Imagine if you will that you're trying to enter a house through a single
opening that is only one foot line.
I don't know about you, but somebody like me, that might be a little bit of a
challenge where I'd have to squeeze through that one foot line opening.
And when we attack a system or a network, the less openings that a house has,
the less opportunity there is for us to be able to.
Make our way inside. Now, there's a couple of options that we have here.
We could either increase the width of that opening door from one foot to let's
say six feet wide.
I say six feet because I'm always finding myself being called upon since I own
a truck to move couches and things like that.
And I'm going to tell you a standard door just ain't fair for a regular couch.
And it's not right. Whoever designed that was just messing with us.
So we can take that door and make it six foot wide and go in and out of that
house with no problem at all.
Right? Well, what if somebody shuts the door and locks it?
Well, we only have that one single point.
Me injury, we have to worry about getting through that door.
No matter how wide the door is, if it's locked and it's secure, it's going to
be difficult for us to be able to get inside the house.
Well, there's other methods of doing that on a common house because there's
windows, there's fennelations, there's crawl space,
there's all sorts of different ways for us to be able to get inside.
And the more that those different windows and other entry points are used, the
more likely they are to be less secure because there's complacency involved.
And that's exactly where Microsoft Office falls into our spectrum of pen
testing.
Now we're beyond the actual operating system itself and we're trying to find
our way into the system through something that is very commonly used.
In our previous skill, we were using command injection to be able to penetrate
the system and potentially open up a reverse shell terminal.
Well, that worked out great for us because we were in a very controlled
environment and we had kind of a left and right limit of parameters in our lab.
Well, aside from that, that was just messing with the door.
And the operating system itself is always going to have standard checks and
balances for security measures.
So we're taking a look at my system here real quick and just taking a look at
some of the settings to kind of demonstrate what I'm talking about here, update
and security windows updates.
And you can see here that we have generally windows updates checked on an
automatic schedule.
So that's for the operating system itself.
If we go into advanced options for a windows 10 system, we can see that as I
zoom in for you right here, we receive updates for other Microsoft products
when you update windows.
Now I turned that on.
What it's talking about is Microsoft Office and that's the focus of this skill.
Office comes with many programs for us to be able to use for pin testing
purposes.
It's adding more windows and ventilation or vents to the house for us to be
able to
pin test or penetrate and go in and actually get something done and access the
system.
People are going to automatically assume because of their complacency and using
things like Word all the time that you opening up these programs in Microsoft
Office is friendly because they use it all the time.
And of course, there are other programs on the systems that people use quite
frequently, but we're really taking a look at Microsoft Office in this and I
want to apologize in advance.
We don't have a lab for this one because I can't install office on any of those
systems without a licensing.
And I don't want the trial to expire and then you'd be left out the code, but
we're going to be doing demonstrations here on the system itself.
I'm going to be using my own system as a guinea pig for you in this skill
together.