How to use the plugin？
Closed this issue · 5 comments
Hello, I see that in your project, volatility supports the use of plugins, but I can't use mimikatz
sudo docker run --rm -v ~/Downloads/:/quzheng -it sk4la/volatility -f /quzheng/mem.raw --plugins=/usr/local/lib/volatility/contrib/plugins/ mimikatz
Volatility Foundation Volatility Framework 2.6.1
ERROR : volatility.debug : You must specify something to do (try -h)
The community plugins included are those listed in the volatilityfoundation/community repository.
You can list all included plugins using the --help or --info flags (e.g. podman run sk4la/volatility:edge --plugins=/usr/local/lib/volatility/contrib/plugins --info). The loading order is non-deterministic and some plugins fail to load because of missing dependencies (some are just not on PyPI anymore) or because their design is not quite suitable for distribution, so you may need to run it multiple times for it to load the plugin you are looking for. I advise instead using each module individually in order to avoid loading dysfunctional plugins.
I am not sure which mimikatz plugin you are referring to, but for Francesco Picasso's plugin the image was indeed missing a dependency:
$ podman run --rm sk4la/volatility --plugins=/usr/local/lib/volatility/contrib/plugins/community/FrancescoPicasso
Volatility Foundation Volatility Framework 2.6.1
*** Failed to import volatility.plugins.mimikatz (ImportError: No module named construct)
ERROR : volatility.debug : You must specify something to do (try -h)Although I have updated the build, the plugin still cannot seem to load:
$ podman run sk4la/volatility --plugins=/usr/local/lib/volatility/contrib/plugins/community/FrancescoPicasso
Volatility Foundation Volatility Framework 2.6.1
*** Failed to import volatility.plugins.mimikatz (AttributeError: 'module' object has no attribute 'ULInt32')
ERROR : volatility.debug : You must specify something to do (try -h)Most of these plugins have been unmaintained for years so you may need to look into it if you want to get it to work.
Thank you, I solved the problem, I need to specify the correct profile, and the correct order of parameters, then mimikatz can be used!
Interesting, I still cannot load the plugin. It might be due to the specific Alpine Linux environment. Did you use the Docker image?
Yes, I'm using a docker build.，im search from dockerhub,and. pull it
- pip install construct==2.5.5-reupload --user
2.volatility --plugins=/usr/local/lib/volatility/contrib/plugins/community/FrancescoPicasso/ mimikatz --profile=Win7SP1x64 -f mem.raw
Next, you'll get the mimikatz results.
The version I picked was too recent. I have just updated the build, it should work out of the box with the latest sk4la/volatility:edge image.
Thank you for the heads up!