https://dr34nn.github.io/2022/11/07/Windows7%E5%86%85%E5%AD%98%E5%…%AF%81%E5%87%BA%E9%A2%98%E8%AE%B0%E5%BD%95/

1<!DOCTYPE html><html lang="zh-CN"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=2"><meta name="theme-color" content="#FFF"><link rel="apple-touch-icon" sizes="180x180" href="/images/apple-touch-icon.png"><link rel="icon" type="image/ico" sizes="32x32" href="/images/favicon.ico"><meta http-equiv="Cache-Control" content="no-transform"><meta http-equiv="Cache-Control" content="no-siteapp"><link rel="alternate" type="application/rss+xml" title="MISC" href="https://dr34nn.github.io/rss.xml"><link rel="alternate" type="application/atom+xml" title="MISC" href="https://dr34nn.github.io/atom.xml"><link rel="alternate" type="application/json" title="MISC" href="https://dr34nn.github.io/feed.json"><link rel="stylesheet" href="//fonts.googleapis.com/css?family=Mulish:300,300italic,400,400italic,700,700italic%7CFredericka%20the%20Great:300,300italic,400,400italic,700,700italic%7CNoto%20Serif%20JP:300,300italic,400,400italic,700,700italic%7CNoto%20Serif%20SC:300,300italic,400,400italic,700,700italic%7CInconsolata:300,300italic,400,400italic,700,700italic&display=swap&subset=latin,latin-ext"><link rel="stylesheet" href="/css/app.css?v=0.2.5"><meta name="keywords" content="出题记录"><link rel="canonical" href="https://dr34nn.github.io/2022/11/07/Windows7%E5%86%85%E5%AD%98%E5%8F%96%E8%AF%81%E5%87%BA%E9%A2%98%E8%AE%B0%E5%BD%95/"><title>Windows7内存取证出题记录 - 取证 - MISC | Dr34nn = MISC</title><meta name="generator" content="Hexo 6.2.0"></head><body itemscope itemtype="http://schema.org/WebPage"><div id="loading"><div class="cat"><div class="body"></div><div class="head"><div class="face"></div></div><div class="foot"><div class="tummy-end"></div><div class="bottom"></div><div class="legs left"></div><div class="legs right"></div></div><div class="paw"><div class="hands left"></div><div class="hands right"></div></div></div></div><div id="container"><header id="header" itemscope itemtype="http://schema.org/WPHeader"><div class="inner"><div id="brand"><div class="pjax"><h1 itemprop="name headline">Windows7内存取证出题记录</h1><div class="meta"><span class="item" title="创建时间：2022-11-07 00:00:00"><span class="icon"><i class="ic i-calendar"></i> </span><span class="text">发表于</span> <time itemprop="dateCreated datePublished" datetime="2022-11-07T00:00:00+08:00">2022-11-07</time></span></div></div></div><nav id="nav"><div class="inner"><div class="toggle"><div class="lines" aria-label="切换导航栏"><span class="line"></span> <span class="line"></span> <span class="line"></span></div></div><ul class="menu"><li class="item title"><a href="/" rel="start">Dr34nn</a></li></ul><ul class="right"><li class="item theme"><i class="ic i-sun"></i></li><li class="item search"><i class="ic