Now you may be wondering what is DLL injection?
Oh, I'm glad you asked.
And that's what the skill is for.
DLL injection is basically a method of us
taking one of the DLLs that we've
created in the previous skills and injecting it
into a running process.
Now that means that we are bypassing the run DLL 32.exe
that we did in the previous skill.
And we're relying upon a program that's already
running in the system to call upon the DLL itself.
So we're not actually injecting code into a DLL file.
That's a whole bolligarn on its own.
We're just saying, hey, we really
would like for you to run this DLL and call upon it
as a library because you really need it.
And then boom, surprise.
It's an attack, right?
Well, let's review real quick.
As we take a look at our lab here,
we know that inside the actual task manager,
we get just a list of all the executables that are being
ran inside of the system overall.
This allows us to be able to get an idea of where we can actually
get that DLL injected to because any one of these processes
can call upon a DLL as needed.
Now, it should go without saying here
that you would want to get a DLL injected into a program that
is either currently in use or is used relatively a good bit,
used a good bit.
So if you put a DLL injection inside of a browser,
it could be that they close the browser or don't use it.
And therefore, it's not actually loaded in this system
running processes and doesn't ever get called upon.
We'd want to use it against something that's pretty common.
Now, we could target explorer.exe
because that's always running.
And we can look at some other programs on here
that are always running as well.
But do know that any time that you inject in DLL
into a running process, this is going to probably trigger
some red flags for the operating system overall.
Now, you could take a look at here, as we learned in our--
when we were going in scripts, learning about DLLs
and their usage on the system, you
could see where all the DLLs are being used at
and the processes that are actually utilizing those DLLs.
So what that means is that these are already in the system
called up and being utilized by the operating system itself.
We just need to be able to find a way to take our malicious DLL
file that we create and poke it inside of this running list
using what we have here in our task manager.
So now that we know what's actually going on,
how do we go about doing this?
Well, the first part is we actually
have to create the malicious DLL.
And we did that in the previous skill.
So based on the payload that was assigned to our DLL that
was in use, if we go into the Share folder
on that virtual machine, Hyper-V,
we have evil.dll and evil2.dll that we have readily available
for us to be able to utilize to try to inject
into that running process.
Now, some of the bells and whistles
that we talked about that could be alerted
are Windows operating system itself,
depending on the endpoint protection settings
that you have and other third party solutions like Symantec
or Maccafee could say, hey, I don't recognize this file
because it lacks signature.
But we've seen DLLs be in the operating system
even issued by Microsoft that don't have a digital signature
with them.
So we know that it's a possibility.
It could be that once that DLL is loaded,
that the code itself within the DLL that we created
triggers an alert saying that a backdoor channel
has been created.
Well, that's always a possibility
whenever we're trying to pen test.
But the point behind this is that we're creating something
malicious, we're trying to slip through into the nightclub
without the bouncer recognizing us under the jacket
of somebody that's already been allowed to enter the nightclub.