We'll be in our lab for this one and I'm going to pull it up here real quick on
the side screen.
Ta-da! Because I have a library folder that I want you to take a look at and it
's down on the
bottom left. I can't get it. There we go. Bottom left there's a photo called
Library Tools.
And inside of here we're going to have three different tools that we'll use
throughout the rest
of the skill to be able to examine and explore those DLLs and library files to
not only check
their structure, the validity, and also to see if there are any out there that
are not signed that
we might be able to, I don't know, exploit in the next couple of skills. So
keep this in mind as we
start working through these and also do remember that throughout the rest of
the skill you'll see
the code that we use in command line, PowerShell, and the tools along with the
links to be able to
get some of these tools that are in the folder here on the lab down below all
the videos where
we refer to them. So just remember that these do exist and we'll be going
through them as the
skill continues. Now since I already have a file explorer pulled up, I kind of
want to walk you
through where we're taking a look at where the DLLs are generally stored at. We
're going to be
taking a look at this PC and do remember we are on a Windows server. But
generally what we're
taking a look at here where all the DLLs are stored at are going to be the same
kind of across the
board in modern Windows operate systems. So in Windows, we're going to go to C
drive and go into
the actual C drive Windows folder. Now there are DLLs all scattered to and all
but the ones that we
really want to take a look at that are primarily shared with other programs on
the system are in
the system 32 folder. And inside of here is you browse all the way down through
past the folders,
you'll start to see a lot of different files. And as I zoom in for you here,
you can see that most
of these are going to be DLL files along with their sizes. Now you may notice
that the DLLs themselves
are really not that big. And that's because they're chunks that fulfill the
completeness of an
as higher program that was coded in whatever language preferably C. But allow
the program to
be more concise, but have libraries on the side and pull these up whenever they
're needed.
As the skill unfolds, we'll actually be going through and seeing these DLLs
locked into the
program as they're used and be able to identify if some of them are actually
shared amongst different
programs. Remember we did mention that some libraries are preloaded in Windows
for third party
software developers to be able to use those libraries to make their coding
concise. You may refer see
these referred to as SDK packs. They're developer tools that allow third party
software developers.
Let's say like in previous skills when the ability to develop a compression
utility, for example,
with when and use the DLLs within the Windows operating system so that the
overall package itself
is not bloated with extra files that already exist on the host system. Now this
is done for not only
Windows here that you see, but also in POSIX based operating systems like Kali
and Ubuntu.
But we're primarily going to be taking a look at Windows in this skill because
as history has taught
us DLLs are more susceptible to attacks than in the Windows platforms than they
are in the POSIX
based systems. And a large part of that is because DLLs have that dot DLL on
the end of them, meaning
that in Windows operating systems files are generally identified one of two
ways. But primarily
with the file extension. If I go through and change the file extension on a DLL
, Windows is going to
panic. Whereas in POSIX based systems, it's done by the magic number in the
front header of the actual
file itself. So you can put any kind of file extension you want on it. It could
be a bitmap
on a library file. But as long as the magic numbers inside of the actual file
header themselves
identify that it is a library type file in that operating system, it's going to
act as such
regardless of the naming scheme. Just keep that in mind that that's why people
like to go and attack
DLLs is because they're easier to find. When we later on in this course, when
we start pivoting
into a system and going into the file directory of what the operating system
has to offer,
you'll see that you could search for aster.tll and most of them will come up.