forensics folks are often called in after breachor to determine if an "incidenthas taken place at all they typically want snapshot of the affected machine' ram in order to capture cryptographic keys or other information that resides only in memory lucky for thema team of talented developers has created an entire python framework suitable for this task called volatilitybilled as an advanced memory forensics framework incident respondersforensic examinersand malware analysts can use volatility for variety of other tasks as wellincluding inspecting kernel objectsexamining and dumping processesand so on weof courseare more interested in the offensive capabilities that volatility provides we first explore using some of the command-line capabilities to retrieve password hashes from running vmware virtual machineand then show how we can automate this two-step process by including volatility in our scripts the final example shows how we can inject shellcode directly into running vm at precise location that we choose this technique can be useful to nail those paranoid users who browse or send emails only from vm we can also leave backdoor hidden in vm snapshot that will be executed when the administrator restores the vm this code injection method is also useful for running code on computer that has firewire port that you can access but which is locked or asleep and requires password let' get started