Cookie Consent by Free Privacy Policy Generator ๐Ÿ“Œ Dumpscan - Tool To Extract And Dump Secrets From Kernel And Windows Minidump Formats

๐Ÿ  Team IT Security News

TSecurity.de ist eine Online-Plattform, die sich auf die Bereitstellung von Informationen,alle 15 Minuten neuste Nachrichten, Bildungsressourcen und Dienstleistungen rund um das Thema IT-Sicherheit spezialisiert hat.
Ob es sich um aktuelle Nachrichten, Fachartikel, Blogbeitrรคge, Webinare, Tutorials, oder Tipps & Tricks handelt, TSecurity.de bietet seinen Nutzern einen umfassenden รœberblick รผber die wichtigsten Aspekte der IT-Sicherheit in einer sich stรคndig verรคndernden digitalen Welt.

16.12.2023 - TIP: Wer den Cookie Consent Banner akzeptiert, kann z.B. von Englisch nach Deutsch รผbersetzen, erst Englisch auswรคhlen dann wieder Deutsch!

Google Android Playstore Download Button fรผr Team IT Security



๐Ÿ“š Dumpscan - Tool To Extract And Dump Secrets From Kernel And Windows Minidump Formats


๐Ÿ’ก Newskategorie: IT Security Nachrichten
๐Ÿ”— Quelle: kitploit.com


Dumpscan is a command-line tool designed to extract and dump secrets from kernel and Windows Minidump formats. Kernel-dump parsing is provided by volatility3.


Features

  • x509 Public and Private key (PKCS #8/PKCS #1) parsing
  • SymCrypt parsing
    • Supported structures
      • SYMCRYPT_RSAKEY - Determines if the key structure also has a private key
    • Matching to public certificates found in the same process
    • More SymCrypt structures to come
  • Environment variables
  • Command line arguments

Note: Testing has only been performed on Windows 10 and 11 64-bit hosts and processes. Feel free to file an issue for additional versions. Linux testing TBD.

Installation

As a command-line tool, installation is recommended using pipx. This allows for easy updates and well and ensuring it is installed in its own virtual environment.

pipx install dumpscan
pipx inject dumpscan git+https://github.com/volatilityfoundation/volatility3#39e812a

Usage

 Usage: dumpscan [OPTIONS] COMMAND [ARGS]...

Scan memory dumps for secrets and keys

โ•ญโ”€ Options โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ•ฎ
โ”‚ โ”‚
โ”‚ --help Show this message and exit. &#9474 ;
โ”‚ โ”‚
โ•ฐโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ•ฏ
โ•ญโ”€ Commands โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ•ฎ
โ”‚ โ”‚
โ”‚ kernel Scan kernel dump using volatility โ”‚
โ”‚ minidump Scan a user-mode minidump โ”‚
โ”‚ โ”‚
โ•ฐโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ•ฏ

In the case for subcommands that extract certificates, you can provide --output/-o <dir> to output any discovered certificates to disk.

Kernel Mode

As mentioned, kernel analysis is performed by Volatility3. cmdline, envar, and pslist are direct calls to the Volatility3 plugins, while symcrypt and x509 are custom plugins.

 Usage: dumpscan kernel [OPTIONS] COMMAND [ARGS]...

Scan kernel dump using volatility

โ•ญโ”€ Options โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ•ฎ
โ”‚ โ”‚
โ”‚ --help Show this message and exit. โ•ฐ
โ”‚ โ”‚
โ•ฐโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ•ฏ
โ•ญโ”€ Commands โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ•ฎ
โ”‚ โ”‚
โ”‚ cmdline List command line for processes (Only for Windows) โ”‚
โ”‚ envar List process environment variables (Only for Windows) โ”‚
โ”‚ pslist List all the processes and their command lin e arguments โ”‚
โ”‚ symcrypt Scan a kernel-mode dump for symcrypt objects โ”‚
โ”‚ x509 Scan a kernel-mode dump for x509 certificates โ”‚
โ”‚ โ”‚
โ•ฐโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ•ฏ

Minidump Mode

Supports Windows Minidump format.

Note: This has only been tested on 64-bit processes on Windows 10+. 32-bit processes requires additional work but isn't a priority.

 Usage: dumpscan minidump [OPTIONS] COMMAND [ARGS]...

Scan a user-mode minidump

โ•ญโ”€ Options โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ•ฎ
โ”‚ โ”‚
โ”‚ --help Show this message and exit. โ”‚
โ”‚ โ”‚
โ•ฐโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ•ฏ
โ•ญโ”€ Commands โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ•ฎ
โ”‚ โ”‚
โ”‚ cmdline Dump the command line string โ”‚
โ”‚ envar Dump the environment variables in a minidump โ”‚
โ”‚ symcrypt Scan a minidump for symcrypt objects โ”‚
โ”‚ x509 Scan a minidump for x509 objects โ”‚
โ”‚ โ”‚
โ•ฐโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ•ฏ

Built With

Acknowledgements

  • Thanks to F-Secure and the physmem2profit project for providing the idea to use construct for parsing minidumps.
  • Thanks to Skelsec and his minidump project which helped me figure out to parse minidumps.

