标签:取证 00 zip kali jpg evidence 镜像
镜像文件取证
任务3:镜像文件取证 |
|
|
证据编号 |
在取证镜像中的文件名 |
镜像中原文件Hash码(MD5,不区分大小写) |
evidence 1 |
eg2kx.jpg |
85cdf73518b32a37f74c4bfa42d856a6 |
evidence 2 |
ZQOo2.zip |
9e69763ec7dac69e2c5b07a5955a5868 |
evidence 3 |
p3qQ4.jpg |
a9a18aecec905a7742042461595b4b5c |
evidence 4 |
nsOh2.png |
f5b9ce3e485314c23c40a89d994b2dc8 |
evidence 5 |
RVlYt.zip |
3f67593f11669c72a36bad4d41a83a78 |
evidence 6 |
mkjRv.7z |
e610fcd2a0cd53d158e8ee4bb088100a |
evidence 7 |
OR8iq.xml |
28ba933c31fd60f8c4461aed14a8c447 |
evidence 8 |
8cFQj.py |
7fccfb1778b15fbc09deb6690afc776a |
evidence 9 |
jMH7w.xlsx |
523c407180d54dde6eca700405599c8a |
evidence 10 |
01d98.gif |
d708444963b79da344fd71e5c72f7f02 |
FF D8 FF E1 |
GPEG(jpg) |
89 50 4E 47 |
PNG(png) |
47 49 46 38 |
GIF(gif) |
49 49 2A 00 |
TIFF(tif) |
42 4D C0 01 |
Windows Bitmap(bmp) |
50 4B 03 04 |
ZIP Archive (zip) |
52 61 72 21 |
RAR Archive (rar) |
38 42 50 53 |
Adobe Photoshop (psd) |
7B 5C 72 74 66 |
Rich Text Format (rtf) |
3C 3F 78 6D 6C |
XML(xml) |
68 74 6D 6C 3E |
HTML (html) |
25 50 44 46 2D 31 2E |
Adobe Acrobat (pdf) |
57 41 56 45 |
Wave (wav) |
4D 3C 2B 1A |
pcap (pcap) |
52 49 46 46 |
WEBP(webp) |
在auto中找到eg2kx.jpg,保存到本地
![image-20240112092314293](/i/l/?n=23&i=blog/3373819/202401/3373819-20240117160004319-366702483.png)
放到kali里查看下文件,发现里面有个压缩包
![image-20240112092629570](/i/l/?n=23&i=blog/3373819/202401/3373819-20240117160004816-541848098.png)
后缀修改.zip,打开压缩包
![image-20240112092705248](/i/l/?n=23&i=blog/3373819/202401/3373819-20240117160005148-473975828.png)
certutil -hashfile filename md5
使用cmd终端求出源文件hash码
![image-20240112131543599](/i/l/?n=23&i=blog/3373819/202401/3373819-20240117160005491-747670364.png)
ZQOo2.jpg
打开kali分析
![image-20240112160133081](/i/l/?n=23&i=blog/3373819/202401/3373819-20240117160005867-1740011772.png)
修改成zip文件需要密码,拉到010修改参数
![image-20240112164249128](/i/l/?n=23&i=blog/3373819/202401/3373819-20240117160006235-331059826.png)
![image-20240112164335875](/i/l/?n=23&i=blog/3373819/202401/3373819-20240117160006559-42605352.png)
![image-20240112164958120](/i/l/?n=23&i=blog/3373819/202401/3373819-20240117160006899-1295894272.png)
p3qQ4.jpg
打开就是图片没显示完全
HEX 十六进制
DEC 十进制
OCT 八进制
BIN 二进制
00 00 02 80 代表宽度
00 00 01 92 代表高度
![image-20240112165830003](/i/l/?n=23&i=blog/3373819/202401/3373819-20240117160007205-217484784.png)
![image-20240112170023751](/i/l/?n=23&i=blog/3373819/202401/3373819-20240117160007607-1640507331.png)
将高度十进制修改成1000,十六进制就是03 E8
![image-20240112170245579](/i/l/?n=23&i=blog/3373819/202401/3373819-20240117160008087-627190193.png)
