Mark930.k
Nightcrawler
Mark930.k
์ „์ฒด ๋ฐฉ๋ฌธ์ž
์˜ค๋Š˜
์–ด์ œ
  • ๐Ÿ“š WWW (102)
    • ๐Ÿ–ฅํ•˜๋“œ์›จ์–ด (1)
    • โšก๋„คํŠธ์›Œํฌ (38)
      • Amazon AWS (5)
      • OSI 7 Layer (1)
      • ๋„คํŠธ์›Œํฌ ๊ธฐ์ดˆ (2)
      • Linux (2)
    • ๐Ÿ’ป๋ชจ์˜ํ•ดํ‚น (9)
      • Android (1)
      • Microsoft (7)
      • Linux (0)
      • ์นจํ•ด๋Œ€์‘ (1)
    • ๐Ÿง๋ฆฌ๋ˆ…์Šค (0)
    • ๐Ÿ‹๏ธ‍โ™‚๏ธ์šด๋™ (7)
      • ํ—ฌ์Šค ๋ฃจํ‹ด (6)
    • ๐ŸŽ๏ธ์ž๋™์ฐจ (1)
      • BMW (1)
    • ๊ธฐํƒ€ (13)
      • NetScaler ์—…๋ฌด ํŽ˜์ด์ง€ (8)
    • ๐Ÿ“–๋…์„œ (1)
      • ๊ฒฝ์ œ (1)

๋ธ”๋กœ๊ทธ ๋ฉ”๋‰ด

    ๊ณต์ง€์‚ฌํ•ญ

    ์ธ๊ธฐ ๊ธ€

    ํƒœ๊ทธ

    • zeroday
    • ์ •๋ณด๋ณด์•ˆ
    • CVE-2022-30190
    • Python test
    • ์›น์œ„๋ณ€์กฐ
    • ์œ„๋ณ€์กฐ
    • ๋ณด์•ˆ
    • ๋„คํŠธ์›Œํฌ
    • Security
    • python
    • ํ•ดํ‚น

    ์ตœ๊ทผ ๋Œ“๊ธ€

    ์ตœ๊ทผ ๊ธ€

    ํ‹ฐ์Šคํ† ๋ฆฌ

    hELLO ยท Designed By ์ •์ƒ์šฐ.
    Mark930.k

    Nightcrawler

    ๋””์ง€ํ„ธ ํฌ๋ Œ์‹
    ๐Ÿ’ป๋ชจ์˜ํ•ดํ‚น/Microsoft

    ๋””์ง€ํ„ธ ํฌ๋ Œ์‹

    2022. 6. 27. 16:44

    ํฌ๋ Œ์‹ & ๋””์ง€ํ„ธ ํฌ๋ Œ์‹

    โ‘  ํฌ๋ Œ์‹(Forensics)

    • ๋ฒ•์˜ํ•™์ด๋ž€ ์˜๋ฏธ๋กœ ๋ฒ•์ •์—์„œ ์‚ฌ์šฉ๋˜๋Š” ์ฆ๊ฑฐ ์ˆ˜์ง‘ ๋ฐ ๋ถ„์„์„ ์˜๋ฏธํ•จ
    • ๋ฒ•๋ฅ ์ ์œผ๋กœ ์ค‘์š”ํ•œ ์‚ฌ์‹ค ๊ด€๊ณ„๋ฅผ ์—ฐ๊ตฌํ•˜๊ณ  ํ•ด์„ํ•˜๋ฉฐ ๊ฐ์ •ํ•˜๋Š” ํ•™๋ฌธ

    โ‘ก ๋””์ง€ํ„ธ ํฌ๋ Œ์‹(Digital Forensics)

    • ๋””์ง€ํ„ธ ๊ธฐ๊ธฐ๋ฅผ ๋งค๊ฐœ์ฒด๋กœ ํ•˜์—ฌ ๋ฐœ์ƒํ•œ ํŠน์ • ํ–‰์œ„์˜ ์‚ฌ์‹ค ๊ด€๊ณ„๋ฅผ ๋ฒ•์ •์—์„œ ๊ทœ๋ช…ํ•˜๊ณ  ์ฆ๋ช…ํ•˜๊ธฐ ์œ„ํ•œ ์ ˆ์ฐจ์™€ ๋ฐฉ๋ฒ•
    • ๋”ฐ๋ผ์„œ, ๋ฒ•์ •์—์„œ ๊ทœ๋ช…ํ•˜๊ธฐ ์œ„ํ•ด ๋””์ง€ํ„ธ ๋ฐ์ดํ„ฐ์˜ ์ฆ๊ฑฐ ๋Šฅ๋ ฅ ๊ณ ๋ ค
    • ์•„๋‚ ๋กœ๊ทธ ์ฆ๊ฑฐ์™€ ๋‹ฌ๋ฆฌ ๋””์ง€ํ„ธ ๋ฐ์ดํ„ฐ๋Š” ์‰ฝ๊ฒŒ ๋ณต์ œ ๊ฐ€๋Šฅํ•˜๊ธฐ์— ๊ฒ€์ฆ๋œ ์ ˆ์ฐจ์™€ ๋ฐฉ๋ฒ• ๋“ฑ์ด ์š”๊ตฌ๋จ
    • (์‰ฝ๊ฒŒ ์„ค๋ช…ํ•˜๋ฉด) ์šฉ์˜์ž๋ฅผ ํŠน์ •ํ•˜์—ฌ ์ฆ๊ฑฐ๋ฌผ๋กœ ์‚ฌ๋ฒ•๊ธฐ๊ด€์— ์ œ์ถœํ•˜๊ธฐ ์œ„ํ•ด ๋””์ง€ํ„ธ ํฌ๋ Œ์‹์„ ํ†ตํ•ด ๋ฐ์ดํ„ฐ ์ˆ˜์ง‘

    ๋”ฐ๋ผ์„œ, ํฌ๋ Œ์‹๊ณผ ๋””์ง€ํ„ธ ํฌ๋ Œ์‹์€ ์ฆ๊ฑฐ ์ˆ˜์ง‘ํ•˜๊ณ ์ž ํ•˜๋Š” ๋Œ€์ƒ์—์„œ ์ฐจ์ด๊ฐ€ ๋ฐœ์ƒํ•œ๋‹ค.(๋””์ง€ํ„ธ ํฌ๋ Œ์‹์€ ๋Œ€์ƒ์ด ๋ฐ์ดํ„ฐ)

     

    ๋กœ์นด๋ฅด๋“œ์˜ ๋ฒ•์น™(Locard's Principle)

    ์ ‘์ด‰ํ•˜๋Š” ๋‘ ๊ฐœ์ฒด๋Š” ์„œ๋กœ์˜ ํ”์ ์„ ์ฃผ๊ณ  ๋ฐ›๋Š”๋‹ค. ์ด๋Š” ๋””์ง€ํ„ธ ํฌ๋ Œ์‹์—๋„ ์ ์šฉ๋œ๋‹ค.

     


    ๋””์ง€ํ„ธ ํฌ๋ Œ์‹ ๊ณผ์ •

    (๋Œ€์ถฉ ํ๋ฆ„๋งŒ ํŒŒ์•…ํ•˜๋ฉด ๋จ)

    1) ์‚ฌ์ „์ค€๋น„

    • ์ฆ๊ฑฐ๋ฌผ ์ˆ˜์ง‘์„ ์œ„ํ•œ ์ €์žฅ๋งค์ฒด ์ค€๋น„ 
    • ๋””์ง€ํ„ธ ํฌ๋ Œ์‹ ๋„๊ตฌ : ๋””์ง€ํ„ธ ํฌ๋ Œ์‹ ์ „๋ฐ˜์ ์ธ ๊ณผ์ •์— ์‹ ๋ขฐ์ ์ธ ๊ฒฐ๊ณผ ์ค„ ์ˆ˜ ์žˆ๋Š” ๋„๊ตฌ ์ค€๋น„, ์˜ฌ๋ฐ”๋ฅด๊ฒŒ ๋™์ž‘ํ•˜์—ฌ ๋ฌด๊ฒฐ์„ฑ ๋ณด์žฅํ•˜๋Š”์ง€ ๊ฒ€์ฆ
    • ์ด๋ฏธ์ง• : ๋ฌผ๋ฆฌ์ ์ธ ์žฅ๋น„์— ์žˆ๋Š” ๋ชจ๋“  ๋ฌผ๋ฆฌ์  ๋ฐ์ดํ„ฐ๋ฅผ ํŒŒ์ผ ํ˜•ํƒœ๋กœ ๋ณ€ํ™˜ํ•˜๋Š” ์ž‘์—…, ๋ฐฉ์‹์€ 2๊ฐ€์ง€(S/W, H/W)
    • ์ €์žฅ๋งค์ฒด ์ด๋ฏธ์ง• - H/W
      • ํ•˜๋“œ๋””์Šคํฌ ๋… : ๋ฐ์ดํ„ฐ ๋ณต์ œํ•˜๋Š” ์žฅ๋น„
      • tableau td3 : ์ด๋ฏธ์ง• ์žฅ๋น„, ์žฅ์ ์€ ๋น ๋ฅด๊ณ  ์‹ธ๊ณ  ์‹ ๋ขฐ์„ฑ ์žˆ๋Š” ๊ธฐ๊ด€์—์„œ ๋งŒ๋“ค์–ด์ง, ๋‹จ์ ์€ ํ•˜๋‚˜์˜ ์†Œ์Šค๋งŒ ์—ฐ๊ฒฐ(ํ•˜๋‚˜์˜ ๋””์Šคํฌ๋งŒ ์ด๋ฏธ์ง•ํ•  ์ˆ˜ ์žˆ๋‹ค.)
      • falcon forensic imager : ์ตœ๋Œ€ 3๊ฐœ์˜ ์†Œ์Šค์— ๋Œ€ํ•ด์„œ ๋ณต์ œ๊ฐ€ ๊ฐ€๋Šฅ, td3๋ณด๋‹ค ๊ฐ€๋ณ๋‹ค.
      • solo-4 : ๋น„์‹ผ๋ฐ ๊ฐ€๋ฒผ์›€, ์ฃผ๋กœ ๊ฒฝ์ฐฐ๋“ค์ด ์‚ฌ์šฉ
    • ์ €์žฅ๋งค์ฒด ์ด๋ฏธ์ง• - S/W
      • FTK Imager
      • tableau Imager
      • Encase Imager

    2) ์ฆ๊ฑฐ์ˆ˜์ง‘

    โ‘  ์ดˆ๊ธฐ๋Œ€์‘ -> โ‘ก ํ™œ์„ฑ ๋ฐ์ดํ„ฐ ์ˆ˜์ง‘ -> โ‘ข ๋น„ํ™œ์„ฑ ๋ฐ์ดํ„ฐ ์ˆ˜์ง‘ -> โ‘ฃ ์ฆ๊ฑฐ ํš๋“ -> โ‘ค ๋ฌด๊ฒฐ์„ฑ ํ™•๋ณด -> โ‘ฅ ์ฆ๊ฑฐ๋ฌผ ์ธ์ •

     

    3) ์ฆ๊ฑฐ ํฌ์žฅ ๋ฐ ์ด์†ก

    • ์ถฉ๊ฒฉ/์ •์ „๊ธฐ ๋ฐฉ์ง€์šฉ ํŒฉ ๋ฐ ํ•˜๋“œ์ผ€์ด์Šค ๋“ฑ์„ ์ด์šฉํ•˜์—ฌ ํฌ์žฅํ•˜๋ฉฐ ์ด์†ก๊ณผ์ •์—์„œ ์ฆ๊ฑฐ๋ฌผ ํ›ผ์† ๋ฐฉ์ง€
    • ์ ˆ์ฐจ์—ฐ์†์„ฑ์˜ ๋ฒ•์น™(CoC : Chain of Cutody) : ์ฆ๊ฑฐ์˜ ๋ฌด๊ฒฐ์„ฑ ์ฆ๋ช…์„ ์œ„ํ•ด ํ˜„์žฅ์—์„œ ๋ฒ•์ •์— ์ œ์ถœ๋  ๋•Œ๊นŒ์ง€ ๊ฑฐ์ณ๊ฐ„ ๊ฒฝ๋กœ, ๋‹ด๋‹น์ž, ์žฅ์†Œ, ์‹œ๊ฐ„ ๋“ฑ๊ณผ ๊ฐ™์€ ๋‹ด๋‹น์ž ๋ชฉ๋ก์„ ์œ ์ง€