i-search"></i></li></ul></div></nav></div><div id="imgs" class="pjax"><ul><li class="item" data-background-image="https://tva4.sinaimg.cn/large/6833939bly1gipeun65urj20zk0m81ii.jpg"></li><li class="item" data-background-image="https://tva4.sinaimg.cn/large/6833939bly1gipeyhsblkj20zk0m81kx.jpg"></li><li class="item" data-background-image="https://tva4.sinaimg.cn/large/6833939bly1gipeu7txpzj20zk0m81kx.jpg"></li><li class="item" data-background-image="https://tva4.sinaimg.cn/large/6833939bly1gipeyvx1d4j20zk0m8hdt.jpg"></li><li class="item" data-background-image="https://tva4.sinaimg.cn/large/6833939bly1giph47e9vtj20zk0m8x6l.jpg"></li><li class="item" data-background-image="https://tva4.sinaimg.cn/large/6833939bly1gipew8gmvyj20zk0m87wh.jpg"></li></ul></div></header><div id="waves"><svg class="waves" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 24 150 28" preserveAspectRatio="none" shape-rendering="auto"><defs><path id="gentle-wave" d="M-160 44c30 0 58-18 88-18s 58 18 88 18 58-18 88-18 58 18 88 18 v44h-352z"/></defs><g class="parallax"><use xlink:href="#gentle-wave" x="48" y="0"/><use xlink:href="#gentle-wave" x="48" y="3"/><use xlink:href="#gentle-wave" x="48" y="5"/><use xlink:href="#gentle-wave" x="48" y="7"/></g></svg></div><main><div class="inner"><div id="main" class="pjax"><div class="article wrap"><div class="breadcrumb" itemscope itemtype="https://schema.org/BreadcrumbList"><i class="ic i-home"></i> <span><a href="/">首页</a></span><i class="ic i-angle-right"></i> <span itemprop="itemListElement" itemscope itemtype="https://schema.org/ListItem"><a href="/categories/MISC/" itemprop="item" rel="index" title="分类于 MISC"><span itemprop="name">MISC</span></a><meta itemprop="position" content="1"></span><i class="ic i-angle-right"></i> <span class="current" itemprop="itemListElement" itemscope itemtype="https://schema.org/ListItem"><a href="/categories/MISC/%E5%8F%96%E8%AF%81/" itemprop="item" rel="index" title="分类于 取证"><span itemprop="name">取证</span></a><meta itemprop="position" content="2"></span></div>

1<article itemscope itemtype="http://schema.org/Article" class="post block" lang="zh-CN"><link itemprop="mainEntityOfPage" href="https://dr34nn.github.io/2022/11/07/Windows7%E5%86%85%E5%AD%98%E5%8F%96%E8%AF%81%E5%87%BA%E9%A2%98%E8%AE%B0%E5%BD%95/"><span hidden itemprop="author" itemscope itemtype="http://schema.org/Person"><meta itemprop="image" content="/images/avatar.jpg"><meta itemprop="name" content="Dr34m"><meta itemprop="description" content=", "></span><span hidden itemprop="publisher" itemscope itemtype="http://schema.org/Organization"><meta itemprop="name" content="MISC"></span><div class="body md" itemprop="articleBody"><p>最近为了准备 ISCTF 的套娃题，想起来可以外层套一个取证的皮，但是本来的环境因为电脑重装就无了，所以重新用虚拟机搭了一个 Win7 的环境，然后遇到了几个之前遇到过的问题，那个时候没有记录，导致配环境浪费了很多时间，这边就小小的记录一下吧。