.
• Linux 2.6.11 – 4.2.3 (including Kali, Debian, Ubuntu, CentOS, and more).
• macOS Leopard (10.5.x) and Snow Leopard (10.12.x) and newer.

Volatility supports several memory dump formats (both 32- and 64-bit), including:

• Windows crash and hibernation dumps (even Windows 7 and earlier).
• VirtualBox.
• VMWare .vmem dump.
• VMware saved state and suspended dumps—.vmss/.vmsn.
• Raw physical memory—.dd.
• Direct physical memory dump over IEEE 1394 FireWire.
• Expert Witness Format (EWF)—.E01.
• QEMU (Quick Emulator).

Even we can convert between these formats and boosts of being able use Volatility with other tools.

Before use Volatility Framework we need to create a memory dump for testing. We can use several tools such as FTK imager, Helix, LiME can be used to acquire the memory image or memory dump. Then it can be investigated and analyzed by the Volatility Framework.

For this tutorial we are going to use a Windows XP image (named cridex.vmem) which is downloaded from here. Volatility have uploaded lots of memory samples publicly available for testing there. We can use them for our practice with the Volatility Framework and enhance our skills. We can download as many as we like and we can use various plugins available in Volatility. In the following screenshot we can see that our dump image is saved on our Desktop for easy access.

Using Volatility in Kali Linux

Volatility Framework comes pre-installed with full Kali Linux image. We can see the help menu of this by running following command:

volatility -h

Then we got the help of Volatility Framework as we can see in the following screenshot:

If we scroll down a little bit on the help menu we can find the list of all plugins within Volatility Framework.

This list comes in handy when performing analysis as each plugin comes with it’s own short description. In the following screenshot we can see a plugin with it’s description.

Gaining Information using Volatility

This imageinfo plugin will tell us about the image. The format for using plugins in Volatility is:

volatility -f [filename] [plugin] [options_if_required]

Now we have stored our image file on Desktop so first we change our working directory by using cd Desktop command. Then we run imageinfo plugin to check information of the image by applying following command:

volatility -f cridex.vmem imageinfo

In the following screenshot we can see the information about our image file.

In the above screenshot we can see some information about the image used, including the suggested operating system and Image Type (Service Pack), the Numbers of Processor used and the date and time of the image. Some valuable information we got from this image is listed:

• WinXP: Windows XP.
• SP3: Service Pack 3.
• x86: 32 bit architecture.

We also can see the suggested profiles WinXPSP2x86 (Windows XP Service Pack 2×86), WinXPSP3x86 (Windows XP Service Pack 3×86) but in the image type section we can see that service pack is 3 so we can use “WinXPSP3x86” profile for our analysis.

Process Analysis using Volatility on Kali

To identify & link connected processes, their ID’s, running time and offset locations within the RAM image, we need these four plugins to get started:

1. pslist
2. pstree
3. psscan
4. psxview

1. Pslist Plugin on Volatility

This plugin or tool shows a list of all running processes, also it gives very crucial information like, Process ID (PID) and the Parent PID (PPID). Not only that it also shows the time when the processes started.

Let we run the pslist first then we explain the things. We use following command:

volatility --profile=WinXPSP3x86 -f cridex.vmem pslist

The following screenshot shows the output of the preceding command:

The Finding are discussed following

In the above screenshot we can see the System, winlogon.exe, services.exe, svchost.exe, and explorer.exe services are all started first and then followed by reader_sl.exe, alg.exe, and finally wuauclt.exe.

The PID identifies the process and the PPID identifies the parent of the process. Looking at the pslist output, we can see that the winlogon.exe process has a PID of 608 and a PPID of 368. The PPID’s of the services.exe and the lsass.exe processes (directly after the winlogon.exe process) are both 608, indicating that winlogon.exe is in fact the PPID for both services.exe and lsass.exe.

For those new to process IDs and processes themselves, a quick Google search can assist with identification and description information. It is also useful to become familiar with many of the startup processes in order to readily point out processes that may be unusual or suspect.

The timing and order of the processes should also be noted as these may assist us in investigations. In the above screenshot, we can see that several processes, including explorer.exe, spoolsv.exe, and reader_sl.exe, all started at the same time of 02:42:36 UTC+0000. We can also tell that explorer.exe is the PPID of reader_sl.exe.

In this analysis, we can see that there are two instance of wuauclt.exe with svchost.exe as the PPID.

2. Pstree Plugin on Voltility

pstree is another process identification command that can be used to list processes. pstree shows output the same list of processes as the pslist command did in previous, but identification is also used to know which one child process and which one is parent process.

