So we're in our Kelly box and I have actually already moved this over to the
Windows system just like we stated in the last part of the skill. I've done
that by
moving it over. I have a mount folder if you're true enough you'll find it.
And what we're doing is taking a look at the evil dll that's been moved over to
the
Windows system. Now one thing I want to point out here more than anything else
is that
the host VM on this system actually has its default window security turned on.
We know this because we can actually go to the bottom left go to start and go
into settings
and go into what just type in security. Now there is a reason that I want to go
through all this
and it's because it ties into actually replacing the dlls on this actual system
.
You can see there that device security is up to date everything's turned on.
Let's check this app
in browser control because reputation based okay and then firewall network
protections
turned on. Everything's generally turned on to defaults. This is really
important because when
we start replacing dlls on the system we mentioned in the previous skill that
we want to start looking
at unsigned dlls. Now you can very well take this evil dot dll and rename it
and replace it to
one of the ones that we found in the last skill that's unsigned. But if we
start putting too much
code in here or we try to replace one that is signed we start getting alerts
from windows and the
cautionary systems the built-in IPS are host based intrusion prevention system
that a core system
file has been tampered with is tamper protection for those files and that's why
we were verifying
that all the windows security's turned on because as you can see the dlls there
and nothing has been
done to it. But if we go back in our calibox for a second there is one thing or
a couple things I
want to show you. You can right click on the actual evil dll and go into
properties
and go into the actual check some tabs. I'll show you here that there is a
check some tabs
right there and when you go inside of there you can see that there are all the
hashings for
in the ones that are checked are the default ones. MD5, SHA-1, SHA-256. We're
going to right click
and go to copy digest and we're going to go over and open up a new window here
real quick because I
have one already pulled up and I won't expose my answers just yet. We're going
to go to virustotal.com.
Now we've used this previously in this course and this is just a decently quick
way for us to be
able to go in and test files or IPs or actual hashing to see if anything comes
up. I'm going to
zoom in and show you here that in the search bar you can type in URL IP domain
the FQDN
or the actual file hash itself. We're going to type put in the file hash that
we got from the
check some tab and we're going to do a search on it and you may notice that it
does come up but
originally didn't the reason it came up is because I uploaded the file on there
. My bad.
But and that's in the second tab right here. Right here. I uploaded the file
because I wanted to see
if virus total would actually pick up what was inside of it and you can see
that along with the
actual file itself above EBA DLL is that entire hash that we just did the
search for.
And now that that files up there on virus total if you did the exact same thing
it got the exact
same hash for whatever reason this would pop up as well and you can see all
these alerts in here.
Now all this is based on the actual contents of the DLL itself and even though
virus total now
knows about it the definitions on the Windows system here where EBA DLL is at
does not know because
the hasn't been updated in the definitions for the Windows host base protection
or that endpoint
protection system that's by default. That's really good for us pen testers
because now we have a DLL
that we can put inside of system folders or basically just hide it and be able
to move this
around as we see fit and avoid detection based on the contents of the file. And
again if we were
to mess with one that was signed and try to replace it we'd be able to replace
it but then we would
get an error or a pop up on the host system stating that the original DLL or
system file has been
tampered with in some way alerting the user. Now as pen testers go this is
going to happen every
now and then but it's important for us to remember that we are trying to be as
discrete as possible
when we're replacing these. Now leaving this on the actual desktop because it's
in the desktop
share folder on the host VM we'd want to try to hide this a little bit better
so I can actually
copy this instead of cut. Let's go into my computer and inside of Windows
Server I have to remember
where this is it's going to file explore. We're going to go down to C drive
inside of our Windows
folder. Now this is an administrative restricted folder so if we try to paste
anything in here
it may or may not depend oh it did. So it's in C drive windows now and it did
it without
giving us any errors. Now granted we are logged in as somebody with
administrative privileges
but this is something that we can do also using those previous skills and
making sure that we're
able to manipulate the file system using many of those exploits that we had
like PHP for one of them.
But now we have C drive windows evil DLL so even if I deleted this right here
we still have it in the actual file system itself and because it's in one of
those
system protected folders and we successfully put it in there it's basically
invisible to the
actual user themselves and if you had something like semantic endpoint or Mc
Afee and you ran the
scans on here the only reason it would pop up is because just like what Virus
Total said
it's looking at the contents of the actual file itself and seeing that there is
a shell code
commandlet in there specifically as I zoom in here for us Trojan.Marte shell
code and if you go through
the explanations of the different code vendors analysis you'll see a couple of
them in there
talking about Metasplight because this was generated using MSF Venom and that's
just one of many ways
that you can go through and start doing this. I did it through Kali inside of
the mount command
and you could do it through that or you could do it through one of the many
methods that we've
talked about sending files over back and forth. You could even embed this
inside of one of those
macros from the Office macro skills. Now once that we have it over and we have
a way for us to be
able to actually have it in system the next question is how exactly do we get
it to run on the system?
Well there's one of two ways that we'll be discussing the next part of the
skill and I'm
going to tell you that one of them is basically renaming it to something that's
already going to
be called up inside the system but now that we have the basics out of the way
on that the creation
and again ready for us to be able to run it the one thing that we do need to do
is set up a
listener for us inside of actual Kali because whenever this DLL is activated we
need to be able
to get ready to listen to it.