{"id":1221,"date":"2015-01-23T17:53:18","date_gmt":"2015-01-23T17:53:18","guid":{"rendered":"http:\/\/www.phillips321.co.uk\/?p=1221"},"modified":"2015-01-23T17:53:18","modified_gmt":"2015-01-23T17:53:18","slug":"quickly-finding-strings-in-process-memory-space","status":"publish","type":"post","link":"https:\/\/www.phillips321.co.uk\/2015\/01\/23\/quickly-finding-strings-in-process-memory-space\/","title":{"rendered":"Quickly finding strings in process memory space"},"content":{"rendered":"

So I was on a locked down Linux system this week with the inability to import any tools and I had to prove that strings could be identified in memory of certain processes.<\/p>\n

Fortunately CentOS was installed which had gdb along with it so I took to writing a script to automate this work for me. (I had to test the processes in a number of different scenarios)<\/p>\n

Basically the process memory map is stored at \/proc\/${pid}\/maps, then you use the address and gdb in batch mode to dump the memory to a file.<\/p>\n

You then grep the binary files for the string and keep your fingers crossed.<\/p>\n

I couldn’t take the script off site due so have had to rewrite it so here it is:<\/p>\n

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
<\/div><\/td>
#!\/bin\/bash<\/span>
\n# phillips321.co.uk<\/span>
\n# Version=0.1<\/span>
\n
\n# Fix for loop using whole line<\/span>
\nOLDIFS<\/span>=${IFS}<\/span>
\nIFS<\/span>='
\n'<\/span>
\nif<\/span> [<\/span>[<\/span> $#<\/span> !<\/span>= 2<\/span> ]<\/span>]<\/span> ; then<\/span>
\n    echo<\/span> '[+] usage: $0 processname string'<\/span>
\n    echo<\/span> "[+] example: $0 gedit "<\/span>Hello World""<\/span>
\n    exit<\/span> 1<\/span>
\nfi<\/span>
\n
\n# Find process id for process<\/span>
\nif<\/span> pid<\/span>=`<\/span>pgrep $1<\/span>`<\/span> ; then<\/span>
\n    echo<\/span> "[+] Process ${1}<\/span> identified as pid ${pid}<\/span>"<\/span>
\nelse<\/span>
\n    echo<\/span> "[+] Process not found, try pgrep ${1}<\/span> yourself"<\/span>
\n    exit<\/span> 1<\/span>
\nfi<\/span>
\n
\n# create folder and go inside it<\/span>
\nmkdir<\/span> -p<\/span> "${1}<\/span>-${pid}<\/span>"<\/span>
\ncd<\/span> ${1}<\/span>-${pid}<\/span>
\n
\n# copy process maps in order to identify memory addresses<\/span>
\ncp<\/span> \/<\/span>proc\/<\/span>${pid}<\/span>\/<\/span>maps .
\n
\n# loop through memory locations using gdb and dump memory to file<\/span>
\nfor<\/span> line in<\/span> `<\/span>cat<\/span> maps`<\/span>
\ndo<\/span>
\n    echo<\/span> "[+] Now working on ${line}<\/span>"<\/span>
\n    start<\/span>=`<\/span>echo<\/span> -n<\/span> ${line}<\/span> |<\/span> sed<\/span> -n<\/span> 's\/^\\([0-9a-f]*\\)-\\([0-9a-f]*\\) .*$\/\\1 \\2\/p'<\/span> |<\/span> cut<\/span> -d<\/span>" "<\/span> -f1`<\/span> #mem start location<\/span>
\n    stop<\/span>=`<\/span>echo<\/span> -n<\/span> ${line}<\/span> |<\/span> sed<\/span> -n<\/span> 's\/^\\([0-9a-f]*\\)-\\([0-9a-f]*\\) .*$\/\\1 \\2\/p'<\/span> |<\/span> cut<\/span> -d<\/span>" "<\/span> -f2`<\/span> #mem end location<\/span>
\n    gdb<\/span> -q<\/span> -silent<\/span> -batch<\/span> -pid<\/span> ${pid}<\/span> -ex<\/span> "dump memory ${pid}<\/span>-${start}<\/span>-${stop}<\/span>.dump 0x${start}<\/span> 0x${stop}<\/span>"<\/span>
\ndone<\/span>
\n
\n
\n# look for string in dumps<\/span>
\nif<\/span> [<\/span>[<\/span> ${2}<\/span> !<\/span>= ""<\/span> ]<\/span>]<\/span> ; then<\/span>
\n    string<\/span>=${2}<\/span>
\n    echo<\/span> "[+] Looking for ${string}<\/span> in dump files"<\/span>
\n    if<\/span> result<\/span>=`<\/span>grep<\/span> ${string}<\/span> *<\/span>.dump`<\/span> ; then<\/span>
\n        for<\/span> line in<\/span> ${result}<\/span>
\n        do<\/span>
\n            filename<\/span>=`<\/span>echo<\/span> -n<\/span> ${line}<\/span> |<\/span> cut<\/span> -d<\/span>' '<\/span> -f3`<\/span>
\n            echo<\/span> "[+] Found in ${filename}<\/span> - Creating ${filename}<\/span>.txt"<\/span>
\n            cat<\/span> ${filename}<\/span> |<\/span> tr<\/span> '[\\000-\\011\\013-\\037\\177-\\377]'<\/span> '.'<\/span> |<\/span> egrep<\/span> -n<\/span> --color<\/span> ${2}<\/span> ><\/span> ${filename}<\/span>.txt
\n        done<\/span>
\n    else<\/span>
\n        echo<\/span> "[+] String not found :-("<\/span>
\n    fi<\/span>
\nfi<\/span>
\n
\ncd<\/span> ..
\nIFS<\/span>=${OLDIFS}<\/span><\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

And here’s what the code looks like when you run it.<\/p>\n

1
2
3
<\/div><\/td>
root@<\/span>kali:~\/<\/span>testing# .\/dumpmem.sh leafpad "Hello World"<\/span>
\n[<\/span>+]<\/span> Looking for<\/span> Hello World in<\/span> dump files
\n[<\/span>+]<\/span> Found in<\/span> 11683<\/span>-b938a000-b9669000.dump - Creating 11683<\/span>-b938a000-b9669000.dump.txt"<\/span><\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

Then it’s a simple case of using the *.txt file in your report \ud83d\ude42<\/p>\n","protected":false},"excerpt":{"rendered":"

So I was on a locked down Linux system this week with the inability to import any tools and I had to prove that strings could be identified in memory of certain processes. Fortunately CentOS was installed which had gdb along with it so I took to writing a script to automate this work for […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[1],"tags":[426,427,5,349,383],"_links":{"self":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts\/1221"}],"collection":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/comments?post=1221"}],"version-history":[{"count":3,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts\/1221\/revisions"}],"predecessor-version":[{"id":1224,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts\/1221\/revisions\/1224"}],"wp:attachment":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/media?parent=1221"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/categories?post=1221"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/tags?post=1221"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}