仿真&bypass登录密码

这里我选择用ftk打开，然后进行转换格式进行仿真

然后记录下用ftk的技巧

在evidence tree下面右键项目，有个verify Drive/image，这个可以帮助我们验证文件完整性，稍微费点时间，但是呢，我们平时使用概率不大，就是打打ctf的取证，不见得出题师傅会在制作的镜像中偷偷更改文件。所以上面这个功能做做了解即可

接下来我们需要做的是将e01镜像文件转换成vmdk格式的文件，然后绕过开机登录密码进行VMware仿真取证,有两种方式，一种是使用格式转换工具，比如StarWind V2V Convertor,操作很简单，按照上面的说明，把选项选好即可，这里就不赘叙了，因为它转换好后，依然需要我下面在wsl2的Ubuntu子系统中进行绕过开机密码操作

操作如下：

mkdir ~/mnt
ewfmount window.e01 ~/mnt    #将e01文件挂载到那个路径下，这是因为qemu-img无法直接从e01文件转换成vmdk，中间需要绕一步
qemu-img convert -f raw ~/mnt/ewf1 -O vmdk window.vmdk #需要等待，时间取决于文件大小
/*接下来是绕过开机密码的操作*/
sudo modprobe nbd  #加载Linux内核的网络块设备（NBD）模块
sudo qemu-nbd -c /dev/nbd0 window.vmdk #将vmdk文件挂载到/dev/nbd0设备上
sudo fdisk -l /dev/nbd0  #列出设备的分区表，确认分区布局
sudo mkdir /mnt/vmdk
sudo mount /dev/nbd0p1 /mnt/vmdk
sudo ntfsfix /dev/nbd0p2   #如果上一步挂载失败，报错说有脏数据，就拿这条命令彻底清除即可
sudo mount -t ntfs-3g /dev/nbd0p2 /mnt/vmdk
cd /mnt/vmdk/Windows/System32/config
sudo chntpw -i SAM  #操作Windows的注册表SAM
sync
sudo umount /mnt/vmdk
sudo qemu-nbd -d /dev/nbd0

具体交互流程就是下面这样

yolo@Yolo:~/Desktop$ mkdir ~/mnt
yolo@Yolo:~/Desktop$ ewfmount window.e01 ~/mnt
ewfmount 20140814

yolo@Yolo:~/Desktop$ qemu-img convert -f raw ~/mnt/ewf1 -O vmdk window.vmdk
yolo@Yolo:~/Desktop$ ls
docker  tools  window.e01  window.vmdk
yolo@Yolo:~/Desktop$ sudo modprobe nbd
[sudo] password for yolo:
yolo@Yolo:~/Desktop$ sudo qemu-nbd -c /dev/nbd0 window.vmdk
yolo@Yolo:~/Desktop$ sudo fdisk -l /dev/nbd0
Disk /dev/nbd0: 80 GiB, 85899345920 bytes, 167772160 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x4bb8fc9c

Device      Boot     Start       End   Sectors  Size Id Type
/dev/nbd0p1 *         2048    104447    102400   50M  7 HPFS/NTFS/exFAT
/dev/nbd0p2         104448 124579774 124475327 59.4G  7 HPFS/NTFS/exFAT
/dev/nbd0p3      124579840 166522879  41943040   20G  f W95 Ext'd (LBA)
/dev/nbd0p4      166522880 167768063   1245184  608M 27 Hidden NTFS WinRE
/dev/nbd0p5      124581888 166522879  41940992   20G  7 HPFS/NTFS/exFAT

Partition table entries are not in disk order.
yolo@Yolo:~/Desktop$ sudo mkdir /mnt/vmdk
yolo@Yolo:~/Desktop$ sudo mount /dev/nbd0p1 /mnt/vmdk
The disk contains an unclean file system (0, 0).
Metadata kept in Windows cache, refused to mount.
Falling back to read-only mount because the NTFS partition is in an
unsafe state. Please resume and shutdown Windows fully (no hibernation
or fast restarting.)
Could not mount read-write, trying read-only
yolo@Yolo:~/Desktop$ sudo ntfsfix /dev/nbd0p2
Mounting volume... The disk contains an unclean file system (0, 0).
Metadata kept in Windows cache, refused to mount.
FAILED
Attempting to correct errors...
Processing $MFT and $MFTMirr...
Reading $MFT... OK
Reading $MFTMirr... OK
Comparing $MFTMirr to $MFT... OK
Processing of $MFT and $MFTMirr completed successfully.
Setting required flags on partition... OK
Going to empty the journal ($LogFile)... OK
Checking the alternate boot sector... OK
NTFS volume version is 3.1.
NTFS partition /dev/nbd0p2 was processed successfully.
yolo@Yolo:~/Desktop$ sudo mount -t ntfs-3g /dev/nbd0p2 /mnt/vmdk
yolo@Yolo:~/Desktop$ cd /mnt/vmdk/Windows/System32/config
yolo@Yolo:/mnt/vmdk/Windows/System32/config$ ls
BBI
BBI.LOG1
BBI.LOG2
BBI{53b39ea0-18c4-11ea-a811-000d3aa4692b}.TM.blf
BBI{53b39ea0-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms
BBI{53b39ea0-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000002.regtrans-ms
BCD-Template
BCD-Template.LOG
COMPONENTS
COMPONENTS.LOG1
COMPONENTS.LOG2
COMPONENTS{53b39e63-18c4-11ea-a811-000d3aa4692b}.TM.blf
COMPONENTS{53b39e63-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms
COMPONENTS{53b39e63-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000002.regtrans-ms
DEFAULT
DEFAULT.LOG1
DEFAULT.LOG2
DRIVERS
DRIVERS.LOG1
DRIVERS.LOG2
DRIVERS{53b39e70-18c4-11ea-a811-000d3aa4692b}.TM.blf
DRIVERS{53b39e70-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms
DRIVERS{53b39e70-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000002.regtrans-ms
ELAM
ELAM.LOG1
ELAM.LOG2
ELAM{53b39eac-18c4-11ea-a811-000d3aa4692b}.TM.blf
ELAM{53b39eac-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms
ELAM{53b39eac-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000002.regtrans-ms
Journal
RegBack
SAM
SAM.LOG1
SAM.LOG2
SECURITY
SECURITY.LOG1
SECURITY.LOG2
SOFTWARE
SOFTWARE.LOG1
SOFTWARE.LOG2
SYSTEM
SYSTEM.LOG1
SYSTEM.LOG2
TxR
systemprofile
yolo@Yolo:/mnt/vmdk/Windows/System32/config$sudo chntpw -i SAM

chntpw功能很强大，可以根据用户的rid进行密码更换、清除等操作

但是很可惜，有一点是chntpw是不支持中文用户名的，这也就会导致它显示的用户列表中是找不到我想找的嫌疑人起早王的

请看，长这样

<>========<> chntpw Main Interactive Menu <>========<>

Loaded hives: <SAM>

  1 - Edit user data and passwords
  2 - List groups
      - - -
  9 - Registry editor, now with full write support!
  q - Quit (you will be asked if there is something to save)


What to do? [1] -> 1


===== chntpw Edit User Info & Passwords ====

| RID -|---------- Username ------------| Admin? |- Lock? --|
| 01f4 | Administrator                  | ADMIN  | dis/lock |
| 01f7 | DefaultAccount                 |        | dis/lock |
| 01f5 | Guest                          |        | dis/lock |
| 01f8 | WDAGUtilityAccount             |        | dis/lock |
Cannot find value <\SAM\Domains\Account\Users\FFFFFFFF\V>

Please enter user number (RID) or 0 to exit: [1] 3e9