„uebung4/logbuch_a2.md“ hinzufügen
parent
5944a0a807
commit
f9287e4996
|
|
@ -0,0 +1,288 @@
|
||||||
|
Für die folgende Untersuchung wird eine virtuelle Maschine (im Folgenden als VM bezeichnet) mit Kali-Linux Version 2023.1 genutzt. Die in der Untersuchung genutzten Tools sind bereits in Kali-Linux vorinstalliert, weshalb keine zusätzliche Installation notwendig ist.
|
||||||
|
|
||||||
|
|
||||||
|
[11.05.2023 19:13:25 UTC+2]: Die Zip-Datei wurde in der VM heruntergeladen. Anschließend wird ein Terminal geöffnet und mit $ cd Downloads in das Download-Verzeichnis gewechselt.
|
||||||
|
|
||||||
|
[11.05.2023 19:19:02 UTC+2]: Es wird versucht die Datei mit Hilfe von 7-Zip zu entpacken:
|
||||||
|
`$ 7z e vUSB(1).zip`
|
||||||
|
Dabei wird folgender Output generiert:
|
||||||
|
```
|
||||||
|
7-Zip [64] 16.02 : Copyright (c) 1999-2016 Igor Pavlov : 2016-05-21
|
||||||
|
p7zip Version 16.02 (locale=en_US.UTF-8,Utf16=on,HugeFiles=on,64 bits,2 CPUs Intel(R) Core(TM) i9-8950HK CPU @ 2.90GHz (906EA),ASM,AES-NI)
|
||||||
|
Scanning the drive for archives:
|
||||||
|
1 file, 5484894 bytes (5357 KiB)
|
||||||
|
Extracting archive: vUSB(1).zip
|
||||||
|
|
||||||
|
Path = vUSB(1).zip
|
||||||
|
Type = zip
|
||||||
|
Physical Size = 5484894
|
||||||
|
30% - vUSB.imgEverything is Ok
|
||||||
|
Size: 3221225472
|
||||||
|
Compressed: 5484894
|
||||||
|
```
|
||||||
|
|
||||||
|
[11.05.2023 19:23:54 UTC+2]: Es wird mit $ ls überprüft, ob das Entpacken funktioniert hat. Dabei wird folgender Output generiert, an dem man erkennen kann, dass das Entpacken scheinbar funktioniert hat:
|
||||||
|
'image(1).zip' image.img Readme.md Recovered01Repaired Recovered02Repaired U2.zip vUSB.img
|
||||||
|
image_dd mnt Recovered01 Recovered02 U2.img 'vUSB(1).zip' vUSB.zip
|
||||||
|
|
||||||
|
[11.05.2023 19:37:37 UTC+2]: Es wird mit dd versucht eine Sicherung zu erstellen:
|
||||||
|
`$ dd if=vUSB.img of=vUSB_dd status=progress conv=notrunc,sync,noerror`
|
||||||
|
Dabei wird folgender Output generiert:
|
||||||
|
```
|
||||||
|
3210326528 bytes (3.2 GB, 3.0 GiB) copied, 193 s, 16.6 MB/s
|
||||||
|
6291456+0 records in
|
||||||
|
6291456+0 records out
|
||||||
|
3221225472 bytes (3.2 GB, 3.0 GiB) copied, 193.62 s, 16.6 MB/s
|
||||||
|
```
|
||||||
|
|
||||||
|
[11.05.2023 19:56:12 UTC+2]: Es wird versucht dc3dd zu installieren:
|
||||||
|
`$ sudo apt install dc3dd`
|
||||||
|
Dabei wird folgender Output generiert:
|
||||||
|
```
|
||||||
|
Reading package lists... Done
|
||||||
|
Building dependency tree... Done
|
||||||
|
Reading state information... Done
|
||||||
|
The following NEW packages will be installed:
|
||||||
|
dc3dd
|
||||||
|
0 upgraded, 1 newly installed, 0 to remove and 507 not upgraded.