    4) ์กฐ์‚ฌ ๋ถ„์„

    • ํƒ€์ž„๋ผ์ธ ๋ถ„์„, ๋ฐ์ดํ„ฐ ๋ธŒ๋ผ์šฐ์ง•, ๋ฐ์ดํ„ฐ ๋ณต๊ตฌ, ์ €์žฅ๋งค์ฒด ์ˆ˜๋ฆฌ/๋ณต์›, ํ•ด์‹œ/ํŒŒ์ผ ๊ฒ€์ƒ‰, ์•”๋ณตํ˜ธํ™”, ์•„ํ‹ฐํŒฉํŠธ ๋ถ„์„ ๋“ฑ๋“ฑ
    • ์•„ํ‹ฐํŒฉํŠธ : ๊ทธ ์‹œ๋Œ€๋‚˜ ์ƒํ™ฉ์„ ์ž˜ ํ‘œํ˜€ํ•ด์ฃผ๋Š” ํ”์ ์„ ์˜๋ฏธํ•จ, ์—ฌ๊ธฐ์„œ๋Š” ์šด์˜์ฒด์ œ๋‚˜ ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜์„ ์‚ฌ์šฉํ•˜๋ฉด์„œ ์ž๋™์œผ๋กœ ์ƒ์„ฑํ•œ ๋ฐ์ดํ„ฐ๋“ค์˜ ํ”์ ์„ ์˜๋ฏธ

    5) ์ •๋ฐ€ ๊ฒ€ํ† 

    • ๋ถ„์„ ๊ฒฐ๊ณผ๋Š” ๋ฒ•์ •์—์„œ ์ฆ๊ฑฐ๋กœ ์‚ฌ์šฉ๋˜๊ธฐ ๋•Œ๋ฌธ์— ๋ถ„์„ ๋‚ด์šฉ์ด ์‚ฌ๊ฑด๊ณผ ๋…ผ๋ฆฌ์ ์œผ๋กœ ์ž˜ ์—ฐ๊ฒฐ๋˜์—ˆ๋Š”์ง€ ํ™•์ธ
    • ๋™์ผํ•œ ๋ฐ์ดํ„ฐ๋ฅผ ๋ดค์„ ๋•Œ ํŽธํŒŒ์ ์œผ๋กœ ๋ถ„์„ํ•˜์ง€ ์•Š์•˜๋Š”์ง€๊ฐ€ ์ค‘์š”

    6) ๋ณด๊ณ ์„œ ์ž‘์„ฑ

    • ์ฆ๊ฑฐ๋ฌผ ํš๋“, ๋ณด๊ด€, ์ด์†ก, ๋ถ„์„ ๋“ฑ ๋ชจ๋“  ๊ณผ์ •์„ ์œกํ•˜์›์น™์— ๋”ฐ๋ผ ๋ช…๋ฐฑํ•˜๊ณ  ๊ฐ๊ด€์„ฑ์žˆ๊ฒŒ ๊ธฐ์ˆ 
    • ๋ณด๊ณ ์„œ์˜ ๋Œ€์ƒ์ด ๋˜๋Š” ๋ฒ•๊ด€, ๋ฐฐ์‹ฌ์›, ๋ณ€ํ˜ธ์‚ฌ ๋“ฑ์€ ๋น„์ „๋ฌธ๊ฐ€์ด๋ฏ€๋กœ ์•Œ๊ธฐ ์‰ฌ์šด ํ˜•ํƒœ๋กœ ์ž‘์„ฑ
    • ๋”ฐ๋ผ์„œ, ๋ณด๊ณ ์„œ๋ฅผ ์ž‘์„ฑํ•  ๋•Œ ์˜๊ฒฌ์€ ๋ณ€ํ˜ธ์‚ฌ๋‚˜ ํŒ์‚ฌ, ๊ฒ€์‚ฌ๊ฐ€ ๋‚ด๊ธฐ ๋•Œ๋ฌธ์— ์ ˆ๋Œ€ ๋ถ„์„๊ฐ€์˜ ์˜๊ฒฌ์ด ํฌํ•จ๋˜๋ฉด ์•ˆ๋จ

    ๋””์Šคํฌ ์ด๋ฏธ์ง€ ํŒŒ์ผ ์ข…๋ฅ˜

    1) E01

    • ํฌ๋ Œ์‹์—์„œ ๊ฐ€์žฅ ๋ฒ”์šฉ์ ์œผ๋กœ ์“ฐ์ด๋Š” ํฌ๋งท, E01์€ ์••์ถ•์„ ์ง€์›ํ•˜๊ธฐ ๋•Œ๋ฌธ์— ํŒŒ์ผํฌ๊ธฐ๋ฅผ ์ค„์ผ ์ˆ˜ ์žˆ๋‹ค๋Š” ์žฅ์ ์ด ์žˆ์Œ
    • ์ฆ๊ฑฐ ํŒŒ์ผ์˜ ๋ฌด๊ฒฐ์„ฑ์„ ๋ณด์žฅํ•˜๊ธฐ ์œ„ํ•ด MD5, SHA1 ํ•ด์‹œ๋ฅผ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ๊ณ  ์ฆ๊ฑฐ ํŒŒ์ผ ์•”ํ˜ธํ™”๋ฅผ ์œ„ํ•ด AES256์‚ฌ์šฉ
    • ํ™•์žฅ์ž๊ฐ€ E01์ด ์•„๋‹ˆ๋ผ, E02, E03๋กœ ๋Š˜์–ด๋‚˜๋ฉด์„œ ์ €์žฅ๋˜๋Š” ํฌ๋งท

    2) RAW(DD)

    • ๊ธฐ๋ณธ์ ์œผ๋กœ ๋ฐ์ดํ„ฐ๋ฅผ ์ถ”๊ฐ€ ๋˜๋Š” ์‚ญ์ œํ•˜์ง€ ์•Š๊ณ  ๋””์Šคํฌ ๋˜๋Š” ๋ณผ๋ฅจ์˜ RAW ๋ฐ์ดํ„ฐ๋ฅผ ๋น„ํŠธ ๋‹จ์œ„ ๋ณต์‚ฌ, ํฌ๋ Œ์‹ ๋„๊ตฌ๋ฅผ ์‚ฌ์šฉํ•˜์ง€ ์•Š์„ ๋•Œ ์‚ฌ์šฉ๋˜๋Š” ํŒŒ์ผ์ด๋ฉฐ ์›๋ณธ ๋ฐ์ดํ„ฐ๋ฅผ ํŒŒ์ผ ํ˜•ํƒœ๋กœ ๋ณ€ํ™˜๋งŒ ํ•ด์คŒ, ์••์ถ• x

    +) E01์€ Encaseํฌ๋งท์„ ์‚ฌ์šฉํ•˜์—ฌ ํšจ๊ณผ์ ์œผ๋กœ ์••์ถ•ํ•œ ์ด๋ฏธ์ง€ ์ƒ์„ฑ, RAW(DD)๋Š” ํŒŒ์ผ ์‹œ์Šคํ…œ์„ ํ†ต์งธ๋กœ ๋ณต์‚ฌํ•ด์„œ ์ด๋ฏธ์ง€ ์ƒ์„ฑ

    +) ์ •์ƒ์ ์ธ ํŒŒ์ผ ์‹œ์Šคํ…œ์ด๋ฉด E01์„ ํ†ตํ•ด ํ•„์š”ํ•œ ํŒŒ์ผ๋งŒ ๋ฝ‘์•„๋‚ด๊ณ , ํŒŒ์ผ ์‹œ์Šคํ…œ์ด ์กฐ์ž‘๋˜์–ด ์žˆ๋‹ค๋ฉด RAW(DD)๋ฅผ ํ†ตํ•ด ๋ถ„์„์„ ์ง„ํ–‰ํ•จ

    +) E01์€ ๋ฆฌ๋ˆ…์Šค ์ง€์›์•ˆํ•˜์ง€๋งŒ RAW(DD)๋Š” ๋ฆฌ๋ˆ…์Šค ์ง€์›ํ•จ

    +) ์šด์˜์ฒด์ œ๋ฅผ ๋ถ„์„ํ•  ๋•Œ๋Š” Logical Drive๋ฅผ ์‚ฌ์šฉํ•จ(Physical Drive๋Š” ๋””์Šคํฌ์˜ 0๋ฒˆ์งธ๋ถ€ํ„ฐ ๋๊นŒ์ง€๋ฅผ ๋งํ•˜๋Š” ๊ฑฐ๊ณ  Logical Drive๋Š” C๋‚˜ D๋“œ๋ผ์ด๋ธŒ ๊ฐ™์€ ๊ฑฐ๋ฅผ ๋งํ•จ)

    +) ์†Œํ”„ํŠธ์›จ์–ด ์ด๋ฏธ์ง•์„ ํ•  ๋•Œ ์šด์˜์ฒด์ œ๊ฐ€ ์„ค์น˜๋œ ๋“œ๋ผ์ด๋ธŒ๋ฅผ ๋จผ์ € ํ™•์ธํ•ด์•ผ ํ•จ ๊ทธ๋ž˜์„œ ํ™˜๊ฒฝ๋ณ€์ˆ˜๋ฅผ ๋ณด๋ฉด ์•Œ ์ˆ˜ ์žˆ์Œ(cmd.exe -> 'SET'๋ช…๋ น์–ด ์‹คํ–‰ํ•˜๋ฉด ํ™˜๊ฒฝ๋ณ€์ˆ˜ ํ™•์ธํ•  ์ˆ˜ ์žˆ์Œ -> systemroot = "C:\\")

     

     

    ๋ผ์ด๋ธŒ ํฌ๋ Œ์‹

    ์‹œ์Šคํ…œ์ด ์ผœ์ ธ์žˆ๋Š” ๋™์•ˆ ์–ป์„ ์ˆ˜ ์žˆ๋Š” ๋ชจ๋“  ๋ฐ์ดํ„ฐ๋ฅผ ํš๋“ํ•˜๋Š” ๊ฒƒ์„ ์˜๋ฏธํ•จ

     

    1) ๋ผ์ด๋ธŒ ํฌ๋ Œ์‹ ํšจ๊ณผ

    • ํ˜„์žฌ ์ง„ํ–‰๋˜๊ณ  ์žˆ๋Š” ์‚ฌ๊ฑด ๋ฐ ์‚ฌ๊ณ ์— ๋Œ€ํ•ด ๋งŽ์€ ๋ฐ์ดํ„ฐ ํš๋“ ๋ฐ ํ™•์ธ ๊ฐ€๋Šฅ

    2) ๋ผ์ด๋ธŒ ํฌ๋ Œ์‹ ๊ณ ๋ ค์‚ฌํ•ญ

    • ์•…์„ฑ์ฝ”๋“œ ๋ฐ ํ•ด์ปค๊ฐ€ ํ˜„์žฌ ๋™์ž‘ํ•˜๊ณ  ์žˆ๋Š” ๋ฐ์ดํ„ฐ๋ฅผ ๋ณ€์กฐํ•œ ๊ฒฝ์šฐ ์‹ ๋ขฐ์„ฑ ์•ผ๊ธฐ
    • ๋งŒ์ผ ํฌ๋ Œ์‹ํ•  ๋Œ€์ƒ์ด ํ•ด์ปค์— ์˜ํ•ด ๋ชจ๋‹ˆํ„ฐ๋ง ๋‹นํ•˜๊ฑฐ๋‚˜ ๊ฐ์—ผ๋˜์–ด ์žˆ์œผ๋ฉด ๋ฐ์ดํ„ฐ๊ฐ€ ๋ณ€์กฐ๋‹นํ•  ๊ฒฝ๊ตฌ ์กด์žฌ
    • ๋Œ€๋ถ€๋ถ„ ๊ธฐ์—…๋“ค์€ ๋ˆ์„ ์•„๋ผ๊ธฐ ์œ„ํ•ด ํ•ดํ‚น์„ ๋‹นํ–ˆ์„ ๋•Œ ๋จผ์ € ๋ถ„์„์„ ํ•˜๊ณ  ๋‚˜์„œ ์˜๋ขฐ๋ฅผ ํ•˜๊ธฐ ๋•Œ๋ฌธ์— ์ด๋ฏธ ํ™•์ธํ•  ๋•Œ๋Š” ๋ฎ์–ด์”Œ์›Œ์ ธ์žˆ๋Š” ๊ฒฝ์šฐ๊ฐ€ ์žˆ์–ด ๋ผ์ด๋ธŒํฌ๋ Œ์‹์„ ํ•  ๊ฒฝ์šฐ๊ฐ€ ๊ฑฐ์˜ ์—†์Œ