To run pstree we use following command:

volatility --profile=WinXPSP3x86 -f cridex.vmem pstree

Following screenshot shows the output of the preceding command:

In the above screenshot, the last two processor listed are explorer.exe and reader_sl.exe. The explorer.exe is not indented, while reader_sl is indented, indicating that sl_reader is the child process and explorer.exe is the parent process. This is how we can identify the parent process and child process.

3. Psscan Plugin on Volatility

With the help of pslist and pstree we have checked the running processes, now it’s time look for inactive and even hidden processes using psscan. Now this hidden processes may be caused by malwares (like rootkits), and they are well known for doing just that to evade discovery by users & antivirus programs.

To check the inactive process using psscan we can use following command:

volatility --profile=WinXPSP3x86 -f cridex.vmem psscan

The output of the command shows in the following screenshot:

Now we can compare the outputs of both paslist and psscan to find any anomalies.

3. Psxview Plugin on Volatility

As with psscan, the psxview plugin is used to find and list hidden processes. With psxview however, a variety of scans are run, including pslist and psscan.

To run the psxview we apply following command:

volatility --profile=WinXPSP3x86 -f cridex.vmem psxview

The output of the command shows in the following screenshot:

Analyzing Network Services & Connections using Volatility

Volatility can be used to find and analyze active, terminated, and hidden connections along with ports and processes. All the protocols are supported and Volatility also reveals details of ports used by the processes including the times the processes were started.

To do this we are going to use the following three commands:

1. connections
2. connscan
3. sockets

1. Connection Plugin on Volatility

The connections command lists active connections at that time. It also displays local and remote IP with the ports and PID. The connection command can be used only for Windows XP and Microsoft 2003 server (both 32 bit and 64 bit).

To use the connections command in Volatility we can use following command:

volatility --profile=WinXPSP3x86 -f cridex.vmem connections

The following screenshot shows the output of the connections command and we can see the IP address (both local and remote) along with the port numbers and PID.

2. Connscan Plugin on Volatility

The connections command displayed only on connection as active at that time. To see a list of connections that have been terminated, we can use the connscan command. This connscan command is also only for Windows XP and 2003 Server (both 32 bit and 64 bit) systems.

To use connscan we run the following command:

volatility --profile=WinXPSP3x86 -f cridex.vmem connscan

The screenshot of this command is following:

In the above screenshot we can see that same local address was previously connected to another Remote Address with the IP address 125.19.103.198 on port 8080. The PID of 1484 is proof that connection was made by the explorer.exe (tested on pslist earlier).

Here we got the Remote IP address. Now for more information we can search the IP address on some IP Look up web services like https://whatismyipaddress.com/ip-lookup or https://www.ip2location.com/demo. We got some additional information from there as we can see in the following screenshot.

We can get IP details like, ISP (Internet Service Provider) name, Continent, Country and City. We also got a map co-ordinate of the city.

3. Sockets Plugin on Volatility

We use the sockets plugin to give additional connectivity information listening sockets.

To use sockets plugin we can use following command:

volatility --profile=WinXPSP3x86 -f cridex.vmem sockets

We can see the output of the command in the following screenshot:

We can see in the above that only UDP and TCP protocols are showing in this case. But sockets plugin supports all types of protocols.

Dynamic Link Libraries Analysis using Volatility

DDL a.k.a. Dynamic Link Libraries are only for Microfost (Windows & Servers). It contains code that can be used by multiple programs simultaneously.

Inspection of a process’s running DDLs and the version information of files and products may assist in correlating processes. Processes and DLL information should also be analyzed as they relate to the user accounts. For these tests we can use the following plugins:

1. verinfo
2. dlllist
3. getsids

1. Verinfo plugin on Volatility

This plugin lists version information as we can see in the plugin name (verinfo) about PE (portable executable) files. The output of this file is usually quite lengthy and so can be run in a separate terminal, if we not wish to continuously scrool through the current terminal to review past plugin command lists and output.

We can use verinfo plugin by running following command:

volatility --profile=WinXPSP3x86 -f cridex.vmem verinfo

The screenshot of the command is following:

2. Dlllist plugin on Volatility

This dlllist plugin lists all running DLLs at that time in memory. DLLs are composed of code that can be used by multiple programs concurrently.

We can use the dlllist plugin by running the following command:

volatility --profile=WinXPSP3x86 -f cridex.vmem dlllist

The following screenshot shows the output of the command:

3. Getsids plugin on Volatility

To identify all users we can use Security Identifier (SID). The getsids command has four very useful items in the order in which the processes were started (refer to pslist and pstree command screenshots).