|
||||||
|
Need to get 117 kB of archives.
|
||||||
|
After this operation, 496 kB of additional disk space will be used.
|
||||||
|
Get:1 http://ftp.halifax.rwth-aachen.de/kali kali-rolling/main amd64 dc3dd amd64 7.2.646-6 [117 kB]
|
||||||
|
Fetched 117 kB in 1s (202 kB/s)
|
||||||
|
Selecting previously unselected package dc3dd.
|
||||||
|
(Reading database ... 392545 files and directories currently installed.)
|
||||||
|
Preparing to unpack .../dc3dd_7.2.646-6_amd64.deb ...
|
||||||
|
Unpacking dc3dd (7.2.646-6) ...
|
||||||
|
Setting up dc3dd (7.2.646-6) ...
|
||||||
|
Processing triggers for man-db (2.11.2-1) ...
|
||||||
|
Processing triggers for kali-menu (2023.1.7) ...
|
||||||
|
```
|
||||||
|
|
||||||
|
[11.05.2023 19:57:34 UTC+2]: Es wird mit dc3dd versucht eine Sicherung zu erstellen:
|
||||||
|
`$ dc3dd if=vUSB.img hash=md5 log=dc3ddusbLog of=vUSB_dc3dd`
|
||||||
|
Die Erstellung schlägt mit folgendem Output fehl:
|
||||||
|
```
|
||||||
|
dc3dd 7.2.646 started at 2023-05-11 14:01:05 -0400
|
||||||
|
compiled options:
|
||||||
|
command line: dc3dd if=vUSB.img hash=md5 log=dc3ddusbLog of=vUSB_dc3dd
|
||||||
|
sector size: 512 bytes (assumed)
|
||||||
|
3132784640 bytes ( 2.9 G ) copied ( 97% ), 161 s, 19 M/s
|
||||||
|
[!!] writing to `vUSB_dc3dd': No space left on device
|
||||||
|
3133341696 bytes ( 2.9 G ) copied ( 97% ), 162 s, 18 M/s
|
||||||
|
input results for file `vUSB.img':
|
||||||
|
6119808 sectors in
|
||||||
|
5b181dc8ab8db2ea22cf4d74e87d96d1 (md5)
|
||||||
|
output results for file `vUSB_dc3dd':
|
||||||
|
6119400 sectors out
|
||||||
|
dc3dd failed at 2023-05-11 14:03:47 -0400
|
||||||
|
```
|
||||||
|
|
||||||
|
|
||||||
|
[18.05.2023 19:06:48 UTC+2]: Es wird erneut mit dc3dd versucht eine Sicherung zu erstellen:
|
||||||
|
`$ dc3dd if=vUSB.img hash=md5 log=dc3ddusbLog of=vUSB_dc3dd `
|
||||||
|
Die Erstellung hat folgenden Output:
|
||||||
|
|
||||||
|
[11.05.2023 20:07:29 UTC+2]: Es wird versucht mit sudo dc3dd eine Sicherung zu erstellen:
|
||||||
|
`$ sudo dc3dd if=vUSB.img hash=md5 log=dc3ddusbLog of=vUSB_dc3dd`
|
||||||
|
Folgender Output wird bei der Erstellung generiert:
|
||||||
|
```
|
||||||
|
dc3dd 7.2.646 started at 2023-05-11 14:07:29 -0400
|
||||||
|
compiled options:
|
||||||
|
command line: dc3dd if=vUSB.img hash=md5 log=dc3ddusbLog of=vUSB_dc3dd
|
||||||
|
sector size: 512 bytes (assumed)
|
||||||
|
3221225472 bytes ( 3 G ) copied ( 100% ), 185 s, 17 M/s
|
||||||
|
input results for file `vUSB.img':
|
||||||
|
6291456 sectors in
|
||||||
|
01f7fd777cc239b0c87c81fc2253a219 (md5)
|
||||||
|
output results for file `vUSB_dc3dd':
|
||||||
|
6291456 sectors out
|
||||||
|
dc3dd completed at 2023-05-11 14:10:34 -0400
|
||||||
|
```
|
||||||
|
|
||||||
|
|
||||||
|
[30.05.2023 16:11:23 UTC+2]: Es wird versucht mit sudo dcfldd eine Sicherung zu erstellen:
|
||||||
|
|
||||||
|
`$ sudo dcfldd if=vUSB.img hash=md5 hashlog=dcflddusbHashlog.log of=vUSB_dc3dd conv=sync,noerror`
|
||||||
|
|
||||||
|
Dabei wird folgender Output generiert:
|
||||||
|
|
||||||
|
```
|
||||||
|
98304 blocks (3072Mb) written.
