Archive

Archive for the ‘*BSD’ Category

Sniffing en Remoto

May 4th, 2011 No comments

En más de una ocasión me he encontrado en la necesidad de realizar una captura de red de un equipo remoto en tiempo real y analizarla con varias herramientas, pero se plantean varios “problemas” a la hora de realizarlo.

Uno de los problemas es que necesitaríamos tener instaladas en el servidor todas las herramientas de análisis que necesitemos. Esto en algunos casos no es posible (herramientas con GUI), además de no ser muy seguro tener todas las herramientas instaladas en el servidor. Una opción es realizar una captura con tcpdump durante X tiempo y luego volcarla a la estación de trabajo, pero el no poder analizar la captura “on-the-fly” o el hecho de que la actividad sospechosa no se realizase justo cuando estamos capturando los datos (¿qué pasa si te la cuelan entre captura y captura?) es algo que me preocupa, y sí, el servidor ya cuenta con NIDS y HIDS pero el problema se plantea cuando necesitamos una captura de red completa.

Para ello lo que vamos a hacer es lo siguiente:

  • Crear un usuario en el servidor, que pueda ejecutar tcpdump con permisos de root sin password
  • Autorizar el login de dicho usuario por SSH en el servidor mediante claves DSA permitiendo únicamente ejecutar el binario ‘sudo
  • Crear una cola FIFO donde volcar la captura remota

Hecho esto, la FIFO contendrá la captura del servidor remoto, con lo que podremos usarla como origen de captura en la estación de trabajo.

El servidor es una Debian GNU/Linux y la estación de trabajo es FreeBSD 8.2.

Creando el usuario en el servidor:

[email protected]:~$ sudo useradd -m -N -s /bin/bash sniffer
[email protected]:~$ sudo passwd sniffer
sudo passwd sniffer
Introduzca la nueva contraseña de UNIX:
Vuelva a escribir la nueva contraseña de UNIX:
passwd: contraseña actualizada correctamente

Parámetros:

  • -m Crea el directorio de conexion si no existe
  • -N No crea el grupo del usuario
  • -s Shell por defecto del usuario
  • sniffer Usuario

La password es opcional, dependiendo si el servidor SSH permite logins con contraseñas vacías. Hecho esto ejecutamos la siguiente orden para permitirle ejecutar tcpdump como root sin pedir la contraseña:

[email protected]:~$ sudo echo "sniffer ALL= NOPASSWD: `which tcpdump`" >> /etc/sudoers

Autorizar login SSH sin password:

Ahora lo que haremos será generar una clave DSA en la estación de trabajo, en caso de que ya la tengas generada, puedes saltarte esta parte.

[[email protected] ~]$ ssh-keygen -t dsa
Generating public/private dsa key pair.
Enter file in which to save the key (/home/sch3m4/.ssh/id_dsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/sch3m4/.ssh/id_dsa.
Your public key has been saved in /home/sch3m4/.ssh/id_dsa.pub.
The key fingerprint is:
78:d2:ed:e7:33:8f:d8:5c:78:b6:2b:21:1d:9c:c0:a6 [email protected]
The key's randomart image is:
+--[ DSA 1024]----+
|         .       |
|          +      |
|         o o .   |
|       oE.  +    |
|      o S .. .   |
|       o .. o.   |
|          ..o.+  |
|           *+= . |
|          . ==+. |
+-----------------+
[[email protected] ~]$

Ahora camos a copiar la clave pública que hemos generado (~/.ssh/id_dsa.pub) al directorio de trabajo del usuario “sniffer” en el servidor, crear la carpeta “.ssh” y volcar la clave pública al fichero “.ssh/authorized_keys” y darle los permisos adecuados. Dependiendo de la configuración que tengamos en el servidor SSH tendremos que agregar el usuario “sniffer” en la linea “AllowUsers“  del fichero de configuración de SSH (/etc/sshd/sshd_config).