To run the getsids we can use following command:

volatility --profile=WinXPSP3x86 -f cridex.vmem getsids

The screenshot of the command is following:

The format for the getsids plugin output is like following:

[Process] (PID) [SID] (User)

On the first line of the output we can see follwoing:

System (4): S-1-5-18 (Local System)

Here we explained in following bullets:

• Process : System
• PID : 4
• SID : S-1-5-18
• User : Local System

If the last number if SID is in a range of 500, that indicates the user with adminstratative privileges. For an example:

S-1-5-32-544 (Administrators)

Here we got something when we are scrolling down the getsids output, we can see that a user called Robert with an SID of S-1-5-21-789336058 (non-admin) has used started or accessed explorer.exe PID 1484.

Resgistry Analysis

Information about every users, settings, programs and the Windows operating system itself can be found within the registry. Even encrypted passwords can be found in the registry.

In the Windows registry analysis, we will be using the following two plugins.

1. hivescan
2. hivelist

1. Hivescan plugin on Volatility

This hivesan plugin display the physical locations of available registry hives.

To use this plugin we need to run following command:

volatility --profile=WinXPSP3x86 -f cridex.vmem hivescan

We can see the physical locations of available registry hives in the following screenshot:

2. Hivelist plugin on Volatility

Hivelist plugin is used for more details (and helpful) information on registry hives and locations with RAM. This plugin shows the details of Virtual and Physical address along with the easier readable plaintext names and locations.

We use following command to run hivelist plugin on Volatility

volatility --profile=WinXPSP3x86 -f cridex.vmem hivelist

The output shows in the following screenshot:

In the above screenshot we can see information about vitual and physical address.

Password Dumping using Volatility

We know that Windows password stored on the SAM (Security Accounts Manager) file on Windows. This SAM file stores hashd passwords for usernames in Windows system. This file can’t be accessed by any user when the Windows system is on.

When we have used the hivelist command (previous screenshot) we have seen the SAM file if we carefully checked the output.

We can see the SAM file during using hivelist plugin

Timeline Investigation using Volatility

We can check timeline of all the events that took place when the image was acquired by using timeliner plugin on Volatility.

Although we have an idea of what took place within this scenario, many other dumps may be quite large and far more detailed and complex. The timeliner plugin will groups details by time and includes process, PID, process offser, DDLs used, registry details and other useful information.

To run timeliner command, we type the following command:

volatility --profile=WinXPSP3x86 -f cridex.vmem timeliner

The output shows in the following screenshot:

This may produce long ouput and we need to scrool to see the full output.

Malware analysis

One of most important feature of Voatility is malfind plugin. This plugin is used to find, or at least direct us toward hints of malware that may have been injected into various processes.

The output of malfind plugin may be very lenghty so we should be run it in a separate terminal to avoid constant scrolling when reviewing the other plugin’s output.

The command used to run malfind pluin will be following:

volatility --profile=WinXPSP3x86 -f cridex.vmem malfind

We can see the output on the following screenshot:

We can see a very long output here. To be more specific we can use -p flag to analyse a specific PID. As we have discovered previously (pslist plugin), winlogon.exe is assigned to PID 608. To analyze this specific PID in malfind we use following command:

volatility --profile=WinXPSP3x86 -f cridex.vmem malfind -p 608

The output of the command shown in the following screenshot:

Final Thoughts

In this article, we looked at memory forensics and analysis using some of the many plugins available within the Volatility Framework on our Kali Linux system.

One of the first, and most important, steps in working with Volatility is choosing the profile that Volatility will use throughout the analysis. This profile tells Volatility Framework what type of operating system is being used. Once the profile was chosen, we were able to successfully perform process, network, registry, DLL, and even malware analysis using this versatile framework.

As we’ve seen, Volatility can perform several important functions in digital forensics and should be used together with other tools we’ve used previously to perform in-depth and detailed forensic analysis and investigations.

Be sure to download more publicly available memory images and samples to test our skills in this area. Experiment with as many plugins as we can and of course, be sure to document our findings and consider sharing them online.

This is how we can perform Digital forensics on RAM and the swap partition etc using our Kali Linux system with the help of Volatility Framework.

Love our articles? Make sure to follow us on Twitter and GitHub, we post article updates there. To join our KaliLinuxInfamily, join our Telegram Group & Whatsapp Channel. We are trying to build a community for Linux and Cybersecurity. For anything we always happy to help everyone on the comment section. As we know our comment section is always open to everyone. We read each and every comment and we always reply.