![image-20240112170336477](/i/l/?n=23&i=blog/3373819/202401/3373819-20240117160008652-1182906156.png)
![image-20240112170507703](/i/l/?n=23&i=blog/3373819/202401/3373819-20240117160009090-103326999.png)
nsOh2.png
直接显示了
![image-20240112171129811](/i/l/?n=23&i=blog/3373819/202401/3373819-20240117160009535-1199317682.png)
![image-20240112171223100](/i/l/?n=23&i=blog/3373819/202401/3373819-20240117160009899-915994664.png)
RVlYt.zip
kali分析
![image-20240112173605944](/i/l/?n=23&i=blog/3373819/202401/3373819-20240117160010323-1992194845.png)
另一张图片并没有什么
用010打开发现两张图片中间含有base64解码
搜索45 4E 44 是结尾16进制表示
![image-20240112173756243](/i/l/?n=23&i=blog/3373819/202401/3373819-20240117160010699-1829591286.png)
![image-20240112174556707](/i/l/?n=23&i=blog/3373819/202401/3373819-20240117160011113-624071044.png)
或者使用kali解码
![image-20240112175116889](/i/l/?n=23&i=blog/3373819/202401/3373819-20240117160011446-1900231646.png)
mkjRv.7z
kali分析
修改成mpeg文件
使用audacity打开
![image-20240112221544123](/i/l/?n=23&i=blog/3373819/202401/3373819-20240117160011787-433754580.png)
![image-20240112222404958](/i/l/?n=23&i=blog/3373819/202401/3373819-20240117160012105-822850297.png)
. ...- .. -.. . -. -.-. . -....
在线解码
![image-20240112222424944](/i/l/?n=23&i=blog/3373819/202401/3373819-20240117160012491-492019149.png)
OR8iq.xml
kali分析
![image-20240112224106279](/i/l/?n=23&i=blog/3373819/202401/3373819-20240117160012832-397801572.png)
拉到stegsolve查看
![image-20240112224134376](/i/l/?n=23&i=blog/3373819/202401/3373819-20240117160013171-922104435.png)
8cFQj.py
kali分析
![image-20240112233049971](/i/l/?n=23&i=blog/3373819/202401/3373819-20240117160013539-1893277790.png)
拉到010 查看到末尾都是二进制,用python进行每8组为单位转换对应十进制
发现结尾都是base32
![image-20240112233157663](/i/l/?n=23&i=blog/3373819/202401/3373819-20240117160013926-720990622.png)
进行在线转换,32->64->32->hex->32->64->32
![image-20240112234717853](/i/l/?n=23&i=blog/3373819/202401/3373819-20240117160014354-557999002.png)
jMH7w.js
kali分析
改成压缩包后打开xlsx表格,拉住界面标红
![image-20240112235603836](/i/l/?n=23&i=blog/3373819/202401/3373819-20240117160014735-659793019.png)
![image-20240112235703295](/i/l/?n=23&i=blog/3373819/202401/3373819-20240117160015087-1238727541.png)
01d98.gif
kali分析
![image-20240113000103279](/i/l/?n=23&i=blog/3373819/202401/3373819-20240117160015447-1433089571.png)
Stegsolve.jar打开
选择
![image-20240113000308014](/i/l/?n=23&i=blog/3373819/202401/3373819-20240117160015926-495240091.png)
![image-20240113000520541](/i/l/?n=23&i=blog/3373819/202401/3373819-20240117160016377-1774172946.png)
标签:取证,
00,
zip,
kali,
jpg,
evidence,
镜像
From: https://www.cnblogs.com/yang-ace/p/17970246