To-Do

  • Verify use against 32-bit minidumps
  • Create a coredump parser for Linux process dumps
  • Verify volatility plugins work against Linux kernel dumps
  • Add an HTML report that shows all plugins
  • Code refactoring to make more extensible
  • MORE SECRETS


...



๐Ÿ“Œ dumpscan: extract and dump secrets from kernel and Windows Minidump formats


๐Ÿ“ˆ 129.25 Punkte

๐Ÿ“Œ Medium CVE-2021-41413: Ok-file-formats project Ok-file-formats


๐Ÿ“ˆ 34.3 Punkte

๐Ÿ“Œ CM PDF & TIFF Page Extractor 4.3.7.3.682 - Extract and save PDF pages in various image formats.


๐Ÿ“ˆ 32.85 Punkte

๐Ÿ“Œ Unblob - Extract Files From Any Kind Of Container Formats


๐Ÿ“ˆ 31.77 Punkte

๐Ÿ“Œ Everything Is Broken: Shipping rust-minidump at Mozilla โ€“ Part 1


๐Ÿ“ˆ 30.65 Punkte

๐Ÿ“Œ Minidump-Analyse (Bluescreen) | ComputerBase Forum


๐Ÿ“ˆ 30.65 Punkte

๐Ÿ“Œ Dump file creation failed due to error during dump creation


๐Ÿ“ˆ 27.64 Punkte

๐Ÿ“Œ PRC State Hacking: 'Chinese Edward Snowden' Spills Iโ€‘Soon Secrets in Huge Dump of TTPs


๐Ÿ“ˆ 25.34 Punkte

๐Ÿ“Œ Git-Secrets Prevents You From Committing Secrets And Credentials Into Git Repositories


๐Ÿ“ˆ 24.11 Punkte

๐Ÿ“Œ 1Password Secrets Automation helps businesses secure and manage secrets


๐Ÿ“ˆ 24.11 Punkte

๐Ÿ“Œ Secure, orchestrate, and manage your companyโ€™s infrastructure secrets with 1Password Secrets Automation


๐Ÿ“ˆ 24.11 Punkte

๐Ÿ“Œ Bitwarden Secrets Manager secures, controls, and manages infrastructure secrets


๐Ÿ“ˆ 24.11 Punkte

๐Ÿ“Œ Secrets Hub fรผr AWS Secrets Manager


๐Ÿ“ˆ 23.03 Punkte

๐Ÿ“Œ Secrets Hub fรผr AWS Secrets Manager - com! professional


๐Ÿ“ˆ 23.03 Punkte

๐Ÿ“Œ Tell Me Your Secrets Without Telling Me Your Secrets


๐Ÿ“ˆ 23.03 Punkte

๐Ÿ“Œ The Secrets of Python โ€œSecretsโ€


๐Ÿ“ˆ 23.03 Punkte

๐Ÿ“Œ Amazon Addresses Best Practice Secrets Management with AWS Secrets Manager


๐Ÿ“ˆ 23.03 Punkte

๐Ÿ“Œ Hard-coded secrets up 67% as secrets sprawl threatens software supply chain


๐Ÿ“ˆ 23.03 Punkte

๐Ÿ“Œ Effective Secrets Management: Retrieving Secrets From Azure Key Vault With Powershell Script


๐Ÿ“ˆ 23.03 Punkte

๐Ÿ“Œ Secrets Sensei: Conquering Secrets Management Challenges


๐Ÿ“ˆ 23.03 Punkte

๐Ÿ“Œ mkTouchPlus: A smart `mkdir -p` and `touch`. Automatically formats names and can make multiple files and folders at once. (Haskell)


๐Ÿ“ˆ 20.39 Punkte

๐Ÿ“Œ How to leverage PubMaticโ€™s Windows SDK to scale monetization across devices and formats


๐Ÿ“ˆ 20.09 Punkte

๐Ÿ“Œ How to leverage PubMaticโ€™s Windows SDK to scale monetization across devices and formats


๐Ÿ“ˆ 20.09 Punkte

๐Ÿ“Œ How to change Date and Time formats in Windows 11


๐Ÿ“ˆ 20.09 Punkte

๐Ÿ“Œ How to extract the signerโ€™s certificate and verify the signature of a Linux kernel image


๐Ÿ“ˆ 20.02 Punkte

๐Ÿ“Œ iPad Pro Launched in 11-inch and 12.9-inch Formats, A12X Bionic Chip and Face ID


๐Ÿ“ˆ 19.31 Punkte

๐Ÿ“Œ Object Detection: COCO and YOLO formats, and conversion between them


๐Ÿ“ˆ 19.31 Punkte











matomo