CST3510 Week 3 Lab Exercises - A Linux Process Analysis

CST3510 Week 3 Lab Exercises - A Linux Process Analysis

Introduction

  • This week’s workshop focuses on the enumeration of processes, specifically through tools like linuxpslist and linuxpstree.

  • Students will analyze processes in detail and extract memory pieces for better analysis.

  • Additional information, such as commands entered at the shell, will be used to deepen understanding of processes.

  • Kali VM profiles necessary for the lab exercises are pre-included; no need to create new profiles as done in previous labs.

  • Importance of practicing Week 2 Lab Exercises A in preparation for the upcoming Lab Test in Learning Week 6.

Lab Goals

  1. Analyze Processes

    • Understand the characteristics of processes and how to analyze them.

  2. Learn Related Plugins

    • Gain insights into other plugins like bash history and their utility.

Tools and Resources

  • Learning slides for reference: LS7

  • Memory Dumps:

    • debian.dump and debianNet.dump (found under Week 3 Lab materials on MyLearning, unzip required).

  • MemoryAnalysis.ova:

    • Available on the lab machine at C:\CST3510\VM.

  • VirtualBox Application:

    • Create a virtual machine with the following credentials:

    • Username: kali

    • Password: MDXK4l1

Setup Procedure for Analysis Environment

  1. Download and Unzip:

    • Memory dumps from Week 3 MyLearning resource.

  2. Open VirtualBox:

    • Import MemoryAnalysis.ova.

  3. Check Settings:

    • Verify display and network settings; edit shared folder to a folder in the Windows host.

  4. Power Up Virtual Machine:

    • Log in with provided credentials and open a terminal.

  5. List Profiles:

    • Get the correct profile using the following command:
      bash $> volatility -–info | grep Linux

  6. Ensure the memory sample is present:

    • Check in the Kali directory /media/testShare that debian.dump exists.

Process Listing

  • Execute Process Enumeration:

  $> volatility -f debian.dump --profile=LinuxDebian_4_9_0-12-amd64_profilex64 linux_pslist

  • This command will generate a list of active processes during the memory capture:

    • Each process has a unique identifier (Process ID - Pid).

    • Distinction between Userland processes and Kernel processes:

    • Kernel threads lack a Directory Table Base - DTB.

    • Userland processes possess their own memory spaces with DTB.

  • PPID (Parent Process ID):

    • Indicates which process launched the current process, important for understanding process relationships.

  • Use linux_pstree to visualize the parent-child relationship among processes:

  $> volatility -f debian.dump --profile=LinuxDebian_4_9_0-12-amd64_profilex64 linux_pstree

  • Example output shows sleep process running under a bash shell, with systemd as the first process (PID 1).

Investigating Kernel Threads

  • Characteristics of kernel threads:

    • Lack Uid and their names are enclosed in square brackets.

  • To find original paths of specific processes:

    • Execute the proc_maps plugin:
      bash $> volatility -f debian.dump --profile=LinuxDebian_4_9_0-12-amd64_profilex64 linux_proc_maps -p 1

    • Output reveals mappings, such as:

    • /lib/systemd/systemd

    • Indicates executable nature with ‘x’ in the flags column.

    • Allows validation of a process's execution source, relevant for malware analysis.

File Handlers and Descriptors

  • To check file handlers for a specific process:

  $> volatility -f debian.dump --profile=LinuxDebian_4_9_0-12-amd64_profilex64 linux_lsof -p 1

  • File Descriptors (FD):

    • FD 0: stdin

    • FD 1: stdout

    • FD 2: stderr

    • In the example, all descriptors are directed to /dev/null.

Exercises

Exercise 1: Find File Handlers of Sleep Process

  • Inspect memory maps and file handlers of the sleep process to see their targets.

Exercise 2: Recover Executable

  • Recover executable section of systemd using:

  $> volatility -f debian.dump --profile=LinuxDebian_4_9_0-12-amd64_profilex64 linux_dump_map -p 1 -s 0x0000560f8f4e3000 -D maps/

  • Follow similar steps for sleep process (PID 694).

Exercise 3: Analyze Command Line Arguments

  • Use linux_psaux to review command arguments:

  $> volatility -f debian.dump --profile=LinuxDebian_4_9_0-12-amd64_profilex64 linux_psaux

  • Example output may be:

    • systemd called as /sbin/init

    • sleep invoked as sleep 100.

Environment Variables in Process Analysis

  • To view environment variables for all processes, execute:

  $> volatility -f debian.dump --profile=LinuxDebian_4_9_0-12-amd64_profilex64 linux_psenv

  • Useful variables include:

    • PWD (current directory)

    • OLDPWD (previous directory)

    • Potential indicators of user’s activity.

  • To filter variables for a specific process:

  $> volatility -f debian.dump --profile=LinuxDebian_4_9_0-12-amd64_profilex64 linux_psenv -p 685

  • Analyze credentials and other variables for insights.

Recovering Bash History

  • To recover bash history for a specific process (e.g., PID 685):

  $> volatility -f debian.dump --profile=LinuxDebian_4_9_0-12-amd64_profilex64 linux_bash -p 685

  • The output includes timestamps, which are crucial for analysis of command execution patterns.

  • Note crucially that all commands appearing with the same timestamp may raise suspicions about the legitimacy of user activity.

Exercise 3 Discussion Prompts

  • Investigate the implications of all commands executed at the same timestamp. Does it seem unusual?

  • The sleep command provides insight into the user's intent from the shell.

Solutions

  • Exercise 1: Utilize previous commands to find maps and file handlers pointing to /dev/tty1 for sleep.

  • Exercise 2: Apply steps to recover executable map for sleep (PID 694).

  • Exercise 3: Discuss observations with peers, potentially clarify with a tutor.

  • List profiles: bash $> volatility -–info | grep Linux

  • Execute process enumeration (list active processes): bash $> volatility -f debian.dump --profile=LinuxDebian_4_9_0-12-amd64_profilex64 linux_pslist

  • Visualize parent-child process relationships: bash $> volatility -f debian.dump --profile=LinuxDebian_4_9_0-12-amd64_profilex64 linux_pstree

  • Find original paths of specific processes (e.g., PID 1): bash $> volatility -f debian.dump --profile=LinuxDebian_4_9_0-12-amd64_profilex64 linux_proc_maps -p 1

  • Check file handlers for a specific process (e.g., PID 1): bash $> volatility -f debian.dump --profile=LinuxDebian_4_9_0-12-amd64_profilex64 linux_lsof -p 1

  • Recover an executable section of systemd (PID 1) with specified address and output directory: bash $> volatility -f debian.dump --profile=LinuxDebian_4_9_0-12-amd64_profilex64 linux_dump_map -p 1 -s 0x0000560f8f4e3000 -D maps/

  • Review command line arguments for all processes: bash $> volatility -f debian.dump --profile=LinuxDebian_4_9_0-12-amd64_profilex64 linux_psaux

  • View environment variables for all processes: bash $> volatility -f debian.dump --profile=LinuxDebian_4_9_0-12-amd64_profilex64 linux_psenv

  • Filter environment variables for a specific process (e.g., PID 685): bash $> volatility -f debian.dump --profile=LinuxDebian_4_9_0-12-amd64_profilex64 linux_psenv -p 685

  • Recover bash history for a specific process (e.g., PID 685): bash $> volatility -f debian.dump --profile=LinuxDebian_4_9_0-12-amd64_profilex64 linux_bash -p 685