[[email protected] ~]$ scp -C .ssh/id_dsa.pub [email protected]:~/
[email protected]'s password:
id_dsa.pub         100%  616     0.6KB/s   00:00   
[[email protected] ~]$

Ahora nos conectamos por SSH al servidor, con el usuario “sniffer” para crear el directorio “~/.ssh” crear el fichero “~/.ssh/authorized_keys” con la clave pública DSA que hemos subido al servidor, e indicarle que solo puede usar la orden ‘sudo‘:

[[email protected] ~]$ ssh [email protected]
[email protected]'s password: 

[email protected]:~$ mkdir .ssh
[email protected]:~$ chmod 0700 .ssh/
[email protected]:~$ cat id_dsa.pub > .ssh/authorized_keys
[email protected]:~$ rm id_dsa.pub
[email protected]:~$ chmod 600 .ssh/authorized_keys
[email protected]:~$ ls -l .ssh/
total 4
-rw------- 1 sniffer users 631 may  4 19:55 authorized_keys
[email protected]:~$

Hecho esto el contenido de “~/.ssh/authorized_keys” quedaría algo parecido a esto:

ssh-dss A(...)suGkuJRcwAAAIEAmKBmvqR+0IjzrdYXR8BX(...)ZScAAACAG2l92RIc4vlI+o(...)UQoreQ= [email protected]

Ahora probamos a iniciar sesion con el usuario ‘sniffer‘ en el servidor:

[[email protected] ~]$ ssh [email protected]

Last login: Wed May  4 19:58:10 2011 from 10.0.0.33
[email protected]:~$

Ahora vamos a intentar iniciar sesión lanzando tcpdump:

[[email protected] ~]$ ssh [email protected] sudo tcpdump -i tun0

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun0, link-type RAW (Raw IP), capture size 65535 bytes
^CKilled by signal 2.
[[email protected] ~]$

Todo correcto así que vamos a preparar los parámetros de tcpdump y volcar la salida a una FIFO:

[[email protected] ~]$ mkfifo /tmp/fifo.sniffer
[[email protected] ~]$ ssh [email protected] sudo tcpdump -U -n -w - -i wlan0 "port 80" > /tmp/fifo.sniffer

Ahora, ya podemos lanzar Wireshark con la siguiente orden:

[[email protected] ~]$ sudo wireshark -k -i /tmp/fifo.sniffer

La opción “-k” es para que comience la captura en cuanto se abra.

Categories: *BSD, General, GNU/Linux, Red, Seguridad, UNIX Tags:

Volatility Installer

May 3rd, 2011 No comments

Como ya sabréis, Volatility es un producto de código abierto de “Volatile Systems” escrito en Python orientado al análisis forense de memoria RAM en entornos Windows.

Una vez instalado es muy potente y sencillo de usar, pero tienes que dedicarle un “ratito” a la instalación… Con el objetivo de hacer más sencillo el proceso de instalación ha nacido un proyecto en Google Code de la mano de Juan Garrido llamado Volatility Installer, en el que he tenido la suerte de participar en la versión UNIX del script.

El proceso de instalación sería el siguiente:

[[email protected] ~]$ uname -a
FreeBSD hellforce1.hell.lan 8.2-RELEASE FreeBSD 8.2-RELEASE #0: Fri Feb 18 02:24:46 UTC 2011     [email protected]:/usr/obj/usr/src/sys/GENERIC  i386
[[email protected] ~]$ wget http://volatility-installer.googlecode.com/files/install.volatility.tar.gz
--2011-05-03 01:42:29--  http://volatility-installer.googlecode.com/files/install.volatility.tar.gz
Resolviendo volatility-installer.googlecode.com (volatility-installer.googlecode.com)... 209.85.147.82
Connecting to volatility-installer.googlecode.com (volatility-installer.googlecode.com)|209.85.147.82|:80... conectado.
Petición HTTP enviada, esperando respuesta... 200 OK
Longitud: 8935 (8,7K) [application/x-gzip]
Saving to: `install.volatility.tar.gz'

100%[===================================================================================================================================================================================================>] 8.935       --.-K/s   in 0s      

2011-05-03 01:42:29 (54,8 MB/s) - `install.volatility.tar.gz' saved [8935/8935]

[[email protected] ~]$ sha1 install.volatility.tar.gz | grep 51f4505f2ed2d53a724cfe4761fa7d45818fbcc4
SHA1 (install.volatility.tar.gz) = 51f4505f2ed2d53a724cfe4761fa7d45818fbcc4
[[email protected] ~]$ tar xf install.volatility.tar.gz
[[email protected] ~]$ cd install.volatility
[[email protected] ~/install.volatility]$ ./volatility.installer.sh 