</p><h3 id="写在开头"><a class="anchor" href="#写在开头">#</a> 写在开头：</h3><p>win7 取证的话，硬盘容量建议开大一点，给 25g，他自身好像是占了 13g，然后一些补丁后续要加，我尝试了 20G，容量不够，25G 就足够的空间了</p><h3 id="step1环境镜像"><a class="anchor" href="#step1环境镜像">#</a> Step1: 环境镜像</h3><p>​	我使用的是 VMware 搭的虚拟机，去官网下的镜像，这边就直接放一篇博客了，<span class="exturl" data-url="aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxNjQ5MDAxL2FydGljbGUvZGV0YWlscy8xMDU5ODkxNzMjOn46dGV4dD0lRTklOTUlOUMlRTUlODMlOEYlRTclOUElODQlRTQlQjglOEIlRTglQkQlQkQlMjAlRTclOTklQkUlRTUlQkElQTYlRTclQkQlOTElRTclOUIlOTglRTUlOUMlQjAlRTUlOUQlODAsJTI4JUU1JUI3JUIyJUU0JUI4JThCJUU4JUJEJUJEJUU1JUE1JUJEd2luZG93c3M3JTIwNjQlMjklM0ElRTklOTMlQkUlRTYlOEUlQTUlRUYlQkMlOUFodHRwcyUzQSUyRiUyRnBhbi5iYWlkdS5jb20lMkZzJTJGMWpQanFJVElfVTlmNXYzdG5pczFGLWclMjAlRTYlOEYlOTAlRTUlOEYlOTYlRTclQTAlODElRUYlQkMlOUFyYmg0">参考博客</span>，镜像版本选取什么应该大抵是没什么问题的，实在要参考的话，我这边选择的是这款，怎么有两款，忘了是哪款了，自己试试吧，应该是 64 位的那款。</p><p><img data-src="https://img-blog.csdnimg.cn/df339ed69054455c9386a0cfe2774bcc.png" alt=""></p><h3 id="step2sp1问题"><a class="anchor" href="#step2sp1问题">#</a> Step2:SP1 问题</h3><p>​	出题最主要的就是问个 SP1 问题了，为什么捏，因为我想安装 vmtools，否则我的附件以及 dump 出来的内存镜像无法从虚拟机中导出来，看了网上几篇《很老》的教程，都是千篇一律的从微软官网下载补丁，然后移进去，然后安装补丁就好了，很简单，但是他们好像忽略了一个问题，没有 vmtools，我根本移不进去啊（不知道是不是我虚拟机的问题）。凭借一个 misc 手的直觉，我最后发现了一个很好地方法，就是使用 UltraISO。</p><p><img data-src="https://img-blog.csdnimg.cn/0d0f9fddff0c407d932a90cb030c7073.png" alt=""></p><p>我们可以把自己想要传入到虚拟机中的东西，用 Ultra 打包成 iso 镜像，然后直接丢进去。</p><p>ps: 试过插 U 盘，但是报错 U 盘无法解析</p><h3 id="step3具体解决方法"><a class="anchor" href="#step3具体解决方法">#</a> Step3: 具体解决方法</h3><h4 id="1-创建iso镜像"><a class="anchor" href="#1-创建iso镜像">#</a> 1、创建 ISO 镜像</h4><p><img data-src="https://img-blog.csdnimg.cn/ebaca264a0f24239ac2b0a5b90984d89.png" alt=""></p><p>我们将自己想要移到虚拟机中的文件移动到右上方的地方，就直接点住图标拖过去就行，然后点左上角直接保存即可</p><h4 id="2-导入镜像"><a class="anchor" href="#2-导入镜像">#</a> 2、导入镜像</h4><p>然后我们打开 VMware win7 的虚拟机，导入 ISO 镜像即可</p><p><img data-src="https://img-blog.csdnimg.cn/ed075b65b5b5457c986e52823ad30bb1.png" alt=""></p><p>然后就打开虚拟机就可以啦</p><h4 id="3-打开文件"><a class="anchor" href="#3-打开文件">#</a> 3、打开文件</h4><p><img data-src="https://img-blog.csdnimg.cn/9bafc0912ea34883a825805280ecb389.png" alt=""></p><p>打开驱动</p><p><img data-src="https://img-blog.csdnimg.cn/00cc92862c99464c9af78eec8553292e.png" alt=""></p><p>将里面的内容移到桌面上就好了</p><h3 id="step4打补丁"><a class="anchor" href="#step4打补丁">#</a> Step4: 打补丁</h3><p>这边有两个补丁要打，一个是更新程序？还有一个就是 sp1</p><p>可以自己去官网下，链接自己找，用 IDM 下很快，或者用我的百度网盘（没会员就不怪我了奥，大小 1.4G，体验 30s 应该也可以下一大部分），顺便把 dump.exe 也给啦，一个 32 位的，一个 64 位的，自己对应版本使用即可</p><p>链接：<span class="exturl" data-url="aHR0cHM6Ly9wYW4uYmFpZHUuY29tL3MvMXI1QWNWOXo3VXhWMy1TZGpkRk5hWUE/cHdkPXl2NG0=">https://pan.baidu.com/s/1r5AcV9z7UxV3-SdjdFNaYA?pwd=yv4m</span><br>提取码：yv4m</p><p>然后我记得好像是先装 exe 那个？无所谓，自己都试一试，两个装完之后就可以快乐地安装 vmtools 了。