I'm trying to recover files from a .mem file with volatility. The mem file is from a Linux machine. I have already loaded the profile and it works fine. I have discovered that the drupalgeddon2 vulnerability was exploited but I need evidence.
To get that evidence I tried the volatility module linux_enumerate_files to enumerate all the files and look for the ones that could be malicious. I found some weird files in the /tmp folder and need to recover them, or at least the hash so that I can check in Virustotal if they are malicious.
To recover the files I tried the module linux_find_file like this:
python2 vol.py --profile=Linuxperfil_memoria_volatility2x64 -f /media/sf_drive-download-20230328T154924Z-001/memoria.bin linux_find_file -F "/tmp/kKUKJsTYJHOVIjKIXYg7wqlj0.php" -O ../Desktop/shell
But the output is:
Inode Number Inode File Path
---------------- ------------------ ---------
---------------- 0x0 /tmp/kKUKJsTYJHOVIjKIXYg7wqlj0.php
And the file shell is not created. I guess the reason volatility can't recover the file and store it in "shell" is because the file doesn't have an inode number, but I don't really know.
Is there any way I can recover this file with volatility?
PD: I also tried bulk_extractor, and it created a folder named "utmp_carved", with hashes and a lot of entries but there are no names, so I don't know what file I am actually looking for. If there is any way that I can recover the file or its hash this way instead of using volatility I could use it too.