    ํ™œ์„ฑ ๋ฐ์ดํ„ฐ ์ข…๋ฅ˜

    - ์‹คํ–‰ ์ค‘์ธ ํ”„๋กœ์„ธ์Šค

    - ์—ฐ๊ฒฐ ์ค‘์ธ ๋„คํŠธ์›Œํฌ

    - ํ˜„์žฌ ๋กœ๊ทธ์ธ ์ค‘์ธ ์‚ฌ์šฉ์ž

    - ํ˜„์žฌ ์‹œ์Šคํ…œ ๋ฆฌ์†Œ์Šค ์ƒํ™ฉ

    - ํ˜„์žฌ ์ „์†ก ์ค‘์ธ ํŒจํ‚ท

    - ํด๋ฆฝ๋ณด๋“œ์— ์ €์žฅ๋œ ๋ฐ์ดํ„ฐ

    - ๋“ฑ๋“ฑ

    + ๋ฉ”๋ชจ๋ฆฌ

     

    1) ํ™œ์„ฑ ๋ฐ์ดํ„ฐ ์ˆ˜์ง‘ ๊ณ ๋ ค์‚ฌํ•ญ

    ์•…์„ฑ์ฝ”๋“œ๊ฐ€ ์‹คํ–‰๋˜๋ฉด ํ”„๋กœ์„ธ์Šค ํ˜•ํƒœ๋กœ ์กด์žฌํ•˜๊ธฐ ๋•Œ๋ฌธ์— ์—†์–ด์ง€๊ฑฐ๋‚˜ ๋ฎ์–ด์”Œ์–ด์งˆ ์ˆ˜ ์žˆ์œผ๋ฏ€๋กœ ๋ถ„์„๋„๊ตฌ๋ฅผ ์‹คํ–‰์‹œํ‚ค๋ฉด ํ”„๋กœ์„ธ์Šค ํ˜•ํƒœ๋กœ ์‹คํ–‰๋˜๋ฏ€๋กœ ๋ฎ์–ด์”Œ์–ด์ง€๋Š”์ง€ ์ฃผ์˜

     

    +) ์ˆ˜์ง‘ ์ˆœ์„œ์—๋Š” ํœ˜๋ฐœ์„ฑ๋งŒ ๊ณ ๋ คํ•˜๋ฉด ์•ˆ๋˜๊ณ  ์ค‘์š”๋„๋„ ๊ณ ๋ คํ•ด์•ผ ํ•˜๋ฏ€๋กœ ์กฐ๊ธˆ์”ฉ ์ˆ˜์ง‘ ์ˆœ์„œ๊ฐ€ ์ƒ์ดํ•˜๋‹ค.

    +) ๊ทธ๋ž˜์„œ ์ œ์ผ ์ค‘์š”ํ•œ ์ •๋ณด๋ฅผ ๋งŽ์ด ๋‹ด๊ณ  ์žˆ๋Š” ๋ฉ”๋ชจ๋ฆฌ๋ฅผ ๋จผ์ € ์ˆ˜์ง‘

    +) pcap ๋“œ๋ผ์ด๋ฒ„๊ฐ™์ด ๋“œ๋ผ์ด๋ฒ„๋ฅผ ์„ค์น˜ํ•˜๋‹ค๊ฐ€ ์ถฉ๋Œ๋‚  ๊ฒฝ์šฐ๊ฐ€ ์žˆ์–ด์„œ ํŒจํ‚ท ์ˆ˜์ง‘์€ ์•ˆํ•˜๋Š” ๊ฒฝ์šฐ๊ฐ€ ๋งŽ์œผ๋ฏ€๋กœ ๋ฐฉํ™”๋ฒฝ ๊ฐ™์€๋ฐ์—์„œ ์ˆ˜์ง‘

     

    +) FPLive_win_v1.1๋„๊ตฌ ์‚ฌ์šฉํ•ด์„œ ํ™œ์„ฑ ๋ฐ์ดํ„ฐ ์ˆ˜์ง‘

     

    Resources | FORENSIC-PROOF

     

    forensic-proof.com

     

     

    ๋น„ํ™œ์„ฑ ๋ฐ์ดํ„ฐ

    • ์‹œ์Šคํ…œ์ด ๊บผ์ ธ ์žˆ์–ด๋„ ์ˆ˜์ง‘ํ•  ์ˆ˜ ์žˆ๋Š” ๋ฐ์ดํ„ฐ๋กœ ํ•˜๋“œ์— ์ €์žฅ๋œ ํ˜•ํƒœ
    • ํ™œ์„ฑ ๋ฐ์ดํ„ฐ๋Š” ๋ผ์ด๋ธŒ ํฌ๋ Œ์‹์—์„œ๋งŒ ํš๋“ ๊ฐ€๋Šฅ, ๋น„ํ™œ์„ฑ ๋ฐ์ดํ„ฐ๋Š” ๋ผ์ด๋ธŒ ํฌ๋ Œ์‹/๋””์Šคํฌ ํฌ๋ Œ์‹์—์„œ ํš๋“ ๊ฐ€๋Šฅ

     

    1) ๋น„ํ™œ์„ฑ ๋ฐ์ดํ„ฐ ์ˆ˜์ง‘ ๊ณ ๋ ค์‚ฌํ•ญ

    • ๋ ˆ์ง€์ŠคํŠธ๋ฆฌ ํŒŒ์ผ์€ ํฌ๋ Œ์‹ ๋ถ„์„ํ•  ๋•Œ ๋ฌด์กฐ๊ฑด ์ˆ˜์ง‘ํ•ด์•ผ ํ•˜๋Š” ํŒŒ์ผ์ด๋‹ค. ํ•˜์ง€๋งŒ ๋ผ์ด๋ธŒ ์ƒํƒœ์—์„œ ๋ ˆ์ง€์ŠคํŠธ๋ฆฌ๋Š” ์šด์˜์ฒด์ œ๊ฐ€ ์ ์œ ํ•˜๊ณ  ์žˆ๋Š” ํŒŒ์ผ์ด๋ผ ๋ณต์‚ฌ๋ฅผ ํ•˜์ง€ ๋ชปํ•˜๊ฒŒ ๋œ๋‹ค. ๋”ฐ๋ผ์„œ ์šด์˜์ฒด์ œ๋ณด๋‹ค ๋‚ฎ์€ ๋ ˆ๋ฒจ์€ ํŒŒ์ผ ์‹œ์Šคํ…œ(ํŒŒ์ผ ์‹œ์Šคํ…œ์ด ์žˆ์–ด์•ผ ์šด์˜์ฒด์ œ๊ฐ€ ์˜ฌ๋ผ๊ฐˆ ์ˆ˜ ์žˆ์Œ)์ด๋ฏ€๋กœ ํด๋ผ์ด์–ธํŠธ๊ฐ€ ๋ฌผ๋ฆฌ๋ ˆ๋ฒจ ์ฒซ ๋ฒˆ์งธ์— ์ง์ ‘ ์ ‘๊ทผํ•  ์ˆ˜ ์žˆ๋‹ค. ์ด์ œ ๋ ˆ์ง€์ŠคํŠธ๋ฆฌ์˜ ์œ„์น˜๋งŒ ์•Œ๋ฉด ์ง์ ‘ ์ฐพ์•„๊ฐ€์„œ ๋ณต์‚ฌํ•˜๋ฉด ๊ฐ€๋Šฅํ•˜๋‹ค.(FTK Imager์—์„œ๋„ ํŒŒ์ผ์‹œ์Šคํ…œ ์ ‘๊ทผ ๊ฐ€๋Šฅ)

    +) FTK Imager๋Š” ์ด๋ฏธ์ง•ํ•˜๋Š” ๋ชฉ์ ์˜ ํˆด, ๊ฐ’์ด ์‹ธ์„œ ๋งŽ์ด ์‚ฌ์šฉ

    +) WinHex๋Š” ๋””์Šคํฌ ๋ถ„์„ ํˆด -> ๋””์Šคํฌ ๋ถ„์„์— ์žˆ์–ด์„œ ์ตœ์ ํ™”๋œ ๋„๊ตฌ

     

    2) ๋น„ํ™œ์„ฑ ๋ฐ์ดํ„ฐ ์ˆ˜์ง‘๋ชฉ๋ก

    - $MFT (ํŒŒ์ผ์‹œ์Šคํ…œ ๋ฉ”ํƒ€๋ฐ์ดํ„ฐ)
    - $LogFile, $UsnJrnl:$J (ํŒŒ์ผ ์‹œ์Šคํ…œ ๋กœ๊ทธ)
    - ์›น ์•„ํ‹ฐํŒฉํŠธ (์›น ๋ธŒ๋ผ์šฐ์ € ์บ์‹œ)
    - ํ”„๋ฆฌํŒจ์น˜
    - ๋ฐ”๋กœ๊ฐ€๊ธฐ ํŒŒ์ผ (LNK)
    - ๋ ˆ์ง€์ŠคํŠธ๋ฆฌ ํ•˜์ด๋ธŒ ํŒŒ์ผ
    - ์ด๋ฒคํŠธ ๋กœ๊ทธ

     

     

    3) WinHexํˆด์„ ์‚ฌ์šฉํ•ด์„œ ํŒŒ์ผ ์ถ”์ถœ ์‹œ

     

    โ‘  ๊ฒฝ๋กœ๋ฅผ ์•Œ ๋•Œ - ๋ ˆ์ง€์ŠคํŠธ๋ฆฌ

    • ๋ณดํ†ต ์•„๋ž˜์— ์žˆ๋Š” ํŒŒ์ผ 6๊ฐœ๋ฅผ ์ถ”์ถœํ•จ(์šด์˜์ฒด์ œ ํ•˜์ด๋ธŒ 4๊ฐœ + ์‚ฌ์šฉ์ž ํ•˜์ด๋ธŒ 2๊ฐœ)
    • ๋ผ์ด๋ธŒ ์ƒํƒœ์—์„œ ๋ ˆ์ง€์ŠคํŠธ๋ฆฌ ์ •๋ณด ์ถ”์ถœ

    [ ํ™•์žฅ์ž๊ฐ€ ์—†๋Š” ํŒŒ์ผ 4๊ฐœ, ์šด์˜์ฒด์ œ์—์„œ ์‚ฌ์šฉํ•˜๋Š” ํ•˜์ด๋ธŒ ํŒŒ์ผ ์ถ”์ถœ ]

    - \Windows\System32\config

       -> SAM, SECURITY, SOFTWARE, SYSTEM

     

    [ ์‚ฌ์šฉ์ž๋“ค์˜ ํ–‰์œ„์— ๋Œ€ํ•œ ๊ธฐ๋ก ํŒŒ์ผ 2๊ฐœ ์ถ”์ถœ, ์‚ฌ์šฉ์ž ํ•˜์ด๋ธŒ ํŒŒ์ผ ์ถ”์ถœ ]

    - \Users\(์‚ฌ์šฉ์ž ์ด๋ฆ„)\NTUSER.DAT

    - \Users\(์‚ฌ์šฉ์ž ์ด๋ฆ„)\AppData\Local\Microsoft\Windows\UsrClass.dat

     

     

    โ‘ก ํŒŒ์ผ ๋ช…์„ ์•Œ ๋•Œ - ์›น ๋ธŒ๋ผ์šฐ์ €

    - WebCacheV01.dat (์ด๋ฆ„์€ ์•„๋Š”๋ฐ ๊ฒฝ๋กœ๊ฐ€ ๋”๋Ÿฌ์›€)