|
||||||
|
98304+0 records in
|
||||||
|
98304+0 records out
|
||||||
|
```
|
||||||
|
|
||||||
|
|
||||||
|
[30.05.2023 16:20:08 UTC+2]: Es wird versucht mit sudo dcfldd eine Sicherung zu erstellen:
|
||||||
|
|
||||||
|
`$ mksquashfs vUSB.img vUSBsquash.sqsh`
|
||||||
|
|
||||||
|
Dabei wird folgender Output generiert:
|
||||||
|
|
||||||
|
```
|
||||||
|
Parallel mksquashfs: Using 2 processors
|
||||||
|
Creating 4.0 filesystem on vUSBsquash.sqsh, block size 131072.
|
||||||
|
[========================================================/] 24576/24576 100%
|
||||||
|
|
||||||
|
Exportable Squashfs 4.0 filesystem, gzip compressed, data block size 131072
|
||||||
|
compressed data, compressed metadata, compressed fragments,
|
||||||
|
compressed xattrs, compressed ids
|
||||||
|
duplicates are removed
|
||||||
|
Filesystem size 2299.80 Kbytes (2.25 Mbytes)
|
||||||
|
0.07% of uncompressed filesystem size (3145824.25 Kbytes)
|
||||||
|
Inode table size 492 bytes (0.48 Kbytes)
|
||||||
|
0.50% of uncompressed inode table size (98394 bytes)
|
||||||
|
Directory table size 28 bytes (0.03 Kbytes)
|
||||||
|
93.33% of uncompressed directory table size (30 bytes)
|
||||||
|
Number of duplicate files found 0
|
||||||
|
Number of inodes 2
|
||||||
|
Number of files 1
|
||||||
|
Number of fragments 0
|
||||||
|
Number of symbolic links 0
|
||||||
|
Number of device nodes 0
|
||||||
|
Number of fifo nodes 0
|
||||||
|
Number of socket nodes 0
|
||||||
|
Number of directories 1
|
||||||
|
Number of hard-links 0
|
||||||
|
Number of ids (unique uids + gids) 1
|
||||||
|
Number of uids 1
|
||||||
|
kali (1000)
|
||||||
|
Number of gids 1
|
||||||
|
kali (1000)
|
||||||
|
```
|
||||||
|
|
||||||
|
|
||||||
|
[30.05.2023 16:26:55 UTC+2]: Es wird versucht mit fsstat herauszufinden, welches Dateisystem auf dem USB befindet:
|
||||||
|
|
||||||
|
`$ fsstat vUSB.img `
|
||||||
|
|
||||||
|
|
||||||
|
Dabei wird folgender Output generiert:
|
||||||
|
|
||||||
|
```
|
||||||
|
FILE SYSTEM INFORMATION
|
||||||
|
--------------------------------------------
|
||||||
|
File System Type: FAT32
|
||||||
|
|
||||||
|
OEM Name: mkfs.fat
|
||||||
|
Volume ID: 0x3700c1ae
|
||||||
|
Volume Label (Boot Sector): NO NAME
|
||||||
|
Volume Label (Root Directory):
|
||||||
|
File System Type Label: FAT32
|
||||||
|
Next Free Sector (FS Info): 16920
|
||||||
|
Free Sector Count (FS Info): 6274528
|
||||||
|
|
||||||
|
Sectors before file system: 0
|
||||||
|
|
||||||
|
File System Layout (in sectors)
|
||||||
|
