从 sqlite 中提取
我有一个从蜜罐创建的 sqlite 数据库。该数据库包含恶意软件文件。我如何从 sqlite 数据库中提取这些文件。如果有人可以帮忙请
i have a sqlite database created from the honeypot. the database contains malware files. how can i extract these files from the sqlite database. please if someone can help
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您可以使用以下命令转储整个数据库：
或者仅使用以下命令查看结构：
要获取文件，您可能需要一个小脚本来将 BLOB 提取到文件中。如果您需要帮助，请发布数据库的架构。
You can dump the whole database with:
Or just view the structure with:
To get the files, you'll probably need a small script to extract the BLOBs into files. Post the schema of the database if you need help.
sqlite3命令可以轻松询问 sqlite3 数据库，.dump命令将允许您转储给定的表，.output命令将允许您转储给定的表。让您在转储之前选择输出的文件名。如果数据来自蜜罐，请非常小心用于检查内容的工具：在终端中发现了允许恶意内容获得系统权限的缺陷。只需使用“cat”检查此类终端上的文件就可以向恶意程序授予您的完整权限集。
因此，至少请使用非特权用户帐户，无法访问系统上的其他数据。使用 AppArmor、SMACK、TOMOYO、SELinux、LIDS 等工具将您的工具限制在一小部分系统资源中也是一个好主意。虚拟化也可以发挥作用，但这些工具也带来了很多“突破”。
The
sqlite3command can easily interrogate an sqlite3 database and the.dumpcommand will allow you to dump a given table, and the.outputcommand will let you select a filename for the output before dumping.If the data came from a honeypot, be very careful about the tools you use to inspect the contents: flaws have been found in terminals that allow malicious content to gain privileges on the system. Simply using 'cat' to inspect a file on such a terminal could grant the malicious program your complete set of privileges.
So, at a minimum step, please at least use an unprivileged user account with no access to other data on the system. Using a tool such as AppArmor, SMACK, TOMOYO, SELinux, LIDS, to confine your tools to a small subset of system resources would be a good idea too. Virtualization could also work, but there have been plenty of 'breakouts' from those tools as well.