##################################################
#     Volatility Installer UNIX Script v0.3b     #
# http://code.google.com/p/volatility-installer/ #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Project leader: Juan Garrido (aka Silverhack)  #
# Script written by: Chema Garcia (aka sch3m4)   #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Contact:                                       #
#           http://safetybits.net                    #
#           [email protected] #
#           [email protected] #
##################################################

Usage: ./volatility.installer.sh <options>

+ Options:
 -v -------> Install Volatility
 -p -------> Install plugins
 -r -------> Install PyCrypto
 -y -------> Install libyara
 -t -------> Install yara-python
 -d -------> Install Distorm
 -s -------> Install libdasm
 -f -------> Install pefile
 -A -------> * Install all above

[[email protected] ~/install.volatility]$ ./volatility-installer -A

##################################################
#     Volatility Installer UNIX Script v0.3b     #
# http://code.google.com/p/volatility-installer/ #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Project leader: Juan Garrido (aka Silverhack)  #
# Script written by: Chema Garcia (aka sch3m4)   #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Contact:                                       #
#           http://safetybits.net                    #
#           [email protected] #
#           [email protected] #
##################################################

[i] Installing: Volatility
 + Url: https://www.volatilesystems.com/volatility/1.3/Volatility-1.3_Beta.tar.gz
 + File: volatility.tar.gz
 + Folder: Volatility-1.3_Beta
 + MD5: 77d05a5e93ea77425379a306024b739b
 + SHA256: 7d4dd429a488671c559c6f5de0d3fae6d3d1f9eb67c19e399495a1b6aa31d392\n

 - Downloading...
 OK
 - Verifing checksums...
 OK
 - Extracting Volatility...
 OK
 - Installing...
Password:
 OK
 - Cleaning...
 OK

[i] Installing: PyCrypto
 + Url: http://www.amk.ca/files/python/crypto/pycrypto-2.0.1.tar.gz
 + File: pycrypto-2.0.1.tar.gz
 + Folder: pycrypto-2.0.1
 + MD5: 4d5674f3898a573691ffb335e8d749cd
 + SHA256: b08d4ed54c9403c77778a3803e53a4f33f359b42d94f6f3e14abb1bf4941e6ea\n

 - Downloading...
 OK
 - Verifing checksums...
 OK
 - Extracting PyCrypto...
 OK
 - Installing...
 OK
 - Cleaning...
 OK

[i] Installing: LibDASM
 + Url: http://www.klake.org/~jt/misc/libdasm-1.5.tar.gz
 + File: libdasm-1.5.tar.gz
 + Folder: libdasm-1.5
 + MD5: f166d83ba73ae7f7f260366ba7155787
 + SHA256: 34d6c17dbb318bf2e21c6a3ae7dcc53d918ce247f1bd422b123d5e41a730a676\n

 - Downloading...
 OK
 - Verifing checksums...
 OK
 - Extracting LibDASM...
 OK
 - Installing...
 OK
 - Cleaning...
 OK

[i] Installing: Distorm3
 + Url: http://distorm.googlecode.com/files/distorm3.zip
 + File: distorm3.zip
 + Folder: distorm3
 + MD5: eb80e8901d4c52965b0de9ea5b7dca91
 + SHA256: 4fba8606caab377d10646953a205507a1faa184047f869cc13e62b1ebf4a1b0e\n

 - Downloading...
 OK
 - Verifing checksums...
 OK
 - Extracting Distorm3...
 OK
 - Installing...
 OK
 - Cleaning...
 OK

[i] Installing: Yara
 + Url: http://yara-project.googlecode.com/files/yara-1.4.tar.gz
 + File: yara-1.4.tar.gz
 + Folder: yara-1.4
 + MD5: ecc744a67482dc9d717936ccd69dc39f
 + SHA256: c040cc139030e49f736200d3a951922d417fc660cf4c81484ff1ca1a06f83952\n

 - Downloading...
 OK
 - Verifing checksums...
 OK
 - Extracting Yara...
 OK
 - Installing...
 OK
 - Cleaning...
 OK

[i] Installing: Yara-Python
 + Url: http://yara-project.googlecode.com/files/yara-python-1.4a.tar.gz
 + File: yara-python-1.4a.tar.gz
 + Folder: yara-python-1.4a
 + MD5: 0754dcc834c7f69ed0382d895d9a10cc
 + SHA256: 0221b6b5178edc99584fb0e082ebbc454e3e33701112f7041349e547a8aabc66\n

