In our last skill, we examined the ability to check out DLLs across the Windows
operating system,
check see if some of them were signed or unsigned, see what their usage was,
and how they're tied into the different programs out there.
Now this allows us to hone in and figure out what it is that we want to attack
as pen testers,
so long as it's within the scope inside of our rules of engagement.
Now DLLs are always a good target for pen testers and hackers in general,
because the Windows operating system relies heavily on additional libraries
in order to keep those executables as concise and tight as possible on size.
The smaller the program is in overall size, the less space it takes up inside
of the RAM,
and the less time it takes to actually process it. That being said, if we call
upon a new feature
or something else that wasn't in the immediate program itself, some sort of
function, if you will,
the DLL then gets called up into said program that wasn't written in the
original source code.
Now as we continue throughout this course, we will mess around with
in DLL hijacking injection and all this other great stuff into some of those
signed DLLs.
But for general purposes inside of this skill, we're going to stay away from
signed DLLs for now,
so that way we can get some good hands-on practice with ones that are just
sitting there waiting
for us to attack them. And we're going to craft some ourselves using Metasploit
as we continue
throughout, so that way we can send them over to the Windows system and see how
we can actually
get them to run in a process or without a process. And by that, I mean that
Windows has an additional
ability to run DLLs outside the scope of a program. So let's say for instance,
you crafted DLL and
you want it to be able to slip right into the operating system. Well, there is
a method inside
of Windows for those additional DLLs to be executed. And this runs natively
inside of Windows under
the command of run DLL32.exe. What this does is it allows additional things to
be called into the
Windows operating system that aren't necessarily tied into win.exe or explore.
exe. So it goes without
saying that this leaves Windows open to an attack using this method. But also
keep in mind too that
we're kind of skipping around a little bit in the pentesting lifecycle by doing
this because we're
not actually going through and do it exploits with getting to the system itself
or elevating
those permissions. Elevating permissions will come later in the course and
getting into the system
is something that we've already explored in multiple ways earlier on using our
bwap website.
Now there are other methods and we will explore those as we continue. But the
focus on this is
can we craft a DLL manipulate another DLL and get it to run inside of the
Windows operating system to
give us either a backdoor or elevated permissions on the system to be able to
go through and use
that as an attack point to expand our threat vector throughout the organization
during this
As always, good news for the experiment.