The reason we've been identifying these DLL library files and figuring out
which programs they're associated with inside of the Windows operating system
is simply to figure out what we're going to be attacking.
The more we know about these DLL files, the more we know how they interact with
programs that are being ran, and it makes it easier for us later on to be able
to inject a fake DLL, if you will, or a crafted one or a manipulated one.
Into the operating system in such a way to where the program thinks it's going
to call upon that DLL as a normal use.
Now, there are many steps along the way before we get there, but I just wanted
to point out that it's important for us to know how these library files
interact because it's not always possible to make a file that's executable or a
macro that's executable.
And send it to an unsuspecting person for them to run it.
There if you think of this as a way to be able to get into a system if another
method did not work, you need more than one way to be able to penetrate a
system or network, because not all methods are going to work every single time.
That being said, we're over on the side screen right now, we're taking a look
at process 8180.
We did this earlier in the skill because this is the explorer.exe process and
we're taking a look at all the DLLs tied to explore.exe.
And this is in our script files, which I have on the right. I'll highlight that
for you real quick. I even have that line highlighted as well.
This PowerShell script goes through based on a process ID number that we
retrieved either through PS exact or inside the task manager itself or a task
list inside a command prompt and shows us.
The actual executable first along with every DLL tied to that running process.
And we mentioned that these library files are going to be called in and out of
the running memory.
Now, one that I want to highlight here is this first one right here.
Nt dll dot dll. This is a common dll file inside of Windows and it even gives
us the path for that.
Well, if I run this again for another process ID that we have and you could see
here and I'm going to highlight it for us.
I can do it. There we go.
That this nt dll dot dll is called for process ID 8060.
So when logon.exe because right above that you can see the actual executable
that invoked the process ID.
What we have here are shared libraries. And this is a very common occurrence as
we mentioned earlier in the skill and you can see where all these are starting
to come together.
Now look, I'm lazy and I want to let you know that I don't want to go through
every process ID and mark down which DLLs are tied with what or even if I do
this in Prokmon or dependency Walker make notes.
There's a different way and more easy method to be able to do this and I've
done that inside of here.
Now I'm going to highlight on the side right here right here inside of our text
file because as you can see I have it inside of our script.txt file in the
folder for us in the lab.
And when we run this, this is not calling upon any specific process ID.
It just gives us a list of every DLL that's currently loaded in system and how
many times it's shared across the actual platform.
And as you can see, there are multiple DLLs that are shared up to 119 times
inside of our lab here.
Some of them are shared more, some of them are shared less.
Now I know this is a lot to take in as far as like the display output and all
that great stuff.
By all means, pipe it out.
But there is another method that we have on here as well that lets us hone in
on one specific DLL.
Let me open that up for you real quick.
Make sure my script file is open.
And as you can see here, I focused in on NTDLL dot DLL.
And I'm going to highlight the script.
There we go.
That's the line right there.
And now I'm going to zoom in for us.
You can see here that on the scripts, I have it show what PD PIDS, a DLL, is
associated with.
And I have the whole script in there.
You will have to change the DLL path variable depending upon which DLL that you
're wanting to inspect.
We already saw where you run a library search on those running PIDS.
And it gives you the path.
So basically you take that path and put it in here.
And then when you run the script, this is what it looks like.
Right there.
It shows you every process that this DLL is associated with.
Now I'm going to clear this up and make it a little bit cleaner for us.
There we go.
As I scroll down, you see the results.
These results are pretty important because not only does it give us the process
name, but it also gives us the PIDS that it's associated with inside of Task
Manager.
Along with the path of the DLL to make sure that it's the same all the way down
to board.
But as you can see, and I'll highlight for you right here.
That's where NTDLL is associated with Explorer.exe and verified by that PIDS 81
80.
Well, that's a lot of information to take in, but now we know that NTDLL is a
high value target in the scope of our actual pen testing if we wanted to do any
kind of DLL or library attack.
[BLANK_AUDIO]