</p><h3 id="step5开始出题"><a class="anchor" href="#step5开始出题">#</a> Step5: 开始出题</h3><p>我这边是设置了两个考点，一个是开机密码是 flag123456，他是以 hash 存储的，是可以解出来的。还有一个就是桌面上的文件</p><p><img data-src="https://img-blog.csdnimg.cn/46ecf0a6d99546e89cced2e087f87fbc.png" alt=""></p><p>把你想要的东西放在桌面上，进阶一点，你可以在你的命令行里打一些命令，或者在你的剪切板，ie 浏览器里访问一些网站，这些就靠你自己去尝试啦。最后运行 dumpit.exe 就好了，直接拖到终端运行即可</p><p><img data-src="https://img-blog.csdnimg.cn/3df1c2b4048f42a98b5388b592d608a9.png" alt=""></p><p>然后按下 y，一个题目就出好咯，可以去欺负小新生了，下班！</p><div class="tags"><a href="/tags/%E5%87%BA%E9%A2%98%E8%AE%B0%E5%BD%95/" rel="tag"><i class="ic i-tag"></i> 出题记录</a></div></div><footer><div class="meta"><span class="item"><span class="icon"><i class="ic i-calendar-check"></i> </span><span class="text">更新于</span> <time title="修改时间：2022-11-07 21:47:28" itemprop="dateModified" datetime="2022-11-07T21:47:28+08:00">2022-11-07</time> </span><span id="2022/11/07/Windows7内存取证出题记录/" class="item leancloud_visitors" data-flag-title="Windows7内存取证出题记录" title="阅读次数"><span class="icon"><i class="ic i-eye"></i> </span><span class="text">阅读次数</span> <span class="leancloud-visitors-count"></span> <span class="text">次</span></span></div><div class="reward"><button>

1<i class="ic i-heartbeat"></i> 赞赏</button><p>请我喝[茶]~(￣▽￣)~*</p><div id="qr"><div><img data-src="/images/wechatpay.png" alt="Dr34m 微信支付"><p>微信支付</p></div><div><img data-src="/images/alipay.png" alt="Dr34m 支付宝"><p>支付宝</p></div><div><img data-src="/images/paypal.png" alt="Dr34m 贝宝"><p>贝宝</p></div></div></div><div id="copyright"><ul><li class="author"><strong>本文作者： </strong>Dr34m <i class="ic i-at"><em>@</em></i>MISC</li><li class="link"><strong>本文链接：</strong> <a href="https://dr34nn.github.io/2022/11/07/Windows7%E5%86%85%E5%AD%98%E5%8F%96%E8%AF%81%E5%87%BA%E9%A2%98%E8%AE%B0%E5%BD%95/" title="Windows7内存取证出题记录">https://dr34nn.github.io/2022/11/07/Windows7内存取证出题记录/</a></li><li class="license"><strong>版权声明： </strong>本站所有文章除特别声明外，均采用 <span class="exturl" data-url="aHR0cHM6Ly9jcmVhdGl2ZWNvbW1vbnMub3JnL2xpY2Vuc2VzL2J5LW5jLXNhLzQuMC9kZWVkLnpo"><i class="ic i-creative-commons"><em>(CC)</em></i>BY-NC-SA</span> 许可协议。转载请注明出处！</li></ul></div></footer></article></div><div class="post-nav"><div class="item left"><a href="/2022/07/06/vulnhub-JANGOW/" itemprop="url" rel="prev" data-background-image="https:&#x2F;&#x2F;tva4.sinaimg.cn&#x2F;mw690&#x2F;6833939bly1gipey0a334j20zk0m8qpt.jpg" title="JANGOW"><span class="type">上一篇</span> <span class="category"><i class="ic i-flag"></i> 内网</span><h3>JANGOW</h3></a></div><div class="item right"></div></div><div class="wrap" id="comments"></div></div><div id="sidebar"><div class="inner"><div class="panels"><div class="inner"><div class="contents panel pjax" data-title="文章目录"><ol class="toc"><li class="toc-item toc-level-3"><a class="toc-link" href="#%E5%86%99%E5%9C%A8%E5%BC%80%E5%A4%B4"><span class="toc-number">1.