But now we get to knobsleds.
But first, let me explain what a knobsled actually is.
Because even though it's addressed as a tactic of Metaspoint,
the books that you may go through don't exactly explain what a knobsled does.
And there's a couple of functions.
We're going to go cover two of the main ones.
The first one is that programs, when they're executed or run,
whether they're calling up a library like a DLL into said program,
take up a portion of memory, the RAM, right?
And so that RAM also is required to process inside the CPU.
So it takes up a little bit of the processing power.
Now, RAM usage percentage-wise based on the size of the file
is not proportionate to what actually processes in the CPU.
The reason for that is, is that you may call up a 2 gigabyte executable
file inside the RAM, but the processing power isn't that much
because it's doing it line by line.
It doesn't really need to do a lot at that time.
Now, if you start calling it like graphics into it and stuff like that,
you may see CPU usage go up.
The core relation to this is that there
is a defined space of processing allocation per what's being run or executed
inside the actual program.
And that allocation of space is called a buffer.
Now buffers come in different forms.
You chop buffers up and have different segments of buffer,
but you have a buffer sectioned inside of the CPU
to be able to allocate processing, allocate of power and usage
for this particular program.
That's the basics of it.
So what a knop sled does in this particular instance,
a knop sled will go into the program that's inside
of the actual processing or ID, the PID, in that allocation
and run endless amounts of basic zeros or knobs
to basically run out the buffer that's been allocated to this processing power.
And it creates a buffer overflow because now you have all this other stuff
that needs to be inside of that buffer and it spills out on the end,
full cup analogy, put too much water in the cup, it's going to spill over.
Well, due to that overflow happening,
there's a possibility to inject code inside that knop sled at the end up.
So you're basically creating an overflow, the processor's trying to fix set
overflow
and you inject code inside of that buffer at the end
with the knop sled getting you there, and then it just executes
that tidbit of code caused by the knop sled.
The other reason that we do knop sleds is just to mess up people
because it's increasing the processing requirements of the system itself
and can send it into a weird kind of state.
Now on a computer system like what we're looking at right here
through our desktop or laptop, buffer overflows and knop sleds
creating processor over usage will just make your system really slow.
And if you're on older versions of Windows and Linux,
you may actually shut it down or blue screen, right?
Well, think about this in network devices.
Most network devices go into what's known as a fail open state
if they process too much or have too much going on and they go and they crash.
And the reason they go into a fail open state usually
is because when that network device fails, you don't want all traffic to just
cease.
So knop sleds in the instance of targeting network devices
doesn't really have to have or need a bit of code to be injected in there.
We could just be overflowing the processing capabilities upset network
advise and sending it into that fail open state because once it's failed open,
it's got too much going on to deal with inside the CPU processing
and can't perform ACL checks because it's tapped out for resources.
Now, what you're going to see in the next part of this video is a teaser for
you
for later in this course.
We're created later on in this course,
DLLs to be able to inject inside of a running process for the sole purpose
of being created a knop sled and demonstrating how one would actually raise
CPU power or allocation.
So let's go over to the side screen real quick and I want to make sure that you
understand what's open and what we're taking a look at to see everything.
I have Task Manager opened up showing processing on the actual system
that we're taking a look at moving over just a little, not that far.
That way we can see the process has go.
We're starting off inside of Metapreater.
You may notice I did a frame jump here because I have a couple of things I want
to show you.
But we're going to be using our inline capabilities to be able to run this
because we have a file that we sent over to the other side called sled.dll.
Now, again, this is teaser for all the DLL skills that are coming up inside
of this particular course.
Just one in particular, you're going to like it.
So let me show you the DLL code first.
It's written in C.
The reason is is because this is a very straightforward DLL file that does
nothing
but do while one return true.
So it's going to keep going because there's no parameters to tell while to
actually stop
it's loop.
Now is this going to kill the system that we're working on for the host VM?
No.
But you will see a spike in CPU usage when this DLL is activate ended.
Now, I exported it using the GCC here on the Kali system.
And again, that's coming up in the DLL skill.
I'm just kind of giving you the filler to get you excited for that skill.
Now, once that DLL is made, I copied it over to the host system.
You can see that here on the left side where I have sled.dll.
And another point that you'll learn inside of those DLL skills later on is that
you can
actually invoke a DLL file regardless of what it is with run DLL32.exe out of
the system
32 folder.
And that's exactly what we're going to do inside.
As you can see up there, MSF console using our capabilities with that reverse
shell.
So we're going to sessions - see the command itself.
And we're going to tell it from the system 32 folder full path run DLL32.exe.
The actual pathing of the DLL file, you'll notice on the end that you see start
comma
start CPU stress.
And that's because that's the name of the module as I have the C code below
that you
can see start CPU stress is on line four.
That's the actual DLL module that's going to be invoked inside the running
processes.
So all that to tell you this, we're going to run this and you can see the CPU
usage on
the side right here going pretty static right now.
And we're going to run that DLL that we created with that knop sled.
Just for the purposes of running up the CPU usage.
So as soon as we press enter, you see on the right side, there's a significant
jump in
CPU utilization.
Actually be up there.
And if I were to run it again, control C break that session - C command, just
hit up, run
it again.
And you can see that we have yet another jump pointing with this hand.
And that jump is significant because at some point, and depending on how you do
your C code
or your DLL manipulation, you can actually make the knop sled be really big.
But what this is doing is using run DLL32.exe to show you that you can actually
increase process
utilization for something that's launched inside the process already that has a
finite
buffer predetermined already.
And we'll definitely be getting into knop sleds and how to inject code and
command injection
later on in this course.
That's just a bit of information and teaser in an example on how to use it.
And inside the lab, you will have access to sled.c and sled.dll on the desktop
of the
Kali system.
Should you want to take a more deeper look at that code?
Now, straight to the point, that's how we wrap everything up inside of Metaspl
oit in terms
of tactics.
And just with these tactics and the previous skill where we talked about the
fundamentals
of being able to use MSF Venom and MSF Console, you too can now continue to go
on and play
Metasploit tactics and all the other versions to come after that, even though
they said
they'd stop it dead.
[BLANK_AUDIO]