      -> C๋“œ๋ผ์ด๋ธŒ ์ตœ์ƒ์œ„๋กœ ์˜ฌ๋ผ๊ฐ€์„œ Explorer recursively๋ฅผ ๋ˆ„๋ฅด๊ณ  Name์ •๋ ฌํ•œ ๋‹ค์Œ ๊ฑ webcah~~์ €๊ฑฐ ์น˜๋ฉด ๋ฐ”๋กœ ๋‚˜์˜ด

      -> ์ƒ๋‹จ์— "\ and subdirectories" ๋ˆ„๋ฅด๋ฉด ์ฐฝ ํ•˜๋‚˜ ๋œจ๋Š”๋ฐ ๊ทธ๊ฑฐ ์˜ค๋ฅธ์ชฝ์— pull path 255๋‚˜ 500์ด๋ ‡๊ฒŒ ํฌ๊ฒŒ ์žก์•„์ฃผ๊ณ  ok๋ˆ„๋ฅด๋ฉด path๋‚˜์˜ด

    -> ํ™•์ธํ•ด๋ณด๋ฉด

     

     

    โ‘ข ํ™•์žฅ์ž๋ฅผ ์•Œ ๋•Œ - ๋งํฌ ํŒŒ์ผ

    -> Ext๋ˆŒ๋Ÿฌ์„œ ํ™•์žฅ์ž๋ณ„๋กœ ์ •๋ ฌํ•˜๊ณ  "LNK"์น˜๋ฉด ๋‚˜์˜ด

    -> ๊ทธ๋ฆฌ๊ณ  ๋˜ ์†Œ๋ฌธ์ž๊ฐ€ ์žˆ์œผ๋ฏ€๋กœ lnkํ•œ ๋ฒˆ ๋” ์น˜๋ฉด๋จ

     

     

    +) ์ถ”๊ฐ€๋กœ C๋ฐ‘์— Extend์—๋Š”Extend์—๋Š”๋กœ ์‹œ์ž‘ํ•˜๋Š” ํŒŒ์ผ๋“ค์ด ์กด์žฌํ•˜๋Š” ๋ชจ๋‘ 0byte์ธ ๊ฒƒ์„ ํ™•์ธํ•  ์ˆ˜ ์žˆ์Œ

    +) ๊ทผ๋ฐ, ์•„์ด์ฝ˜์„ ์ž์„ธํžˆ ๋ณด๋ฉด "..."์œผ๋กœ ๋˜์–ด์žˆ๋Š” ๊ฒƒ์„ ๋ณผ ์ˆ˜ ์žˆ๋Š”๋ฐ ์š”๋Ÿฐ๊ฑฐ๋Š” ๋‚ด๋ถ€๋กœ ํ•œ ๋ฒˆ๋” ๋“ค์–ด๊ฐˆ ์ˆ˜ ์žˆ์Œ์„ ์˜๋ฏธ

    +) ads -> ์•„์ด์ฝ˜์— ...์œผ๋กœ ๋˜์–ด์žˆ๋Š” ํŒŒ์ผ ์žˆ์Œ

    +) \Extend\Usnjrnl ๋“ค์–ด๊ฐ€๋ฉด ads ์†์„ฑ์ด ์ ์šฉ๋œ ํŒŒ์ผ์„ ๋ณต๊ตฌํ•  ๋•Œ $J๋ฅผ ๋ณด๋ฉด ์šฉ๋Ÿ‰์ด ใ…ˆ.. ๋งค์šฐ ํผ -> ๊ทผ๋ฐ ๋ง‰์ƒ ํ•ต์‚ฌ ๊ฐ’ ๋ณด๋ฉด ๋งˆ์ง€๋ง‰ ๋ช‡ ๋ฉ”๊ฐ€ ์งœ๋ฆฌ ๋นผ๊ณ  ๋‚˜๋จธ์ง€๋Š” ๋‹ค 0์œผ๋กœ ์ฑ„์›Œ์ ธ ์žˆ์œผ๋ฏ€๋กœ ๋งˆ์ง€๋ง‰ ๋ถ€๋ถ„๋งŒ ๋ณต๊ตฌํ•˜๋ฉด ๋จ

    ์ด๋Ÿฐ ํŒŒ์ผ์„ ๋ณต๊ตฌํ•˜๊ฑฐ๋‚˜ ์ˆ˜์ง‘ํ•  ๋•Œ์—๋Š” WinHex์™€ ๊ฐ™์€ ๋””์Šคํฌ ๋ถ„์„ ๋„๊ตฌ๋ฅผ ํ†ตํ•ด ์•ˆ์œผ๋กœ ์ง์ ‘ ๋“ค์–ด๊ฐ€์„œ ๋ณต๊ตฌ๋ฅผ ํ•ด์•ผํ•จ ์ด๋Ÿฐ ๊ฒƒ์„ "ํŒŒ์ผ ์‹œ์Šคํ…œ ์•„ํ‹ฐํŒฉํŠธ"๋ผ๊ณ  ํ•จ

     

    +) ADS๋ž€ Alternate Data Stream์˜ ์•ฝ์ž๋กœ NTFS ๊ตฌ์กฐ์—์„œ๋Š” ๋‹ค์ค‘์˜ ๋ฐ์ดํ„ฐ ์ŠคํŠธ๋ฆผ์„ ์ง€์›ํ•˜๋Š”๋ฐ, ์ด๋Ÿฌํ•œ ๋ฐ์ดํ„ฐ ์ŠคํŠธ๋ฆผ์ด ์—ฌ๋Ÿฌ ๊ฐœ๋ผ๋Š” ๊ฒƒ์€ ํŒŒ์ผ์ด ํ•˜๋‚˜ ์ด์ƒ์˜ ๋ฐ์ดํ„ฐ๋ฅผ ๋‹ด์„ ์ˆ˜ ์žˆ๋‹ค๋Š” ๊ฒƒ์ด๋‹ค. ์ด๋ฅผ ์ด์šฉํ•˜์—ฌ ์›ํ•˜๋Š” ๋ฐ์ดํ„ฐ๋ฅผ ๋‹ค๋ฅธ ํŒŒ์ผ ์•ˆ์— ์ˆจ๊ธธ ์ˆ˜๊ฐ€ ์žˆ์Œ

     

    ๋ฉ”๋ชจ๋ฆฌ ์ˆ˜์ง‘/๋ถ„์„

    ์ฃผ ๊ธฐ์–ต์žฅ์น˜

    • ์‚ฌ์šฉ์ž๊ฐ€ ์›ํ•˜๋Š” ์ž‘์—…์„ ์ฒ˜๋ฆฌํ•˜๊ธฐ ์œ„ํ•œ ๋ฐ์ดํ„ฐ ๋ฐ ์ฒ˜๋ฆฌ๊ฒฐ๊ณผ ๋“ฑ์„ ๊ธฐ์–ตํ•˜๋ฉฐ ํœ˜๋ฐœ์„ฑ์ด๋ผ๋Š” ํŠน์ง•์„ ๊ฐ€์ง
    • ๋ฉ”๋ชจ๋ฆฌ ๊ฐ€์šฉ๊ณต๊ฐ„์ด ๋ถ€์กฑํ•  ๋•Œ ํŽ˜์ด์ง€ ํŒŒ์ผ์„ ์‚ฌ์šฉํ•˜์—ฌ ๋ณด์กฐ ๊ธฐ์–ต์žฅ์น˜๋ฅผ ๋นŒ๋ ค ์‚ฌ์šฉ -> ๊ฐ€์ƒ ๋ฉ”๋ชจ๋ฆฌ
    • ๋Œ€๋ถ€๋ถ„์˜ ์ž‘์—…์ด ๋ฉ”๋ชจ๋ฆฌ๋ฅผ ๊ฑฐ์น˜๊ธฐ ๋•Œ๋ฌธ์— ๋ฉ”๋ชจ๋ฆฌ๋ฅผ ํš๋“ํ•˜๋ฉด ๊ฑฐ์˜ ๋ชจ๋“  ๋ฐ์ดํ„ฐ ํ™•๋ณด ๊ฐ€๋Šฅ

    ๋ฉ”๋ชจ๋ฆฌ ํฌ๋ Œ์‹ ํ™œ์„ฑํ™”๋œ ์ด์œ )

    โ‘  ์•…์„ฑ์ฝ”๋“œ PE ํ—ค๋”๋ฅผ ๊ตฌํ•˜๊ธฐ ์œ„ํ•ด ๋ฉ”๋ชจ๋ฆฌ ํ™•๋ณด ์ค‘์š”

    โ‘ก ์•…์„ฑ์ฝ”๋“œ ๊ฐ์—ผ ๋ฐ ์‹คํ–‰ ์‹œ ์ž˜ ๋‚˜ํƒ€๋‚ด๋Š” ๊ฒƒ์€ ๋ฉ”๋ชจ๋ฆฌ์ด๋ฏ€๋กœ ๋ฉ”๋ชจ๋ฆฌ ํ™•๋ณด ์ค‘์š”

    โ‘ข ์•”ํ˜ธํ™” ์ „์†ก ๋ฐ ์•”ํ˜ธํ™”๋œ ๋ฐ์ดํ„ฐ๋Š” ๋ฉ”๋ชจ๋ฆฌ๋ฅผ ์ œ์™ธํ•˜๋ฉด ํ™•๋ณดํ•˜๊ธฐ ์–ด๋ ค์›€

    โ‘ฃ ์•ˆํ‹ฐ ํฌ๋ Œ์‹ ๊ธฐ์ˆ ์˜ ๋ฐœ์ „์œผ๋กœ ๋ณด์กฐ ๊ธฐ์–ต์žฅ์น˜ ํ”์  ์™ธ ์ถ”๊ฐ€ ๋ถ„์„ ์š”์†Œ ํ•„์š”์„ฑ ์ฆ๊ฐ€

     

    +) ๊ฒฐ๋ก ์€ ๋ฉ”๋ชจ๋ฆฌ ํ™•๋ณด๋ฅผ ํ•˜๋ฉด ํ•ด๋‹น ์‹œ์ ์„ ์ž˜ ๋‚˜ํƒ€๋‚ด๋ฏ€๋กœ ๋ฉ”๋ชจ๋ฆฌ ํ™•๋ณด ์ค‘์š”

    +) ์‚ฌ๊ณ ๋ฐœ์ƒ ์ดํ›„์— ๋ถ„์„ํ•˜๋ฏ€๋กœ ํ•ด๋‹น ๋ฉ”๋ชจ๋ฆฌ๊ฐ€ ๋ฎ์–ด์”Œ์–ด์ง€๋Š” ๊ฒฝ์šฐ๋กœ ์ธํ•ด ๋ฉ”๋ชจ๋ฆฌ ํฌ๋ Œ์‹ ํ•  ์ผ ๊ฑฐ์˜ ์—†์Œ

     


    ๋ฉ”๋ชจ๋ฆฌ ์ˆ˜์ง‘

    • ์ผ๋ฐ˜์ ์œผ๋กœ ๋ฉ”๋ชจ๋ฆฌ์™€ ํŽ˜์ด์ง€ ํŒŒ์ผ์ด ๋ถ„์„ ๋Œ€์ƒ -> ๋ฉ”๋ชจ๋ฆฌ, ํŽ˜์ด์ง€ ํŒŒ์ผ
    • ์ž ์ž๊ธฐ/์ตœ๋Œ€์ ˆ์ „๋ชจ๋“œ ํ™œ์„ฑํ™”์‹œ ์ถ”๊ฐ€ ๋ถ„์„ ๋Œ€์ƒ -> ํ•˜์ด๋ฒ„๋„ค์ด์…˜ ํŒŒ์ผ

    +) ํŽ˜์ด์ง€ ํŒŒ์ผ : ๋ฌผ๋ฆฌ์ ์œผ๋กœ ๋ชจ์ž๋ž€ RAM๊ณต๊ฐ„์„ ํ•˜๋“œ๋””์Šคํฌ๋ฅผ ํ™œ์šฉํ•ด ๋ณด์ถฉํ•˜๊ณ ์ž ํ•˜๋Š” ๊ธฐ๋Šฅ

    +) ํ•˜์ด๋ฒ„๋„ค์ด์…˜ ํŒŒ์ผ : ์ ˆ์ „ ๋ชจ๋“œ์‹œ ์œˆ๋„์šฐ ํ™˜๊ฒฝ์„ ๊ทธ๋Œ€๋กœ ๋ณด์กดํ•˜๊ธฐ ์œ„ํ•ด ๋ณต๊ตฌํ•˜๋Š” ๊ธฐ๋Šฅ -> hiberfil.sys