 - Downloading...
 OK
 - Verifing checksums...
 OK
 - Extracting Yara-Python...
 OK
 - Installing...
 OK
 - Cleaning...
 OK

[i] Installing: PEFile
 + Url: http://pefile.googlecode.com/files/pefile-1.2.10-102.tar.gz
 + File: pefile-1.2.10-102.tar.gz
 + Folder: pefile-1.2.10-102
 + MD5: 0047429fbd7b8bad8f5c583291b598f9
 + SHA256: 29d8b6fb4d30b1b45b801526591e8f23fb539cc059ed79d5aa34be93a9734dfe\n

 - Downloading...
 OK
 - Verifing checksums...
 OK
 - Extracting PEFile...
 OK
 - Installing...
 OK
 - Cleaning...
 OK

[i] Installing plugin: DriverIRP
 + Url: http://mhl-malware-scripts.googlecode.com/files/driverirp.py
 + File: driverirp.py
 + Folder: memory_plugins
 + MD5: 0696eefa51362b71606337b8d04d886f
 + SHA256: 7edf7373260462b36ac985837f28c27623e229291d7a1550334fcb2f667fc0fc\n

 - Downloading...
 OK
 - Verifing checksums...
 OK
 - Installing DriverIRP...
 OK
 - Cleaning...
 OK

[i] Installing plugin: GetSIDs
 + Url: http://www.cc.gatech.edu/~brendan/volatility/dl/getsids.py
 + File: getsids.py
 + Folder: memory_plugins
 + MD5: 49353f0a48a1f9b2411439fb8a0973dc
 + SHA256: a403bfbb98d49d9a73cc0f9928994f5ed3bcbf9ef249627e1bb0b86f2c24e41b\n

 - Downloading...
 OK
 - Verifing checksums...
 OK
 - Installing GetSIDs...
 OK
 - Cleaning...
 OK

[i] Installing plugin: SSDT
 + Url: http://www.cc.gatech.edu/~brendan/volatility/dl/ssdt.py
 + File: ssdt.py
 + Folder: memory_plugins
 + MD5: c820f40174bd42e77608d0415ed021c6
 + SHA256: 5760e5fba87b5fb536c0ad80ec6621bd43fa28ded8b75055380a6ac83db7f187\n

 - Downloading...
 OK
 - Verifing checksums...
 OK
 - Installing SSDT...
 OK
 - Cleaning...
 OK

[i] Installing plugin: ModDump
 + Url: http://www.cc.gatech.edu/~brendan/volatility/dl/moddump.py
 + File: moddump.py
 + Folder: memory_plugins
 + MD5: a6a98d106793bf674d8276a7ca127f4c
 + SHA256: 93771efe555c99d720371a5f6556aa9c734a49d514e782e0d3ceaf097019e522\n

 - Downloading...
 OK
 - Verifing checksums...
 OK
 - Installing ModDump...
 OK
 - Cleaning...
 OK

[i] Installing plugin: VolShell
 + Url: http://www.cc.gatech.edu/~brendan/volatility/dl/volshell.py
 + File: volshell.py
 + Folder: memory_plugins
 + MD5: 0012136fdef54c479eec44b7f19b5bcc
 + SHA256: e0b0b23eb00bf25b160399916004afe34da1c8ae3ebb870e901d09147f310962\n

 - Downloading...
 OK
 - Verifing checksums...
 OK
 - Installing VolShell...
 OK
 - Cleaning...
 OK

[i] Installing plugin: MalFind2
 + Url: http://mhl-malware-scripts.googlecode.com/files/malfind2.py
 + File: malfind2.py
 + Folder: memory_plugins
 + MD5: b9212ae50a800ffabfa5889bb7e3766b
 + SHA256: 8ad794435ad7a3cda7e3ec12525c781b14f5f09d6e37ffc39e5923ac07c304ec\n

 - Downloading...
 OK
 - Verifing checksums...
 OK
 - Installing MalFind2...
 OK
 - Cleaning...
 OK

[i] Installing plugin: CryptoScan
 + Url: http://jessekornblum.com/tools/volatility/cryptoscan.py
 + File: cryptoscan.py
 + Folder: memory_plugins
 + MD5: 523f67f6c19fa5637c35accef492a04b
 + SHA256: c6d97346eefe7c27cda73ed711ea3225d509c5162ae346f8fa66c6159898c9c6\n

