Tyler Staut
Ask or search...
Ctrl + K
Pentesting
Misc Commands
Carve out file from memory
Can use DD to recover deleted files
Previous
SSH Tunnel
Next
Powershell
Last updated
1 year ago
From
@ippsec
on twitter
Ever come across a file running on a Linux box that was deleted from the disk? Did you know you can likely use DD to recover the file without any non-standard tools?
As a bonus. You can dump other things like the heap, which in this case reveals that file was mettle (meterpreter) and where it was talking to!