</span> <span class="toc-text">写在开头：</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#step1%E7%8E%AF%E5%A2%83%E9%95%9C%E5%83%8F"><span class="toc-number">2.</span> <span class="toc-text">Step1: 环境镜像</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#step2sp1%E9%97%AE%E9%A2%98"><span class="toc-number">3.</span> <span class="toc-text">Step2:SP1 问题</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#step3%E5%85%B7%E4%BD%93%E8%A7%A3%E5%86%B3%E6%96%B9%E6%B3%95"><span class="toc-number">4.</span> <span class="toc-text">Step3: 具体解决方法</span></a><ol class="toc-child"><li class="toc-item toc-level-4"><a class="toc-link" href="#1-%E5%88%9B%E5%BB%BAiso%E9%95%9C%E5%83%8F"><span class="toc-number">4.1.</span> <span class="toc-text">1、创建 ISO 镜像</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#2-%E5%AF%BC%E5%85%A5%E9%95%9C%E5%83%8F"><span class="toc-number">4.2.</span> <span class="toc-text">2、导入镜像</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#3-%E6%89%93%E5%BC%80%E6%96%87%E4%BB%B6"><span class="toc-number">4.3.</span> <span class="toc-text">3、打开文件</span></a></li></ol></li><li class="toc-item toc-level-3"><a class="toc-link" href="#step4%E6%89%93%E8%A1%A5%E4%B8%81"><span class="toc-number">5.</span> <span class="toc-text">Step4: 打补丁</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#step5%E5%BC%80%E5%A7%8B%E5%87%BA%E9%A2%98"><span class="toc-number">6.</span> <span class="toc-text">Step5: 开始出题</span></a></li></ol></div><div class="related panel pjax" data-title="系列文章"><ul><li class="active"><a href="/2022/11/07/Windows7%E5%86%85%E5%AD%98%E5%8F%96%E8%AF%81%E5%87%BA%E9%A2%98%E8%AE%B0%E5%BD%95/" rel="bookmark" title="Windows7内存取证出题记录">Windows7内存取证出题记录</a></li></ul></div><div class="overview panel" data-title="站点概览"><div class="author" itemprop="author" itemscope itemtype="http://schema.org/Person"><img class="image" itemprop="image" alt="Dr34m" data-src="/images/avatar.jpg"><p class="name" itemprop="name">Dr34m</p><div class="description" itemprop="description"></div></div><nav class="state"><div class="item posts"><a href="/archives/"><span class="count">3</span> <span class="name">文章</span></a></div><div class="item categories"><a href="/categories/"><span class="count">3</span> <span class="name">分类</span></a></div><div class="item tags"><a href="/tags/"><span class="count">2</span> <span class="name">标签</span></a></div></nav><div class="social"></div><ul class="menu"><li class="item"><a href="/" rel="section"><i class="ic i-home"></i>首页</a></li><li class="item dropdown"><a href="javascript:void(0);"><i class="ic i-feather"></i>文章</a><ul class="submenu"><li class="item"><a href="/archives/" rel="section"><i class="ic i-list-alt"></i>归档</a></li><li class="item"><a href="/categories/" rel="section"><i