       -> hiberfil.sysํฌ๊ธฐ๋Š” ๋ณดํ†ต ๋žจ์˜ 70%์ •๋„๋ฅผ ์‚ฌ์šฉ, ํ•˜์ง€๋งŒ ์ด๊ฑธ ์ œ๋Œ€๋กœ ๋ถ„์„ํ•  ์ˆ˜ ์žˆ๋Š” ๋„๊ตฌ๊ฐ€ ์ž˜ ์—†์Œ

     

    ๋ฉ”๋ชจ๋ฆฌ ์ˆ˜์ง‘ ๋ฐฉ๋ฒ•

    โ‘  H/W๋ฅผ ์ด์šฉํ•œ ๋คํ”„ : FireWire๋ฅผ ์ด์šฉํ•œ ๋ฉ”๋ชจ๋ฆฌ ๋คํ”„, PCI ์Šฌ๋กฏ์— ๋คํ”„ํ•  H/W ๊ปด์„œ ๋คํ”„(๊ฑฐ์˜ ์‚ฌ์šฉ์•ˆํ•จ)

    โ‘ก S/W๋ฅผ ์ด์šฉํ•œ ๋คํ”„ : DD, MDD, Winen, Dumpit ๋“ฑ ์‚ฌ์šฉ

    โ‘ข ํฌ๋ž˜์‹œ ๋คํ”„ : ์‹œ์Šคํ…œ ์œ ์ง€์— ์น˜๋ช…์ ์ธ ์˜ํ–ฅ์„ ์ฃผ๋Š” ๋ฌธ์ œ ๋ฐœ์ƒ์‹œ ์›์ธ ์ฐพ๊ธฐ ์œ„ํ•ด ์œˆ๋„์šฐ ์Šค์Šค๋กœ ๋งŒ๋“œ๋Š” ๋ฉ”๋ชจ๋ฆฌ ๋คํ”„, ์ผ๋ช… BSOD(Blue Screen Of Death)๋ฐœ์ƒ ์‹œ ์ƒ์„ฑ๋œ๋А ํฌ๋ž˜์‹œ ๋คํ”„

    โ‘ฃ ์ ˆ์ „๋ชจ๋“œ ๋คํ”„ : ํ•˜์ด๋ฒ„๋„ค์ด์…˜ ํŒŒ์ผ(hiberfil.sys) ๋คํ”„

    โ‘ค ๊ฐ€์ƒํ™” ์‹œ์Šคํ…œ ๋คํ”„ : VM์—์„œ ์„ธ์…˜ ์ •์ง€๋  ๊ฒฝ์šฐ ๋ฌผ๋ฆฌ ๋ฉ”๋ชจ๋ฆฌ ๋‚ด์šฉ์€ .vmemํ™•์žฅ์ž ํŒŒ์ผ์— ํฌํ•จ, ์ด ๋•Œ, .vmemํŒŒ์ผ์€ ๋กœ์šฐ ํฌ๋งท๊ณผ ๋งค์šฐ ์œ ์‚ฌํ•˜๋ฏ€๋กœ ๋‹ค๋ฅธ ๋ฉ”๋ชจ๋ฆฌ ๋ถ„์„๋„๊ตฌ๋ฅผ ํ†ตํ•ด ๋ถ„์„ ๊ฐ€๋Šฅ

    โ‘ฅ ์ฝœ๋“œ ๋ถ€ํŠธ : PC๊ฐ€ ๊บผ์งˆ ๋•Œ ๋ฉ”๋ชจ๋ฆฌ๊ฐ€ ์ง€์›Œ์ง€๊ธฐ ์ „์— ๋žจ์„ ๊ธ‰์†๋ƒ‰๊ฐ์‹œ์ผœ ๋ฐ์ดํ„ฐ ๋‚ ์•„๊ฐ€์ง€ ์•Š๊ฒŒ ํ•˜๋Š” ๊ธฐ์ˆ 

     

    1) ์ตœ๊ทผ ๋ฉ”๋ชจ๋ฆฌ ์ˆ˜์ง‘ ๋ฐฉ์‹

    -> S/W + ํฌ๋ž˜์‹œ ๋คํ”„

     

    2) ๊ฐ ๋ฉ”๋ชจ๋ฆฌ ์ˆ˜์ง‘ ๋ฐฉ๋ฒ• ๋ฌธ์ œ์ 

    โ‘  H/W : ํ•˜๋“œ์›จ์–ด ๊ตฌ๋น„ ๋ฐ ๋ฏธ๋ฆฌ ์„ค์น˜๋˜์–ด ์žˆ์–ด์•ผ ํ•˜๋ฉฐ ๊ฐ„ํ˜น ์‹œ์Šคํ…œ ํฌ๋ž˜์‹œ ๋ฐœ์ƒํ•˜๋ฏ€๋กœ ์•ˆ์ •์„ฑ์— ๋Œ€ํ•œ ๊ฒ€์ฆ์ด ํ•„์š”

    โ‘ก ์ ˆ์ „๋ชจ๋“œ : ์ ˆ์ „๋œ ์ฆ‰์‹œ ๋งŒ๋“ค์–ด์ง€๋ฏ€๋กœ ๊ทธ ์ƒํ™ฉ ๋‹น์‹œ์˜ ๋ฉ”๋ชจ๋ฆฌ ๋คํ”„๊ฐ€ ์•„๋‹Œ ์ด์ „์˜ ๋ฉ”๋ชจ๋ฆฌ ๋คํ”„ ํŒŒ์ผ์ด๊ธฐ ๋•Œ๋ฌธ์— ์ •ํ™•ํ•œ ์‹œ์ ์˜ ๋ถ„์„ ๋ฐ์ดํ„ฐ ์–ป๊ธฐ ์–ด๋ ค์›€

    โ‘ข ๊ฐ€์ƒํ™” ์‹œ์Šคํ…œ : ๋ถ„์„ ๋Œ€์ƒ์ด ๊ฐ€์ƒํ™” ์‹œ์Šคํ…œ์ผ ๊ฒฝ์šฐ๋งŒ ํš๋“ ๊ฐ€๋Šฅ

     

     


    ๋ฉ”๋ชจ๋ฆฌ ๋ถ„์„ ๋ฐฉ๋ฒ•

    1) ์ดˆ๊ธฐ ๋ฉ”๋ชจ๋ฆฌ ๋ถ„์„ ๋ฐฉ๋ฒ•

    โ‘  ๋ฌธ์ž์—ด ๊ฒ€์ƒ‰ : ์ด๋ฉ”์ผ ์ฃผ์†Œ, ๋น„๋ฐ€๋ฒˆํ˜ธ, ํŒŒ์ผ ๋ช… ๋“ฑ.. (HxD์‚ฌ์šฉํ•ด์„œ)

    โ‘ก ํŒŒ์ผ ์นด๋น™ : ํŒŒ์ผ์˜ ์‹œ๊ทธ๋‹ˆ์ณ์™€ ๊ฐ™์€ ๋ฐ”์ด๋„ˆ๋ฆฌ ๋ฐ์ดํ„ฐ๋ฅผ ์ด์šฉํ•ด ๋””์Šคํฌ์˜ ๋น„ํ• ๋‹น ์˜์—ญ์—์„œ ํŒŒ์ผ ๋ณต๊ตฌ

     

    2) ์ตœ๊ทผ ๋ฉ”๋ชจ๋ฆฌ ๋ถ„์„ ๋ฐฉ๋ฒ•

    - ์˜ค๋ธŒ์ ํŠธ ๊ฒ€์ƒ‰์œผ๋กœ ๋ฐœ์ „ : ๋ฆฌ์ŠคํŠธ ์›Œํ‚น, ํŒจํ„ด ๋งค์นญ

    โ‘  ๋ฆฌ์ŠคํŠธ ์›Œํ‚น : ๋งํฌ๋ฅด ๋”ฐ๋ผ ํ”„๋กœ์„ธ์Šค ๊ฒ€์ƒ‰(DKOM๊ณผ ๊ฐ™์€ ์€๋‹‰ ๊ธฐ๋ฒ• ํƒ์ง€ ๋ถˆ๊ฐ€๋Šฅ)

    โ‘ก ํŒจํ„ด ๋งค์นญ : ํ”„๋กœ์„ธ์Šค ๊ตฌ์กฐ์ฒด์˜ ํŒจํ„ด์„ ์ด์šฉํ•ด ๋ฉ”๋ชจ๋ฆฌ ์˜์—ญ ์ „์ฒด ๊ฒ€์ƒ‰, ์€๋‹‰ ํ”„๋กœ์„ธ์Šค๋„ ๋™์ผํ•œ ๊ตฌ์กฐ์ฒด ๊ฐ€๋ฐŽ

    +) ๋ฉ”๋ชจ๋ฆฌ ๊ตฌ์กฐ๊ฐ€ ๊นจ์ ธ ๋ฆฌ์ŠคํŠธ ์›Œํ‚น ์‚ฌ์šฉ ๋ชปํ•œ๋‹ค๋ฉด ํŒจํ„ด ๋งค์นญ ์‚ฌ์šฉ

    +) ๋ฏธ๋ฏธ์นด์ธ (mimikatz) : ์œˆ๋„์šฐ ์ธ์ฆ ์ทจ์•ฝ์ ์„ ํ†ตํ•ด ๋น„๋ฐ€๋ฒˆํ˜ธ๋ฅผ ๋ณตํ˜ธํ™”ํ•˜๋Š” ๋„๊ตฌ

     

    3) ๋ฉ”๋ชจ๋ฆฌ ๋ถ„์„ ๋„๊ตฌ

    - Volatility, Rekail ๋‘ ๊ฐ€์ง€๋ฅผ ์ฃผ๋กœ ์‚ฌ์šฉ

     

    4) ๋ฉ”๋ชจ๋ฆฌ ๋ถ„์„์˜ ์žฅ,๋‹จ์ 

    ์žฅ์ ) ํ•ด๋‹น ์ƒํ™ฉ์— ๋Œ€ํ•ด ์ž˜ ํ‘œํ˜„ํ•ด ์ค„ ์ˆ˜ ์žˆ๋‹ค.

    ๋‹จ์ ) ๋ฎ์–ด์”Œ์–ด์ง€๊ธฐ ๋•Œ๋ฌธ์— ์ž˜๋ชป๋œ ํŒ๋‹จ์„ ํ•  ์ˆ˜ ์žˆ๋‹ค. ๊ฒฐ๊ตญ ์žฅ์ ์œผ๋กœ ์ธํ•ด ๋‹จ์ ์ด ๋ฐœ์ƒํ•  ์ˆ˜ ์žˆ์Œ

     


    ๋ฉ”๋ชจ๋ฆฌ ํฌ๋ Œ์‹(๋ฉ”๋ชจ๋ฆฌ ๋ถ„์„)

    ๋ฉ”๋ชจ๋ฆฌ ํฌ๋ Œ์‹์€ ๋ฌผ๋ฆฌ ๋ฉ”๋ชจ๋ฆฌ(RAM)์„ ๋คํ”„๋– ์„œ ๋ถ„์„์„ ํ•˜๋Š” ๊ฒƒ์„ ๋งํ•˜๋ฉฐ, ๋ถ„์„์„ ํ†ตํ•ด ์‹œ์Šคํ…œ์— ์‹คํ–‰ ์ค‘์ธ ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜, ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜์— ์ ‘๊ทผํ•œ ๊ฐ์ฒด(ํŒŒ์ผ, ๋ ˆ์ง€์ŠคํŠธ๋ฆฌ ๋“ฑ), ๋กœ๋“œํ•œ ๋ชจ๋“ˆ, ๋กœ๋“œํ•œ ์ปค๋„ ๋“œ๋ผ์ด๋ฒ„ ๋“ฑ๊ณผ ๊ฐ™์€ ํฌ๋ Œ์‹ ์กฐ์‚ฌ์— ํ•„์š”ํ•œ ์ •๋ณด๋ฅผ ์–ป์„ ์ˆ˜ ์žˆ๋‹ค.