 - Downloading...
 OK
 - Verifing checksums...
 OK
 - Installing CryptoScan...
 OK
 - Cleaning...
 OK

[i] Installing plugin: Suspicious
 + Url: http://jessekornblum.com/tools/volatility/suspicious.py
 + File: suspicious.py
 + Folder: memory_plugins
 + MD5: d751b34f2ef1713a5f599ea7fae20c1b
 + SHA256: 7941afa01e6de182c8e7452a23908be86702fa9b691dea0d56ff0a6d2bcdda43\n

 - Downloading...
 OK
 - Verifing checksums...
 OK
 - Installing Suspicious...
 OK
 - Cleaning...
 OK

[i] Installing plugin: PsTree
 + Url: http://www.pyflag.net/volatility/pstree.py
 + File: pstree.py
 + Folder: memory_plugins
 + MD5: cabf40d8fc1fc52e1a89930dec1ccec9
 + SHA256: ef2f719a3213c6e637735ad9a4a6bd04e922fa177d7c8651f4d8bd75c8cfa2c9\n

 - Downloading...
 OK
 - Verifing checksums...
 OK
 - Installing PsTree...
 OK
 - Cleaning...
 OK

[i] Installing plugin: KeyboardBuffer
 + Url: http://computer.forensikblog.de/files/volatility_plugins/keyboardbuffer.py
 + File: keyboardbuffer.py
 + Folder: memory_plugins
 + MD5: fda30c99dc701dce7a039d3de19307a3
 + SHA256: 396e72ddbda2846b301fb97b5ccf06bd250bf81a7327e514e4821ca637d6e088\n

 - Downloading...
 OK
 - Verifing checksums...
 OK
 - Installing KeyboardBuffer...
 OK
 - Cleaning...
 OK

[i] Installing plugin: OrphanThreads
 + Url: http://mhl-malware-scripts.googlecode.com/files/orphan_threads.py
 + File: orphan_threads.py
 + Folder: memory_plugins
 + MD5: 82ad2b8b5dde35f68f9ac3e9687655d6
 + SHA256: 009239a031cd53a82378a815ce81803ad3b7d4e8bd6257f34e50a5833cc0bda9\n

 - Downloading...
 OK
 - Verifing checksums...
 OK
 - Installing OrphanThreads...
 OK
 - Cleaning...
 OK

[i] Installing plugin: UsermodeHooks
 + Url: http://mhl-malware-scripts.googlecode.com/files/usermode_hooks2.py
 + File: usermode_hooks2.py
 + Folder: memory_plugins
 + MD5: 253a6885e52e39002c770e77916e7e09
 + SHA256: fae684cb49922dbf0c7920c4195876805ed591887e1b34dd590472a2a5a55de1\n

 - Downloading...
 OK
 - Verifing checksums...
 OK
 - Installing UsermodeHooks...
 OK
 - Cleaning...
 OK

[i] Installing plugin: KernelHooks
 + Url: http://mhl-malware-scripts.googlecode.com/files/kernel_hooks.py
 + File: kernel_hooks.py
 + Folder: memory_plugins
 + MD5: 01dcde71e2878b8c04cace8acd4bd06c
 + SHA256: 5911d54bb2e4802feb9cc5915dbabde395a89cbf1fd0217626112646da04e055\n

 - Downloading...
 OK
 - Verifing checksums...
 OK
 - Installing KernelHooks...
 OK
 - Cleaning...
 OK

[i] Installing plugin: IDT
 + Url: http://mhl-malware-scripts.googlecode.com/files/idt.py
 + File: idt.py
 + Folder: memory_plugins
 + MD5: 1890882ec273bf0036e9fb1aa4ea17e5
 + SHA256: 4ea358826d4f284f8f669a7bbddf4a6048c0fe3e83f98f973525cd1172d28b35\n

 - Downloading...
 OK
 - Verifing checksums...
 OK
 - Installing IDT...
 OK
 - Cleaning...
 OK