Total Range: 0 - 6291455
|
||||||
|
* Reserved: 0 - 31
|
||||||
|
** Boot Sector: 0
|
||||||
|
** FS Info Sector: 1
|
||||||
|
** Backup Boot Sector: 6
|
||||||
|
* FAT 0: 32 - 6167
|
||||||
|
* FAT 1: 6168 - 12303
|
||||||
|
* Data Area: 12304 - 6291455
|
||||||
|
** Cluster Area: 12304 - 6291455
|
||||||
|
*** Root Directory: 12304 - 12311
|
||||||
|
|
||||||
|
METADATA INFORMATION
|
||||||
|
--------------------------------------------
|
||||||
|
Range: 2 - 100466438
|
||||||
|
Root Directory: 2
|
||||||
|
|
||||||
|
CONTENT INFORMATION
|
||||||
|
--------------------------------------------
|
||||||
|
Sector Size: 512
|
||||||
|
Cluster Size: 4096
|
||||||
|
Total Cluster Range: 2 - 784895
|
||||||
|
|
||||||
|
FAT CONTENTS (in sectors)
|
||||||
|
--------------------------------------------
|
||||||
|
12304-12311 (8) -> EOF
|
||||||
|
12312-12695 (384) -> EOF
|
||||||
|
12696-16895 (4200) -> EOF
|
||||||
|
16896-16927 (32) -> EOF
|
||||||
|
```
|
||||||
|
|
||||||
|
|
||||||
|
[30.05.2023 16:37:45 UTC+2]: Es wird versucht mit dcfldd den USB-Stick erneut zu sichern und dabei alle 1M Chunks einen Hash zu erzeugen. Dabei wird der Algorithmus SHA1 verwendet und jeder Hash in eine neue Zeile geschrieben:
|
||||||
|
|
||||||
|
`$ dcfldd if=vUSB.img of=vUSB_hash_dcfldd.img hash=sha1 hashwindow=1M hashlog=hashlog_vUSB.txt `
|
||||||
|
|
||||||
|
Dokumentation der Hashes (hashlog_vUSB.txt)
|
||||||
|
|
||||||
|
```
|
||||||
|
0 - 1048576: a253aa45f32e482664f24084758393209cfe31fd
|
||||||
|
1048576 - 2097152: 3b71f43ff30f4b15b5cd85dd9e95ebc7e84eb5a3
|
||||||
|
2097152 - 3145728: 3b71f43ff30f4b15b5cd85dd9e95ebc7e84eb5a3
|
||||||
|
3145728 - 4194304: 302f8a09309ffe605c547e1a11a99018c635cd6e
|
||||||
|
4194304 - 5242880: 3b71f43ff30f4b15b5cd85dd9e95ebc7e84eb5a3
|
||||||
|
5242880 - 6291456: 3b71f43ff30f4b15b5cd85dd9e95ebc7e84eb5a3
|
||||||
|
6291456 - 7340032: 05571fd2f866650acbabe1e938da0a5f3e78f23c
|
||||||
|
7340032 - 8388608: 58441662c3c1b3a7d1b79b13c65dbbfa37f6c2d0
|
||||||
|
8388608 - 9437184: 9b75dc78f044a96a3448dc2750d90a4613485f4c
|
||||||
|
9437184 - 10485760: 3b71f43ff30f4b15b5cd85dd9e95ebc7e84eb5a3
|
||||||
|
10485760 - 11534336: 3b71f43ff30f4b15b5cd85dd9e95ebc7e84eb5a3
|
||||||
|
11534336 - 12582912: 3b71f43ff30f4b15b5cd85dd9e95ebc7e84eb5a3
|
||||||
|
12582912 - 13631488: 3b71f43ff30f4b15b5cd85dd9e95ebc7e84eb5a3
|
||||||
|
13631488 - 14680064: 3b71f43ff30f4b15b5cd85dd9e95ebc7e84eb5a3
|
||||||
|
14680064 - 15728640: 3b71f43ff30f4b15b5cd85dd9e95ebc7e84eb5a3
|
||||||
|