     

    ์‚ฌ์šฉ ์ด์œ )

    ์•…์˜์ ์ธ ์•„ํ‹ฐํŒฉํŠธ๋ฅผ ์ฐพ๋Š” ์šฉ๋„๋กœ ๋ฉ”๋ชจ๋ฆฌ ์ด๋ฏธ์ง€๋ฅผ ์ˆ˜์ง‘ํ•˜์—ฌ ๋ถ„์„ํ•  ์ˆ˜ ์žˆ๊ณ , ์•…์„ฑ์ฝ”๋“œ ๋ถ„์„์—์„œ ์•…์„ฑ์ฝ”๋“œ์˜ ์ถ”๊ฐ€์ ์ธ ์ •๋ณด๋ฅผ ์–ป๊ธฐ ์œ„ํ•ด ๋ฉ”๋ชจ๋ฆฌ ํฌ๋ Œ์‹์„ ํ•˜๋Š” ๊ฒฝ์šฐ๋„ ์žˆ๋‹ค. ์˜ˆ๋ฅผ ๋“ค๋ฉด ์•…์„ฑ์ฝ”๋“œ ์ƒ˜ํ”Œ์„ ๊ฐ€์ง€๊ณ  ์žˆ์œผ๋ฉด ๊ฒฉ๋ฆฌ๋œ ํ™˜๊ฒฝ์—์„œ ์ƒ˜ํ”Œ์„ ์‹คํ–‰ํ•˜๊ณ  ๊ฐ์—ผ๋œ ํ•ด๋‹น ์‹œ์Šคํ…œ์˜ ๋ฉ”๋ชจ๋ฆฌ๋ฅผ ๋คํ”„๋œจ๊ณ  ๋ถ„์„ํ•˜์—ฌ ์ถ”๊ฐ€์ ์ธ ์•…์„ฑ์ฝ”๋“œ์˜ ํ–‰์œ„๋ฅผ ํŒŒ์•…ํ•  ์ˆ˜ ์žˆ๋‹ค. ๋˜ํ•œ, ์•…์„ฑ์ฝ”๋“œ๊ฐ€ ๋””์Šคํฌ์— ์กด์žฌํ•˜์ง€ ์•Š๊ณ  ๋ฉ”๋ชจ๋ฆฌ์—์„œ๋งŒ ์กด์žฌํ•  ์ˆ˜ ์žˆ๊ธฐ ๋•Œ๋ฌธ์— ๋””์Šคํฌ ํฌ๋ Œ์‹์ด๋‚˜ ํŒŒ์ผ ์‹œ์Šคํ…œ ๋ถ„์„๋ณด๋‹ค๋Š” ๋ฉ”๋ชจ๋ฆฌ ํฌ๋ Œ์‹์ด ์œ ์šฉํ•˜๋‹ค.

     

    ๋ฉ”๋ชจ๋ฆฌ ํฌ๋ Œ์‹ ๋‹จ๊ณ„)

    โ‘  ๋ฉ”๋ชจ๋ฆฌ ์ˆ˜์ง‘ : ํ•ด๋‹น ์‹œ์Šคํ…œ์˜ ๋ฉ”๋ชจ๋ฆฌ๋ฅผ ์ˆ˜์ง‘(๋คํ”„)ํ•˜๋Š” ๊ฒƒ์„ ์˜๋ฏธ

    โ‘ก ๋ฉ”๋ชจ๋ฆฌ ๋ถ„์„ : ๋ฉ”๋ชจ๋ฆฌ๋ฅผ ๋คํ”„ํ•œ ํŒŒ์ผ์„ ๋ถ„์„ํ•˜๋Š” ๊ฒƒ์„ ์˜๋ฏธ

     


    ์ฐธ๊ณ ์ž๋ฃŒ

     

    ๋ฉ”๋ชจ๋ฆฌ ํฌ๋ Œ์‹(Memory Forensic) ์ข…๋ฅ˜์™€ ๊ฐœ์š”

    ๋ฉ”๋ชจ๋ฆฌ ํฌ๋ Œ์‹(Memory Forensic) ๊ฐœ์š” ์ปดํ“จํ„ฐ ํฌ๋ Œ์‹(computer forensics, ์ปดํ“จํ„ฐ ๋ฒ•์˜ํ•™) ๋˜๋Š” ๋””์ง€ํ„ธ ํฌ๋ Œ์‹์€ ์ „์ž์  ์ฆ๊ฑฐ๋ฌผ ๋“ฑ์„ ์‚ฌ๋ฒ•๊ธฐ๊ด€์— ์ œ์ถœํ•˜๊ธฐ ์œ„ํ•ด ๋ฐ์ดํ„ฐ๋ฅผ ์ˆ˜์ง‘, ๋ถ„์„, ๋ณด๊ณ ์„œ๋ฅผ ์ž‘์„ฑํ•˜๋Š” ์ผ

    jmoon.co.kr

     

     

    ๋ฉ”๋ชจ๋ฆฌ ์ˆ˜์ง‘ (DumpIt)

     

     

    ์ด์ œ ๋ฉ”๋ชจ๋ฆฌ๋ฅผ ๋คํ”„ํ•˜๋Š” ๋ฐฉ๋ฒ•์„ ์•Œ์•„๋ณด์ž

    ๋ฉ”๋ชจ๋ฆฌ๋ฅผ ์ˆ˜์ง‘ํ•  ์ˆ˜ ์žˆ๋Š” ๋‹ค์–‘ํ•œ ๋„๊ตฌ๊ฐ€ ์žˆ์ง€๋งŒ ์—ฌ๊ธฐ์„œ๋Š” DumpIt์ด๋ผ๋Š” ํˆด์„ ์‚ฌ์šฉํ•ด์„œ ๋ฉ”๋ชจ๋ฆฌ๋ฅผ ๋คํ”„ํ•œ๋‹ค.

    (DumpIt์€ Comae memory toolkit์˜ ํ•œ ๋ถ€๋ถ„์œผ๋กœ ์ตœ์‹  ๋ฒ„์ „์„ ๋‹ค์šด๋ฐ›์œผ๋ ค๋ฉด comae.com์— ๋“ค์–ด๊ฐ€์„œ ๊ณ„์ • ์ƒ์„ฑ ํ›„, Comae memory toolkit์„ ๋ฐ›์œผ๋ฉด ๋œ๋‹ค๋Š”๋ฐ ๊ท€์ฐฎ๋‹ค.. ๊ทธ๋ƒฅ ์•„๋ž˜ ๋งํฌ์—์„œ ๋‹ค์šด๋ฐ›์ž) 

     

    Crypt2Shell/Comae-Toolkit

    Memory Dump. Contribute to Crypt2Shell/Comae-Toolkit development by creating an account on GitHub.

    github.com

     

    DumpIt์€ 32bit(x86), 64bit(x64) ์‹œ์Šคํ…œ์—์„œ ์‚ฌ์šฉ ๊ฐ€๋Šฅํ•˜๊ณ  ๊ธฐ๋ณธ์ ์œผ๋กœ Microsoft Crash Dump(.dmpํŒŒ์ผ)ํ˜•์‹์œผ๋กœ ๋ฉ”๋ชจ๋ฆฌ๋ฅผ ๋คํ”„ํ•œ๋‹ค. ๋คํ”„ ํŒŒ์ผ์„ ํ†ตํ•ด Volatility์™€ ๊ฐ™์€ ๋ฉ”๋ชจ๋ฆฌ ๋ถ„์„ ๋„๊ตฌ ๋˜๋Š” WinDbg์—์„œ ๋ถ„์„๊ฐ€๋Šฅํ•˜๋‹ค.

     

    [ Option ํ™•์ธ ]

    C:\Users\sec\Desktop\Comae-Toolkit-3.0.20171228.1\x64>DumpIt.exe /?
    
      DumpIt 3.0.20171228.1
      Copyright (C) 2007 - 2017, Matthieu Suiche <http://www.msuiche.net>
      Copyright (C) 2012 - 2014, MoonSols Limited <http://www.moonsols.com>
      Copyright (C) 2015 - 2017, Comae Technologies FZE <http://www.comae.io>
    
    Usage: DumpIt [Options] /OUTPUT <FILENAME>
    
    Description:
      Enables users to create a snapshot of the physical memory as a local file.
    
    Options:
      /TYPE, /T             Select type of memory dump (e.g. RAW or DMP) [default: DMP]
      /OUTPUT, /O           Output file to be created. (optional)
      /QUIET, /Q            Do not ask any questions. Proceed directly.
      /NOLYTICS, /N         Do not send any usage analytics information to Comae Technologies. This is used to improve our services.
      /NOJSON, /J           Do not save a .json file containing metadata. Metadata are the basic information you will need for the analysis.
      /LIVEKD, /L           Enables live kernel debugging session.
      /COMPRESS, /R         Compresses memory dump file.
      /APP, /A              Specifies filename or complete path of debugger image to execute.
      /CMDLINE, /C          Specifies debugger command-line options.
      /DRIVERNAME, /D       Specifies the name of the installed device driver image.
    
    Examples:
    
      Create a local memory snapshot:
    
          DumpIt.exe /OUTPUT snapshot.bin
    
      Enable live kernel debugging session:
    
          DumpIt.exe /L /A <debugger image path>
    
      Extract metadata from machine in live kernel debugging session:
    
          DumpIt.exe /L /A Dmp2Json.exe /C "/Y srv*C:\Symbols*http://msdl.microsoft.com/download/symbols /C \"/live /all /datetime /archive /snapshot C:\Snapshots\Snapshot\""

     

     

    1) "/OUTPUT" or "/O"

    -> ๋ฉ”๋ชจ๋ฆฌ๋ฅผ ์ˆ˜์ง‘ํ•˜๊ณ  ์ง€์ •ํ•œ ํŒŒ์ผ ์ด๋ฆ„์œผ๋กœ ๊ฒฐ๊ณผ๋ฅผ ์ €์žฅ

    C:\Users\sec\Desktop\Comae-Toolkit-3.0.20171228.1\x64>DumpIt.exe /O test.dmp
    
      DumpIt 3.0.20171228.1
      Copyright (C) 2007 - 2017, Matthieu Suiche <http://www.msuiche.net>
      Copyright (C) 2012 - 2014, MoonSols Limited <http://www.moonsols.com>
      Copyright (C) 2015 - 2017, Comae Technologies FZE <http://www.comae.io>
    
        Destination path:           \??\C:\Users\sec\Desktop\Comae-Toolkit-3.0.20171228.1\x64\test.dmp
    
        Computer name:              LAPTOP-LB4RMK61
    
    
        --> Proceed with the acquisition ? [y/n] n
        Aborting...
    

     

     

    2) "/TYPE" or "/T"

    -> Microsoft crash dump(.dmp)ํŒŒ์ผ ๋Œ€์‹ ์— ์›์‹œ ๋ฉ”๋ชจ๋ฆฌ ๋คํ”„(.bin)๋ฅผ ์ˆ˜์ง‘

    C:\Users\sec\Desktop\Comae-Toolkit-3.0.20171228.1\x64>DumpIt.exe /T RAW
    
      DumpIt 3.0.20171228.1
      Copyright (C) 2007 - 2017, Matthieu Suiche <http://www.msuiche.net>
      Copyright (C) 2012 - 2014, MoonSols Limited <http://www.moonsols.com>
      Copyright (C) 2015 - 2017, Comae Technologies FZE <http://www.comae.io>
    
        WARNING: RAW memory snapshot files are considered obsolete and as a legacy format.
    
        Destination path:           \??\C:\Users\sec\Desktop\Comae-Toolkit-3.0.20171228.1\x64\LAPTOP-LB4RMK61-20210429-004442.bin
    
        Computer name:              LAPTOP-LB4RMK61
    
    
        --> Proceed with the acquisition ? [y/n] n
        Aborting...