[i] Installing plugin: Lists
 + Url: http://www.cc.gatech.edu/~brendan/volatility/dl/lists.py
 + File: lists.py
 + Folder: forensics/win32
 + MD5: 7d7e7cd7b9d8f12773c057b402f79650
 + SHA256: 793b9a77a6b04c941c870cb4d22f3d8a9447a0431aaa954da04b4fcdee5dc140\n

 - Downloading...
 OK
 - Verifing checksums...
 OK
 - Installing Lists...
 OK
 - Cleaning...
 OK

[i] Installing plugin: ThreadQueues
 + Url: http://www.cc.gatech.edu/~brendan/volatility/dl/threadqueues.py
 + File: threadqueues.py
 + Folder: forensics/win32
 + MD5: 1dc40cd5987dfd55f4146721d978416f
 + SHA256: 4e370bfb29f673373ea1cc36991b42457894d12a1eb8df720e8ef040484d9d0e\n

 - Downloading...
 OK
 - Verifing checksums...
 OK
 - Installing ThreadQueues...
 OK
 - Cleaning...
 OK

[i] Installing plugin: VolRIP
 + Url: http://www.cc.gatech.edu/~brendan/volatility/dl/volrip-0.1.zip
 + File: volrip-0.1.zip
 + Folder: ./
 + MD5: 96b15dc1bcd1bd1f2782d38645dc5af9
 + SHA256: dc1b6bd109e813c3bd831c53955ae1401e181221ce3ffcfacc4fffb3b964b820\n

 - Downloading...
 OK
 - Verifing checksums...
 OK
 - Installing VolRIP...
 OK
 - Cleaning...
 OK

[i] Installing plugin: VolREG
 + Url: http://www.cc.gatech.edu/~brendan/volatility/dl/volreg-0.6.zip
 + File: volreg-0.6.zip
 + Folder: ./
 + MD5: 75d5e4f686082799d961641ebcd17bbd
 + SHA256: b361f0d516baf5e60c1048b5416a899365ac1824631390a962d5d258c10585b4\n

 - Downloading...
 OK
 - Verifing checksums...
 OK
 - Installing VolREG...
 OK
 - Cleaning...
 OK

[i] Installing plugin: FileObjScan
 + Url: http://computer.forensikblog.de/files/volatility_plugins/volatility_fileobjscan-current.zip
 + File: volatility_fileobjscan-current.zip
 + Folder: ./
 + MD5: 11a0a12f5d6ed31872daa6660446eb1c
 + SHA256: d8963851b4286b7fda5e9902ab176c49e1afb107dac8629046db6dfaedfc3653\n

 - Downloading...
 OK
 - Verifing checksums...
 OK
 - Installing FileObjScan...
 OK
 - Cleaning...
 OK

[i] Installing plugin: SymLinkScan
 + Url: http://computer.forensikblog.de/files/volatility_plugins/volatility_symlinkobjscan-current.zip
 + File: volatility_symlinkobjscan-current.zip
 + Folder: ./
 + MD5: e62dac146336e6f79ca89ca07061730c
 + SHA256: 7215b1977d7a6e9bfc44056c1becf41a7dc230a8ef14df5d260026fb5e600518\n

 - Downloading...
 OK
 - Verifing checksums...
 OK
 - Installing SymLinkScan...
 OK
 - Cleaning...
 OK

[i] Installing plugin: MutantScan
 + Url: http://computer.forensikblog.de/files/volatility_plugins/volatility_mutantscan-current.zip
 + File: volatility_mutantscan-current.zip
 + Folder: ./
 + MD5: c0571785cdea36f40416594b6e6134e4
 + SHA256: 080a8aa43cbd445c716c1b46a9c97c326d92bf8c3953eadea65cd9b7e677285e\n

 - Downloading...
 OK
 - Verifing checksums...
 OK
 - Installing MutantScan...
 OK
 - Cleaning...
 OK

[i] Installing plugin: ObjTypeScan
 + Url: http://computer.forensikblog.de/files/volatility_plugins/volatility_objtypescan-current.zip
 + File: volatility_objtypescan-current.zip
 + Folder: ./
 + MD5: 6ae2673cdaf7a0f2249db6f9dcc4b0a3
 + SHA256: 00b5b98bc2d6449a2106d42f208176360488d0da2b203c14c4c6ad66ef3e46a0\n

 - Downloading...
 OK
 - Verifing checksums...
 OK
 - Installing ObjTypeScan...
 OK
 - Cleaning...
 OK