15728640 - 16777216: 3b71f43ff30f4b15b5cd85dd9e95ebc7e84eb5a3
|
||||||
|
16777216 - 17825792: 3b71f43ff30f4b15b5cd85dd9e95ebc7e84eb5a3
|
||||||
|
17825792 - 18874368: 3b71f43ff30f4b15b5cd85dd9e95ebc7e84eb5a3
|
||||||
|
18874368 - 19922944: 3b71f43ff30f4b15b5cd85dd9e95ebc7e84eb5a3
|
||||||
|
19922944 - 20971520: 3b71f43ff30f4b15b5cd85dd9e95ebc7e84eb5a3
|
||||||
|
20971520 - 22020096: 3b71f43ff30f4b15b5cd85dd9e95ebc7e84eb5a3
|
||||||
|
22020096 - 23068672: 3b71f43ff30f4b15b5cd85dd9e95ebc7e84eb5a3
|
||||||
|
23068672 - 24117248: 3b71f43ff30f4b15b5cd85dd9e95ebc7e84eb5a3
|
||||||
|
```
|
||||||
|
|
||||||
|
|
||||||
|
[30.05.2023 16:44:04 UTC+2]: Es wird versucht mit fls und dem ermittelten Offset und File System Type (siehe ffstat-Command) die Dateien zu extrahieren:
|
||||||
|
|
||||||
|
`$ fls -o 12304 -f fat32 vUSB.img`
|
||||||
|
|
||||||
|
Dabei wird folgender Output generiert:
|
||||||
|
|
||||||
|
`Invalid magic value (Not a FATFS file system (magic))`
|
||||||
|
|
||||||
|
[30.05.2023 16:58:13 UTC+2]: Es wird die Inode-Nummer der Datei vUSB.img ermittelt:
|
||||||
|
|
||||||
|
`$ ls -i vUSB.img `
|
||||||
|
|
||||||
|
Dabei wird folgender Output generiert:
|
||||||
|
|
||||||
|
`17432816 vUSB.img`
|
||||||
|
|
||||||
|
[30.05.2023 17:04:45 UTC+2]: Es wird versucht mit icat und dem ermittelten Offset und File System Type (siehe ffstat-Command), dem Offset und der ermittelten Inode-Nummer die Dateien zu extrahieren:
|
||||||
|
|
||||||
|
`$ icat vUSB.img -f fat32 -i raw -b 512 -o 12304 17432816 > /home/kali/Downloads/extracted_vUSB_icat`
|
||||||
|
|
||||||
|
Dabei wird folgender Output generiert:
|
||||||
|
|
||||||
|
`Invalid magic value (Not a FATFS file system (magic))`
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
[30.05.2023 17:13:18 UTC+2]: Der Output der Dateien wird mit dem fls ermittelt:
|
||||||
|
|
||||||
|
`$ fls vUSB.img`
|
||||||
|
|
||||||
|
Dabei wird folgender Output generiert:
|
||||||
|
|
||||||
|
```
|
||||||
|
r/r 4: Bild1.jpg
|
||||||
|
r/r 6: Bild2.jpeg
|
||||||
|
r/r 8: Blue.png
|
||||||
|
v/v 100466435: $MBR
|
||||||
|
v/v 100466436: $FAT1
|
||||||
|
v/v 100466437: $FAT2
|
||||||
|
V/V 100466438: $OrphanFiles
|
||||||
|
```
|
||||||
|
|
||||||
|
In diesen Dateien befinden sich drei Bilder. Das erste Bild ist ein Adler, der in die Kamera schaut, das zweite Bild ist ein fliegender Adler, der gestreckte Flügel und gestreckte Beine zeigt und das letzte Bild ist ein blau ausgefülltes Bild.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
Loading…
Reference in New Issue