     

     

    3) "/COMPRESS" or "/R"

    -> .zdmp(Comae ์••์ถ• ํฌ๋ž˜์‹œ ๋คํ”„)ํŒŒ์ผ๋กœ ์ƒ์„ฑํ•จ์œผ๋กœ์จ ํฌ๊ธฐ๋ฅผ ์ค„์ด๊ณ  ๋” ๋น ๋ฅด๊ฒŒ ์ˆ˜์ง‘

    C:\Users\sec\Desktop\Comae-Toolkit-3.0.20171228.1\x64>DumpIt.exe /R
    
      DumpIt 3.0.20171228.1
      Copyright (C) 2007 - 2017, Matthieu Suiche <http://www.msuiche.net>
      Copyright (C) 2012 - 2014, MoonSols Limited <http://www.moonsols.com>
      Copyright (C) 2015 - 2017, Comae Technologies FZE <http://www.comae.io>
    
        Destination path:           \??\C:\Users\sec\Desktop\Comae-Toolkit-3.0.20171228.1\x64\LAPTOP-LB4RMK61-20210429-004537.zdmp
    
        Computer name:              LAPTOP-LB4RMK61
    
    
        --> Proceed with the acquisition ? [y/n] n
        Aborting...

     

    +) VMWare๋ฅผ ์ผ์‹œ ์ •์ง€ํ•˜๊ณ  ๊ฐ€์ƒ ๋จธ์‹ ์˜ ๋ฉ”๋ชจ๋ฆฌ ์ˆ˜์ง‘ ๊ฐ€๋Šฅ -> ์•…์„ฑ์ฝ”๋“œ ์ƒ˜ํ”Œ ์‹คํ–‰ ํ›„ VMWare๋ฅผ ์ •์ง€ํ•˜์—ฌ ํ˜ธ์ŠคํŠธ์—์„œ .vmemํ™•์žฅ์ž๋ฅผ ๊ฐ€์ง„ ํŒŒ์ผ๋กœ ์ €์žฅ๋จ

    +) Virtual Box๋Š” VM๊ณผ ๋‹ฌ๋ฆฌ ์ผ์‹œ ์ •์ง€๋ฅผ ํ†ตํ•ด ๋ฉ”๋ชจ๋ฆฌ ์ˆ˜์ง‘์„ ํ•  ์ˆ˜ ์—†์œผ๋ฏ€๋กœ ๊ฒŒ์ŠคํŠธ ๋จธ์‹  ๋‚ด๋ถ€์—์„œ DumpIt ์‚ฌ์šฉ

     

    Raw Memory Dump์œผ๋กœ ๋คํ”„๋œจ๋ฉด ๋‹ค์Œ๊ณผ ๊ฐ™์ด ํŒŒ์ผ์ด ์ƒ์„ฑ๋œ๋‹ค.

    ํŒŒ์ผ ํฌ๊ธฐ๊ฐ€ ๊ฒ๋‚˜ ํฌ๋‹ค;;

     

    ์š”๊ฑธ๋กœ volatility์—์„œ ์‚ฌ์šฉํ• ๋ผ๋‹ˆ๊น ์‹œ๊ฐ„์ด ๋„ˆ๋ฌด ๊ฑธ๋ฆฐ๋‹น;;

     

    ๊ทธ๋ž˜์„œ ๋ฉ”๋ชจ๋ฆฌ ๋ถ„์„์„ ์œ„ํ•ด ๋‹ค์Œ ๋งํฌ์—์„œ ๋ฉ”๋ชจ๋ฆฌ ๋คํ”„ํŒŒ์ผ์„ ๊ตฌํ•ด์„œ ๋ถ„์„ํ•ด๋ณด์ž

     

    volatilityfoundation/volatility

    An advanced memory forensics framework. Contribute to volatilityfoundation/volatility development by creating an account on GitHub.

    github.com

     

    (์ฐธ๊ณ ๋กœ Comae memory toolkit๋ง๊ณ  ๊ทธ๋ƒฅ ๊ตฌ๊ธ€๋งํ•ด์„œ dumpit๋‹ค์šด๋ฐ›์•„์„œ ์‹คํ–‰ํ•˜๋ฉด .RAWํŒŒ์ผ ํ˜•์‹์œผ๋กœ ๋คํ”„๋– ์ง€๋Š”๋ฐ ์œ„์—์„œ ๋คํ”„๋–ด๋˜ .bin์ด๋‚˜ ๋˜‘๊ฐ™์€ ๊ฒƒ ๊ฐ™๋‹ค.)

     

    ๋ฉ”๋ชจ๋ฆฌ ๋ถ„์„(feat. Volatility)

    ์ด์ œ ์ˆ˜์ง‘ํ•œ ๋ฉ”๋ชจ๋ฆฌ ์ด๋ฏธ์ง€๋ฅผ volatility๋ผ๋Š” ๋„๊ตฌ๋ฅผ ์‚ฌ์šฉํ•ด์„œ ๋ถ„์„ํ•ด๋ณด์ž

     

    ๋‹ค์šด๋กœ๋“œ : 

     

    Volatility 2.6 Release

    Volatility 2.6 - an advanced memory forensics framework

    www.volatilityfoundation.org

     

    volatility๋Š” ํŒŒ์ด์ฌ์œผ๋กœ ์ž‘์„ฑ๋œ ๋ฉ”๋ชจ๋ฆฌ ํฌ๋ Œ์‹ ํ”„๋ ˆ์ž„์›Œํฌ์ด๋ฉฐ Window, mac, linux์—์„œ๋„ ์‹คํ–‰ํ•  ์ˆ˜ ์žˆ๋‹ค. ๋…๋ฆฝ ์‹คํ–‰ ํŒŒ์ผ(standalone executable)์„ ์‚ฌ์šฉํ•˜๋ฉด ํŒŒ์ด์ฌ 2.7์ธํ„ฐํ”„๋ฆฌํ„ฐ์™€ ์˜์กด์„ฑ์ด ํ•จ๊ป˜ ๋ฌถ์—ฌ์žˆ๊ธฐ ๋•Œ๋ฌธ์— ๋”ฐ๋กœ ํŒŒ์ด์ฌ ์ธํ„ฐํ”„๋ฆฌํ„ฐ๋ฅผ ์„ค์น˜ํ•˜๊ฑฐ๋‚˜ ์˜์กด์„ฑ์„ ๊ณ ๋ คํ•˜์ง€ ์•Š๊ณ  ๋น ๋ฅด๊ฒŒ ์‹คํ–‰ํ•  ์ˆ˜ ์žˆ๋‹ค.

     

    volatility option : 

    C:\Users\sec\Desktop\forensic_tool\MEM>vol_2.6.exe -h
    Volatility Foundation Volatility Framework 2.6
    Usage: Volatility - A memory forensics analysis platform.
    
    Options:
      -h, --help            list all available options and their default values.
                            Default values may be set in the configuration file
                            (/etc/volatilityrc)
      --conf-file=.volatilityrc
                            User based configuration file
      -d, --debug           Debug volatility
      --plugins=PLUGINS     Additional plugin directories to use (semi-colon
                            separated)
      --info                Print information about all registered objects
      --cache-directory=C:\Users\sec/.cache\volatility
                            Directory where cache files are stored
      --cache               Use caching
      --tz=TZ               Sets the (Olson) timezone for displaying timestamps
                            using pytz (if installed) or tzset
      -f FILENAME, --filename=FILENAME
                            Filename to use when opening an image
      --profile=WinXPSP2x86
                            Name of the profile to load (use --info to see a list
                            of supported profiles)
      -l LOCATION, --location=LOCATION
                            A URN location from which to load an address space
      -w, --write           Enable write support
      --dtb=DTB             DTB Address
      --shift=SHIFT         Mac KASLR shift address
      --output=text         Output in this format (support is module specific, see
                            the Module Output Options below)
      --output-file=OUTPUT_FILE
                            Write output in this file
      -v, --verbose         Verbose information
      -g KDBG, --kdbg=KDBG  Specify a KDBG virtual address (Note: for 64-bit
                            Windows 8 and above this is the address of
                            KdCopyDataBlock)
      --force               Force utilization of suspect profile
      -k KPCR, --kpcr=KPCR  Specify a specific KPCR address
      --cookie=COOKIE       Specify the address of nt!ObHeaderCookie (valid for
                            Windows 10 only)
    
            Supported Plugin Commands:
    
                    amcache         Print AmCache information
                    apihooks        Detect API hooks in process and kernel memory
                    atoms           Print session and window station atom tables
                    atomscan        Pool scanner for atom tables
                    auditpol        Prints out the Audit Policies from HKLM\SECURITY\Policy\PolAdtEv
                    bigpools        Dump the big page pools using BigPagePoolScanner
                    bioskbd         Reads the keyboard buffer from Real Mode memory
                    cachedump       Dumps cached domain hashes from memory
                    callbacks       Print system-wide notification routines
                    clipboard       Extract the contents of the windows clipboard
                    cmdline         Display process command-line arguments
                    cmdscan         Extract command history by scanning for _COMMAND_HISTORY
                    connections     Print list of open connections [Windows XP and 2003 Only]
                    connscan        Pool scanner for tcp connections
                    consoles        Extract command history by scanning for _CONSOLE_INFORMATION
                    crashinfo       Dump crash-dump information
                    deskscan        Poolscaner for tagDESKTOP (desktops)
                    devicetree      Show device tree
                    dlldump         Dump DLLs from a process address space
                    dlllist         Print list of loaded dlls for each process
                    driverirp       Driver IRP hook detection
                    drivermodule    Associate driver objects to kernel modules
                    driverscan      Pool scanner for driver objects
                    dumpcerts       Dump RSA private and public SSL keys
                    dumpfiles       Extract memory mapped and cached files
                    dumpregistry    Dumps registry files out to disk
                    editbox         Displays information about Edit controls. (Listbox experimental.)
                    envars          Display process environment variables
                    eventhooks      Print details on windows event hooks
                    evtlogs         Extract Windows Event Logs (XP/2003 only)
                    filescan        Pool scanner for file objects
                    gahti           Dump the USER handle type information
                    gditimers       Print installed GDI timers and callbacks
                    gdt             Display Global Descriptor Table
                    getservicesids  Get the names of services in the Registry and return Calculated SID
                    getsids         Print the SIDs owning each process
                    handles         Print list of open handles for each process
                    hashdump        Dumps passwords hashes (LM/NTLM) from memory
                    hibinfo         Dump hibernation file information
                    hivedump        Prints out a hive
                    hivelist        Print list of registry hives.
                    hivescan        Pool scanner for registry hives
                    hpakextract     Extract physical memory from an HPAK file
                    hpakinfo        Info on an HPAK file
                    idt             Display Interrupt Descriptor Table
                    iehistory       Reconstruct Internet Explorer cache / history
                    imagecopy       Copies a physical address space out as a raw DD image
                    imageinfo       Identify information for the image
                    impscan         Scan for calls to imported functions
                    joblinks        Print process job link information
                    kdbgscan        Search for and dump potential KDBG values
                    kpcrscan        Search for and dump potential KPCR values
                    ldrmodules      Detect unlinked DLLs
                    lsadump         Dump (decrypted) LSA secrets from the registry
                    machoinfo       Dump Mach-O file format information
                    malfind         Find hidden and injected code
                    mbrparser       Scans for and parses potential Master Boot Records (MBRs)
                    memdump         Dump the addressable memory for a process
                    memmap          Print the memory map
                    messagehooks    List desktop and thread window message hooks
                    mftparser       Scans for and parses potential MFT entries
                    moddump         Dump a kernel driver to an executable file sample
                    modscan         Pool scanner for kernel modules
                    modules         Print list of loaded modules
                    multiscan       Scan for various objects at once
                    mutantscan      Pool scanner for mutex objects
                    notepad         List currently displayed notepad text
                    objtypescan     Scan for Windows object type objects
                    patcher         Patches memory based on page scans
                    poolpeek        Configurable pool scanner plugin
                    printkey        Print a registry key, and its subkeys and values
                    privs           Display process privileges
                    procdump        Dump a process to an executable file sample
                    pslist          Print all running processes by following the EPROCESS lists
                    psscan          Pool scanner for process objects
                    pstree          Print process list as a tree
                    psxview         Find hidden processes with various process listings
                    qemuinfo        Dump Qemu information
                    raw2dmp         Converts a physical memory sample to a windbg crash dump
                    screenshot      Save a pseudo-screenshot based on GDI windows
                    servicediff     List Windows services (ala Plugx)
                    sessions        List details on _MM_SESSION_SPACE (user logon sessions)
                    shellbags       Prints ShellBags info
                    shimcache       Parses the Application Compatibility Shim Cache registry key
                    shutdowntime    Print ShutdownTime of machine from registry
                    sockets         Print list of open sockets
                    sockscan        Pool scanner for tcp socket objects
                    ssdt            Display SSDT entries
                    strings         Match physical offsets to virtual addresses (may take a while, VERY verbose)
                    svcscan         Scan for Windows services
                    symlinkscan     Pool scanner for symlink objects
                    thrdscan        Pool scanner for thread objects
                    threads         Investigate _ETHREAD and _KTHREADs
                    timeliner       Creates a timeline from various artifacts in memory
                    timers          Print kernel timers and associated module DPCs
                    truecryptmaster Recover TrueCrypt 7.1a Master Keys
                    truecryptpassphrase     TrueCrypt Cached Passphrase Finder
                    truecryptsummary        TrueCrypt Summary
                    unloadedmodules Print list of unloaded modules
                    userassist      Print userassist registry keys and information
                    userhandles     Dump the USER handle tables
                    vaddump         Dumps out the vad sections to a file
                    vadinfo         Dump the VAD info
                    vadtree         Walk the VAD tree and display in tree format
                    vadwalk         Walk the VAD tree
                    vboxinfo        Dump virtualbox information
                    verinfo         Prints out the version information from PE images
                    vmwareinfo      Dump VMware VMSS/VMSN information
                    volshell        Shell in the memory image
                    windows         Print Desktop Windows (verbose details)
                    wintree         Print Z-Order Desktop Windows Tree
                    wndscan         Pool scanner for window stations
                    yarascan        Scan process or kernel memory with Yara signatures