[i] Installing plugin: DriverScan
 + Url: http://computer.forensikblog.de/files/volatility_plugins/volatility_driverscan-current.zip
 + File: volatility_driverscan-current.zip
 + Folder: ./
 + MD5: 02da6e69c983a9c2d5f5334da60f9d68
 + SHA256: 4384bbf66af9169986bacca75fbaf75d15c7006f4250b187f9b7ef94ebcad095\n

 - Downloading...
 OK
 - Verifing checksums...
 OK
 - Installing DriverScan...
 OK
 - Cleaning...
 OK

[+] Finished! You can check installation logs in /usr/home/sch3m4/install.volatility/logs_martes.05-03-11.01-40-33
[[email protected] ~/install.volatility]$

Hecho esto se habrá creado el script /usr/bin/volatility con el que podemos invocar a volatility desde cualquier directorio:

[[email protected] /tmp]$ volatility 

 Volatile Systems Volatility Framework v1.3
 Copyright (C) 2007,2008 Volatile Systems
 Copyright (C) 2007 Komoku, Inc.
 This is free software; see the source for copying conditions.
 There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

 usage: volatility cmd [cmd_opts]

 Run command cmd with options cmd_opts
 For help on a specific command, run 'volatility cmd --help'

 Supported Internel Commands:
 connections        Print list of open connections
 connscan           Scan for connection objects
 connscan2          Scan for connection objects (New)
 datetime           Get date/time information for image
 dlllist            Print list of loaded dlls for each process
 dmp2raw            Convert a crash dump to a raw dump
 dmpchk             Dump crash dump information
 files              Print list of open files for each process
 hibinfo            Convert hibernation file to linear raw image
 ident              Identify image properties
 memdmp             Dump the addressable memory for a process
 memmap             Print the memory map
 modscan            Scan for modules
 modscan2           Scan for module objects (New)
 modules            Print list of loaded modules
 procdump           Dump a process to an executable sample
 pslist             Print list of running processes
 psscan             Scan for EPROCESS objects
 psscan2            Scan for process objects (New)
 raw2dmp            Convert a raw dump to a crash dump
 regobjkeys         Print list of open regkeys for each process
 sockets            Print list of open sockets
 sockscan           Scan for socket objects
 sockscan2          Scan for socket objects (New)
 strings            Match physical offsets to virtual addresses (may take a while, VERY verbose)
 thrdscan           Scan for ETHREAD objects
 thrdscan2          Scan for thread objects (New)
 vaddump            Dump the Vad sections to files
 vadinfo            Dump the VAD info
 vadwalk            Walk the vad tree

 Supported Plugin Commands:
 cachedump          Dump (decrypted) domain hashes from the registry
 cryptoscan         Find TrueCrypt passphrases
 driverirp          Print driver IRP function addresses
 driverscan         Scan for driver objects
 fileobjscan        Scan for file objects
 getsids            Print the SIDs owning each process
 hashdump           Dump (decrypted) LM and NT hashes from the registry
 hivedump           Dump registry hives to CSV
 hivelist           Print list of registry hives
 hivescan           Scan for _CMHIVE objects (registry hives)
 idt                Print Interrupt Descriptor Table (IDT) entries
 kernel_hooks       Locate IAT/EAT/in-line API hooks in kernel space
 keyboardbuffer     Print BIOS keyboard buffer
 lsadump            Dump (decrypted) LSA secrets from the registry
 malfind2           Detect hidden and injected code
 moddump            Dump loaded kernel modules to disk.
 mutantscan         Scan for mutant (mutex) objects
 objtypescan        Scan for object type objects
 orphan_threads     Find kernel threads that don't map back to loaded modules
 printkey           Print a registry key, and its subkeys and values
 pstree            
 ssdt               Display SSDT entries
 suspicious         Find suspicious command lines and display them
 symlinkobjscan     Scan for symbolic link objects
 usermode_hooks     Locate IAT/EAT/in-line API hooks in user space
 volshell           Shell in the memory image

 Example: volatility pslist -f /path/to/my/file
[[email protected] /tmp]$

El archivo res.conf es el fichero del que lee los datos de las dependencias y plugins el script de instalación, por lo que para cambiar una versión por otra y/o agregar o eliminar plugins basta con editar este archivo.

Más información en el blog de Juan Garrido.