class="ic i-th"></i>分类</a></li><li class="item"><a href="/tags/" rel="section"><i class="ic i-tags"></i>标签</a></li></ul></li><li class="item"><a href="/friends/" rel="section"><i class="ic i-heart"></i>友链</a></li></ul></div></div></div><ul id="quick"><li class="prev pjax"></li><li class="up"><i class="ic i-arrow-up"></i></li><li class="down"><i class="ic i-arrow-down"></i></li><li class="next pjax"></li><li class="percent"></li></ul></div></div><div class="dimmer"></div></div></main><footer id="footer"><div class="inner"><div class="widgets"><div class="rpost pjax"><h2>随机文章</h2><ul><li class="item"><div class="breadcrumb"><a href="/categories/MISC/" title="分类于 MISC">MISC</a> <i class="ic i-angle-right"></i> <a href="/categories/MISC/%E5%8F%96%E8%AF%81/" title="分类于 取证">取证</a></div><span><a href="/2022/11/07/Windows7%E5%86%85%E5%AD%98%E5%8F%96%E8%AF%81%E5%87%BA%E9%A2%98%E8%AE%B0%E5%BD%95/" title="Windows7内存取证出题记录">Windows7内存取证出题记录</a></span></li><li class="item"><div class="breadcrumb"></div><span><a href="/2022/07/05/hello-world/" title="Hello World">Hello World</a></span></li><li class="item"><div class="breadcrumb">

1<a href="/categories/%E5%86%85%E7%BD%91/" title="分类于 内网">内网</a></div><span><a href="/2022/07/06/vulnhub-JANGOW/" title="JANGOW">JANGOW</a></span></li></ul></div><div><h2>最新评论</h2><ul class="leancloud-recent-comment"></ul></div></div><div class="status"><div class="copyright">&copy; 2010 – <span itemprop="copyrightYear">2023</span> <span class="with-love"><i class="ic i-sakura rotate"></i> </span><span class="author" itemprop="copyrightHolder">Dr34m @ Dr34nn</span></div><div class="powered-by">基于 <span class="exturl" data-url="aHR0cHM6Ly9oZXhvLmlv">Hexo</span> & Theme.<span class="exturl" data-url="aHR0cHM6Ly9naXRodWIuY29tL2FtZWhpbWUvaGV4by10aGVtZS1zaG9rYQ==">Shoka</span></div></div></div></footer></div>

1<script data-config type="text/javascript">var LOCAL={path:"2022/11/07/Windows7内存取证出题记录/",favicon:{show:"（●´3｀●）やれやれだぜ",hide:"(´Д｀)大変だ！"},search:{placeholder:"文章搜索",empty:"关于 「 ${query} 」，什么也没搜到",stats:"${time} ms 内找到 ${hits} 条结果"},valine:!0,fancybox:!0,copyright:'复制成功，转载请遵守 <i class="ic i-creative-commons"></i>BY-NC-SA 协议。',ignores:[function(e){return e.includes("#")},function(e){return new RegExp(LOCAL.path+"$").test(e)}]}</script>

1<script src="https://cdn.polyfill.io/v2/polyfill.js"></script>

1<script src="//cdn.jsdelivr.net/combine/npm/[email protected]/pace.min.js,npm/[email protected]/pjax.min.js,npm/[email protected]/dist/fetch.umd.min.js,npm/[email protected]/lib/anime.min.js,npm/algoliasearch@4/dist/algoliasearch-lite.umd.js,npm/instantsearch.js@4/dist/instantsearch.production.min.js,npm/lozad@1/dist/lozad.min.js,npm/quicklink@2/dist/quicklink.umd.js"></script>

1<script src="/js/app.js?v=0.2.5"></script>

1</body></html>