I am analyzing a mem and trying to recover a file that an attacker used to exploit drupalgeddon2 vulnerability. I discover that the process with pid 11046 executes the request with the file h38x.php (the one the attacker submitted).

I need to somehow extract the file or its hash. Is there any way to do that with volatility?


You must log in to answer this question.

Browse other questions tagged .