    ์œ„์—์„œ ๋ณผ ์ˆ˜ ์žˆ๋“ฏ์ด volaitlity๋Š” ๋‹ค์–‘ํ•œ ์ •๋ณด๋ฅผ ์ถ”์ถœํ•  ์ˆ˜ ์žˆ๊ฒŒ ๋งŽ์€ ํ”Œ๋Ÿฌ๊ทธ์ธ๋“ค๋กœ ๊ตฌ์„ฑ๋˜์–ด ์žˆ๋‹ค.

     

    ํ”Œ๋Ÿฌ๊ทธ์ธ์— ๋Œ€ํ•œ ์„ค๋ช…์€ ๋‹ค์Œ ๋งํฌ๋ฅผ ์ฐธ๊ณ 

     

    volatilityfoundation/volatility

    An advanced memory forensics framework. Contribute to volatilityfoundation/volatility development by creating an account on GitHub.

    github.com

     

    ๋ณดํ†ต ๋‹ค์Œ๊ณผ ๊ฐ™์ด Volatility๋ฅผ ์‚ฌ์šฉํ•œ๋‹ค.

    volatility.exe -f <๋ฉ”๋ชจ๋ฆฌ ์ด๋ฏธ์ง€ ํŒŒ์ผ> --profile=<ํ”„๋กœํŒŒ์ผ> <ํ”Œ๋Ÿฌ๊ทธ์ธ> <์ธ์ž>
    python vol.py -f <๋ฉ”๋ชจ๋ฆฌ ์ด๋ฏธ์ง€ ํŒŒ์ผ> --profile=<ํ”„๋กœํŒŒ์ผ> <ํ”Œ๋Ÿฌ๊ทธ์ธ> <์ธ์ž>

    ๊ทผ๋ฐ ๋ฌธ์ œ๋Š” ๋คํ”„๋œฌ ๋ฉ”๋ชจ๋ฆฌ ์ด๋ฏธ์ง€ ํŒŒ์ผ์—์„œ ํ”„๋กœํŒŒ์ผ ๊ฐ’์„ ์–ด๋–ค ๊ฒƒ์œผ๋กœ ์ „๋‹ฌํ•  ์ง€๋ฅผ ๋ชจ๋ฅผ ์ˆ˜ ์žˆ๋‹ค.

    ๊ทธ๋ž˜์„œ ๋จผ์ € imageinfoํ”Œ๋Ÿฌ๊ทธ์ธ์„ ์‚ฌ์šฉํ•ด์„œ ๋คํ”„๋œฌ ์ด๋ฏธ์ง€ ํŒŒ์ผ์˜ ํ”„๋กœํŒŒ์ผ ๊ฐ’์„ ๊ตฌํ•œ๋‹ค.

    ์œ„์—์„œ Suggested Profile(s) ํ•ญ๋ชฉ์— "Win7SP1x86_23418, Win7SP0x86, Win7SP1x86" ์ด 3๊ฐœ๊ฐ€ ๋‚˜์˜ค๋Š”๋ฐ ์ด ์ค‘์— ํ•˜๋‚˜๋ฅผ ์‚ฌ์šฉํ•˜๋ฉด ๋œ๋‹ค.

     

    ํ…Œ์ŠคํŠธ๋กœ pslist ํ”Œ๋Ÿฌ๊ทธ์ธ์„ ์‚ฌ์šฉํ•œ๋‹ค๊ณ  ํ•˜๋ฉด ๋‹ค์Œ๊ณผ ๊ฐ™์ด profile์„ ์„ธํŒ…ํ•˜๊ณ  ์‹คํ–‰ํ•˜๋ฉด ๋œ๋‹ค.

    volatility ํ”Œ๋Ÿฌ๊ทธ์ธ ๋Œ€๋ถ€๋ถ„์€ ์œˆ๋„์šฐ OS ๊ตฌ์กฐ์ฒด์—์„œ ์ถ”์ถœํ•œ ์ •๋ณด์— ์˜์กดํ•˜๋ฉฐ ์ด๋Ÿฐ ๊ตฌ์กฐ์ฒด๋Š” ์œˆ๋„์šฐ ๋ฒ„์ „์— ๋”ฐ๋ผ ๋‹ค๋ฅด๊ธฐ ๋•Œ๋ฌธ์— profile์„ ํ†ตํ•ด volatility์—๊ฒŒ ์‚ฌ์šฉํ•  ๋ฐ์ดํ„ฐ ๊ตฌ์กฐ, ์‹ฌ๋ฒŒ, ์•Œ๊ณ ๋ฆฌ์ฆ˜์„ ์•Œ๋ ค์ค€๋‹ค.


    ํ”Œ๋Ÿฌ๊ทธ์ธ ์ •๋ฆฌ

    1) imageinfo : ๋ฉ”๋ชจ๋ฆฌ ๋คํ”„ ์šด์˜์ฒด์ œ, ์‹œ๊ฐ„ ํ™•์ธ(์Šค์บ” ๋ฐฉ์‹)

    2) pslist : ํ”„๋กœ์„ธ์Šค ๋ฆฌ์ŠคํŠธ ์ถœ๋ ฅ(๋ฆฌ์ŠคํŠธ์›Œํ‚น-๊ฐ€์ƒ์ฃผ์†Œ)

    3) psscan : ํ”„๋กœ์„ธ์Šค ๊ตฌ์กฐ์ฒด ์Šค์บ” ํ›„ ์ถœ๋ ฅ(ํŒจํ„ด๋งค์นญ-๋ฌผ๋ฆฌ์ฃผ์†Œ)

    4) pstree : ํ”„๋กœ์„ธ์Šค ํŠธ๋ฆฌ ์ถœ๋ ฅ(๋ฆฌ์ŠคํŠธ์›Œํ‚น-๊ฐ€์ƒ์ฃผ์†Œ)

    5) cmdline : ํ”„๋กœ์„ธ์Šค ์‹คํ–‰ ๋ช…๋ น์ค„ ์ธ์ž ์ถœ๋ ฅ

    6) netscan : ๋„คํŠธ์›Œํฌ ์—ฐ๊ฒฐ ์Šค์บ” ํ›„ ์ถœ๋ ฅ(ํŒจํ„ด๋งค์นญ-๋ฌผ๋ฆฌ์ฃผ์†Œ)

    7) filescan : ํŒŒ์ผ ๋ชฉ๋ก ์Šค์บ” ํ›„ ์ถœ๋ ฅ(ํŒจํ„ด๋งค์นญ-๋ฌผ๋ฆฌ์ฃผ์†Œ)

    8) dumpfiles : ์Šค์บ” ๋œ ํŒŒ์ผ ์ถ”์ถœ(๋ฌผ๋ฆฌ์ฃผ์†Œ๋ฅผ ์ธ์ž๋กœ ๋ฐ›๊ณ , ๊ฐ€์ƒ์ฃผ์†Œ๋ฅผ ๊ธฐ๋ฐ˜์œผ๋กœ ํŒŒ์ผ์„ ์ถ”์ถœํ•ด์คŒ)

    9) hivelist : ๋ฉ”๋ชจ๋ฆฌ์— ์กด์žฌํ•˜๋Š” ํ•˜์ด๋ธŒํŒŒ์ผ ๋ชฉ๋ก ์ถœ๋ ฅ(๊ฐ€์ƒ+๋ฌผ๋ฆฌ์ฃผ์†Œ)

    10) printkey : ํ•˜์ด๋ธŒํŒŒ์ผ ๋‚ด๋ถ€์— ์กด์žฌํ•˜๋Š” ์„œ๋ธŒํ‚ค๋ฅผ ๊ฒ€์ƒ‰ํ•ด์คŒ

     

    * ์‚ฌ์šฉ์ˆœ์„œ

    1) -> 4) -> 3) -> 5) -> 6)

    (๋‚˜๋จธ์ง€๋Š” ์˜ต์…˜)

     

    ํ”Œ๋Ÿฌ๊ทธ์ธ ์ฐธ๊ณ  ์ž๋ฃŒ)

     

    The Volatility Framework: Main Page

     

    volatilityfoundation.github.io

    ์™ผ์ชฝ ํƒญ์—์„œ The Volatility Framework -> Classes -> Class List -> volatility -> plugins๋ฅผ ํ†ตํ•ด ํ™•์ธ

     


    Volatility ์‚ฌ์šฉ ์ฐธ๊ณ 

     

    'Security/Volatility' ์นดํ…Œ๊ณ ๋ฆฌ์˜ ๊ธ€ ๋ชฉ๋ก

     

    rninche01.tistory.com

     

     

     

    ์ถœ์ฒ˜ : 'Security/04 forensic' ์นดํ…Œ๊ณ ๋ฆฌ์˜ ๊ธ€ ๋ชฉ๋ก (tistory.com)

    ์ถœ์ฒ˜ : 'Security/04 forensic' ์นดํ…Œ๊ณ ๋ฆฌ์˜ ๊ธ€ ๋ชฉ๋ก (tistory.com)

    ์ €์ž‘์žํ‘œ์‹œ ๋ณ€๊ฒฝ๊ธˆ์ง€ (์ƒˆ์ฐฝ์—ด๋ฆผ)

    '๐Ÿ’ป๋ชจ์˜ํ•ดํ‚น > Microsoft' ์นดํ…Œ๊ณ ๋ฆฌ์˜ ๋‹ค๋ฅธ ๊ธ€

    ํŒŒ์ผ ์‚ญ์ œ ํ”์  ์ฐพ๊ธฐ (NTFS) #nagoona  (0) 2022.06.27
    MFT Parsing ๋„๊ตฌ - analyzeMFT  (0) 2022.06.27
    Windows Registry ์นจํ•ด ๋Œ€์‘ ๋ถ„์„  (1) 2022.06.27
    ๐ŸŒWindow Froensic Tool List  (0) 2022.06.22
    Windows ์นจํ•ด ๋Œ€์‘ ๋ฐ ๋ถ„์„ ๊ธฐ๋ฒ• ( ๊ธˆ์œต๋ณด์•ˆ์› ๊ต์œก )  (0) 2022.06.22
      '๐Ÿ’ป๋ชจ์˜ํ•ดํ‚น/Microsoft' ์นดํ…Œ๊ณ ๋ฆฌ์˜ ๋‹ค๋ฅธ ๊ธ€
      • ํŒŒ์ผ ์‚ญ์ œ ํ”์  ์ฐพ๊ธฐ (NTFS) #nagoona
      • MFT Parsing ๋„๊ตฌ - analyzeMFT
      • Windows Registry ์นจํ•ด ๋Œ€์‘ ๋ถ„์„
      • ๐ŸŒWindow Froensic Tool List
      Mark930.k
      Mark930.k
      Citrix Netscaler / Citrix VDI / KaliLinux / AWS / VMware / Window Svr

      ํ‹ฐ์Šคํ† ๋ฆฌํˆด๋ฐ”