Basic Linux Memory Forensics - Dumping Memory and Files with DD - Analyzing Metttle/Meterpreter

00:00 - Intro
00:47 - Discovering a weird binary running in /tmp/ but it doesn't exist on disk
01:55 - Start of explaining dd copying things out of memory
02:30 - Reading maps to identify where the file is, showing how to covnert hex to decimal in bash
04:00 - File extracted from memory
05:15 - Copying the heap from memory and discovering it is mettle/meterpreter based upon strings
06:55 - Showing we don't need to use DD to extract the file, can just use the "exe" file in proc/pid/
09:15 - Opening the elf in Ghidra and examining its decompiled output
12:00 - Showing what the file looks like in Cutter, which has a different decompile view
13:40 - Reading the Metasploit source code to identify what it looked like, to confirm what our findings from reversing
16:00 - Using MSFVenom to generate our own stager in order to confirm this is indeed what we saw on the box and that we extracted it correctly
18:50 - Using GDB against the stager to just practice reversing

[@obfusec8329]

I feel like we've been getting more uploads than usual from you and its great! It's crazy to think I've learned much of what I know about offensive security from your videos. Now I'm OSCP certified and working towards OSWE and OSED. Can't thank you enough for the content!

[@hubertgruber2341]

can you describe how your work looked like? I mean, were you spending some time on htb before oscp course, how much time do you spend on python etc?

[@devnull8769]

Awesome explanation like always. I‘d love to see a deep-dive assembly with reversing malware from you.
Keep things up ipp!

[@henrik.johnsen]

This was super informative, with quick and spot on explanations without any unnecessary «fill» content👍🏼👍🏼👍🏼

[@chiragartani]

I was just reading your reply on Liveoverflow's comment about not going technical. By the way Happy April Fool.☺️
Watching the video now..

[@takeshikovacs1081]

the way you explain things is truly amazing ! can't get enough of your content

[@emilsrbrden2987]

Awesome to see some new content from you my man! Please keep it up, much appreciated!

[@gokul6120]

Thanks for that . Please continue with this type of content !! ❤️❤️

[@amirmoti8494]

Thank you ippsec, you are the best. Keep uploads videos that can teach us

[@saurabhshinde1855]

As always, just awesome content.

[@MattKAva]

This was great, love it!

[@oldprogrammer93]

It's really very interesting, thank you IppSec.

[@valeryivanov7756]

Amazing!
Thank you!

[@cryptolivebot7163]

great explanation

[@mrd7901]

It's reminds me "Mr robot".
You always gem 💎❤️

[@fabiorj2008]

Awesome video.

[@defyteryt2452]

Good job we enjoying your vedio

[@MikaCybertron]

hi sir why when i dumping memory and files always just get dump file with size 1 MB to 1.5 MB, but the original size file is more than 15 MB, do you know how to fix it sir?
here is my command:
dd if=/proc/pid/mem of=/temp/dump bs=1 count=dumpSize skip=StartAddress

[@RandyFortier]

Ports are 16 bits, and 4433 decimal works out to 1151. As x86 uses little endian, this will show up as 5111. So, the dword that you found was, in fact, the port for sys_socketcall().

[@woolliedev]

Nice!

[@x.plorer]

Thanks

[@Ms.Robot.]

Ohhh nicceee ❤️

[@cimihan4816]

Hello, ippsec can you provide me the flag that you used to reduce go file size while compiling ?

[@ippsec]

Just search Ippsec.rocks for “shrink go”

[@robbie2044]

That was very nice forensics. From the video I gathered it was a 'malicious actor'? Maybe I am wrong and someone just left it there, didn't watch the stream :(
I am wondering though, what generally happens to people who put malware like this on certain HTB machines? Because I know you can track the IP to the account. I am asking because this might not be only scenario. Like what happens to people who actively try to hack another user. Not an "accident" or a bump during live machines.

[@nicof_2000]

4:00 ELF is a windows executeable? I thought ELF is for unix based systems and PE is the windows executable format?

[@zakcheb6086]

Hey ipp,
For 21:18 part, the port and AF_INET are both taking 2 bytes:
The port is echo $((0x5111)) => 20753 and AF_INET=2 , you can check it in 14:47.
Awesome content as always, thanks alot for it, we learn everyday from you =)

[@seppmeier9961]

crap you were 3minutes faster (watch out for network byte order/bigendian: the port is 4433 decimal)

[@ippsec]

Thanks!

[@S2eedGH]

So it is running even after removing the executable ? what about after rebooting a system, will still be working ?

[@secinject814]

Good question. Crazy that a malware could run after being deleted

[@Fidelity_Investments]

What gdb config is that? Mine is seemingly boring compared to yours :(

[@luffy20250]

Brother, please make a video on how to install dvwa on ubuntu

[@itsmijail]

Who else likes how he uses legend of zelda related names in some of his VMs?

[@sotecluxan4221]

[@sieteLineas]

wow