Password dumping in volatility.
In this lecture, you will learn about the password dumping and volatility framework.
So actually the passwords in Windows is listed in the security accounts Manager.
SRM file is also listed using the Hive list plugin.
In previous lecture, as you remember, we use the Hive list plugin to print these out and the path
to the same file is seen in this here, as you can see here.
System32 config file.
So in this.
Here in this address.
We have the stored passwords here.
So this file cannot be accessed by users within the windows while the while the system is on.
And it can be further used to acquire the hashed passwords in the same file to crack passwords using
the word list.
So along with the password cracking tools using the John the Ripper, as you saw as you know, John
the Ripper, you can use this for the password cracking tools using brute force or other methods and
in Linux.
So you're going to in next lectures.
We also we will also do the same file investigation and the password extraction from the memory file
or storage file in Windows.
And now I'm going to tell you more about the timeline of events and volatility.
And volatility can produce a list of timestamps events which is essential to an investigation.
So to produce this list, we will use the Timeliner plugin in volatility here.
So timeliner and.
At this time.
Linear plugin helps Investigator by providing a timeline of all the events that took place when the
image was acquired.
So although we have an idea of what took place within this scenario, many other times may be quite
large and far more detailed and complex.
So the timeliner plugin groups details by times and include processes, product IDs, process offset,
DLLs used registry details and other useful informations to run the Timeliner command.
You need to like as previously comments, you need to specify the profile and then the virtual memory
file and then the use the plugin plugin parameter.
Here.
In this case it's a timeliner because we're going to use the Timeliner plugin here.
Press enter and yeah.
It's now analyzing.
And we'll show what show us the details here.
Okay.
I will also paste this.
File and the attachment here.
Zoom.
Zoom out here as we previously did.
So now here we got zoom out like that.
And I will copy this output to the text file and share it with you.
Here.
And the past.
Paste Editor And this is the timelines of what happened on the system.
As you can see, there is the clocks here, date time, the process, the executable file process ID
offset, and all those information and the information about what users or what system programs did
at what time.
So it's actually quite useful and powerful information on doing malware analysis here.
So I'm going to paste this command on the paste, the text file on the attachment so you can analyze
further or you can just get this result by using this analysis techniques I use here.
So let's.
Okay.
Now, in next lecture, we're going to we're going to use the graphical user interface in volatility
and.
Uh, we will get more information about volatility in graphical user interface.
So I'm waiting your next lecture.