One thing to remember when you're running this type of reconnaissance,
I see, pen testing line cycle, never goes away,
is to know that this is generally going to be done on a remote system.
We just happen to be looking at it from the actual system itself
and being able to prep ourselves for an attack that's going to be happening
remotely later on.
Most of these attacks will be remote as well, too.
But as we've demonstrated in some of the previous skills,
there are methods for us to be able to remote into a system,
be it through PHP manipulation or reverse shell.
However, that case may be, once we have access to the actual command line of
the system,
we can begin running some of these things that we're learning in this skill
and the following skills in the course.
So with that being said, we're going to hop on over to the actual system itself
.
And I'm going to clear screen on there for a second,
because the way that I would go about doing this
is in our script file that we have in the folder is find out which DLLs are not
signed.
And then I can do that by simply going through the script that tells us
which ones are not signed.
This one right here.
Oops, right here.
There we go.
Copy that and I need to open up PowerShell real quick.
And remember, for testing purposes only, we're going to be running PowerShell
as administrator.
Go ahead and paste everything in and run this.
And you could see we get a list of all DLLs that are on the system.
Oops, I think the wrong one.
I'm going to go with and I'm showing you my mistakes on purpose
because time is precious when we're doing these attacks.
And that could potentially cost me a system that I'm inside of.
So I'm going to see it if there are any unsigned DLLs on the system
and pasting that in there.
Copy that, paste inside the system.
There we go.
And I'm going to run this.
You will see a frame jump here as this is taking a second to run.
So after running the script, I have found one that I want to target.
And that is I'm going to zoom in for you real quick.
A system in I dot DLL.
It's not signed and it's inside of the C drive windows assembly,
native images, et cetera, et cetera.
So I have that actually opened up right here and I'm select.
I have selected the actual DLL file itself.
We'll come back to that a second.
Now I went in in my script folders to also see,
oh, click the wrong button, but I'm going to pop this up anyway.
Ran the script to see if the DLL is being ran right now as we speak
with any known processes or processes on the actual system.
And in fact, yes.
If I zoom in for you, aside from the PowerShell stuff that we're running,
you can see that there are two pins on the bottom for three, two, four, three,
nine, three, two
that are currently using that DLL library files to be able to run that those
programs.
And you can look at those inside the details of task manager or however you
decide what I want to take a look at even further is the actual signature of
the file itself
to make sure and verify that it is in fact not signed.
Now I did this using SIGCHEC and I put in the full path of the file itself.
And as we look inside of here, we can see that it's verified, unsigned,
the date that it was created, who made it though, because it is a Microsoft DLL
.
It just happens to be unsigned and it is running currently in the actual system
itself.
Now inside the folder, the reason I had that pulled up is because you can
actually
right click that and go to properties and see that there is a missing tab up at
the top
next to general.
In signed DLL or library files, we would see a digital signatures tab right
here,
but we don't write here on this one, meaning that, yep, it's unsigned.
We found one and not only did we find it on signed DLL, it's actually running
in the
actual processes of the system right now.
And we know this because of the PIDS.
So we can go and open our Prokmon.
We'll go ahead and close this and I was looking at something more ago.
And we're looking at everything that's running in the system.
I'm going to sort by PID, hopefully, and then we're looking for 4324 or, oh,
there it is right there.
And I found the process that it's actually attached to by the PID.
So I can right click on that and go to, well, if I double click on it,
I can go into processes and I can see everything else that's associated with
that too,
along with the full file path and command line of how it was invoked.
Simply, they just, whatever ran it, was the WA app agent.exe.
Now, I point all this out to show you that now I have something that's actually
running
inside of the system itself and I have selected a target.
That DLL being in the running memory on the system and used currently on that
system
is invoked at system level permissions.
We can further in skills coming up, do a DLL library manipulation, potentially,
inside of that DLL file.
And because it's not signed, it may slip past the endpoint protection or IDS or
IPS that's in place
in that environment.
If so, then we can actually inject code inside of that DLL at some point
and potentially have it just do everything that we want on the system itself,
which is why we need to truly understand in this skill why DLLs are important,
what purpose they serve and what targets we need to look at selecting for
potential manipulation
in upcoming skills.
I hope this has been informative for you and I'd like to thank you for viewing.