So we started off by explaining that we're essentially trying to sneak into the
club under somebody else's code,
and trying to pass ourselves off as one person altogether.
And that's essentially a DLL injection in a nutshell.
So the rest of the skill is going to be focused on trying to figure out how we
convince windows to do that for us,
to pick out a DLL that we've already implanted on the system using our previous
skills,
and go through and do a little bit of manipulation into it currently running
processed.
Well, there's a little bit of digging that we need to catch up on real quick.
Now, if you remember, we can very simply open up process manager, or task
manager here, and see all the running PIDs,
and figure out what exactly is running and all that other great stuff.
For example, here I have explorer.exe highlighted, being process ID 7744,
and this is a process that we know that's going to be running the entire time.
I point that out because it's important to know that whenever we do DLL
injection,
we have to find a process that's either going to be running or about to be
called upon to run.
We can't DLL inject into a process that doesn't exist.
So explorer.exe is definitely one of those ones that's always running.
Now, you could very well find another process that has a long runtime on it, or
is called upon quite frequently,
like a web browser or something like that.
But this definitely gets into knowing the operating system, and knowing what
processes are going to be running on set system.
Now, in the first part of our exercise, we're going to be taking a look at
running a program called
notepad. You may be familiar with it. And in order to do so, we're just going
to hit start inside the lab,
go startrun notepad.exe. Now, inside of our task manager, we can see that that
is very clearly process ID 4020.
And the reason that we need to know this information is because inside of our
library tools,
where we have the actual script.txt file, we're going to open that up and take
a look at the very first line,
where we get the actual identifying the DLLs tied to a running process.
What we want to do is for sure identify all the DLLs tied to this particular
process and do a trust but verify here.
Now, I've gone ahead and pasted the inside of PowerShell. I'm going to verify
my PID again 4020.
Yeah. And I'm going to go back and replace the bracket PID with 4020.
4020. And I'm going to hit enter. And these are all the DLLs tied to notepad.
exe, that particular process, right?
I can go ahead and close that one so that's our only version or running process
of notepad.
And you can see that 4020 is the only one running.
The reason I've done this is because I want to show you there's no tricks up my
sleeve while this is actually happening.
So we're going to inject a DLL into the running process of this just as an
example real quick.
So you can see here that these are all the DLLs that are currently running with
notepad.
I have inside the downloads folder a DLL dash injector.exe program.
And I have the link for that program and the C code for it if you want to take
a look right below this video.
And what we're doing is we're identifying the actual DLL that we're going to be
using for this
injection evil2.dll inside our share folder. And we're going to inject it. I'm
going to replace that right there.
But inside of process ID 4020 inside of our notepad.exe.
So let me go ahead and replace that with 4020.
And you can see right there that memory has been allocated at the actual
addressing space memory allocated at blah blah blah blah blah.
Hex addressing.
Now if I just hit up twice and I go to get process ID 4020 and look at all the
modules in there again.
At the bottom of the list I should see evil2.dll.
And just like that that's exactly what I see.
Now this is really important because we just performed a full on DLL injection
attack
where we've taken a running process and injected a DLL totally unrelated to
that.
Inside of the actual process ID running.
This was done for a couple of reasons.
Being able to take a DLL and inject it into a running process.
Freeze up a little bit of headache for us because now we don't have to look at
getting a whole program to run.
Inside of the actual system itself.
This requires permissions and and security features to the actual programs on
the remote systems.
And hope and pray and that they actually run some of these said programs.
Well here we just picked on the notepad.exe process ID and injected a DLL to it
.
Can we do the same thing to a process ID that's running it a little bit more
importance.
And what I mean by that is let's take a look at our task manager here.
As we zoom in you can see that notepad.exe process ID 4020 is running under the
username
learner. So whatever permissions that are executed or allowed under learner are
going to be available to
us if we're able to manipulate this.
But what if we were able to access a user or a system that had admin functions
and were able to
inject a DLL into that. Well if you look right below or above you can see a
bunch of them that say
system. And one in particular that says system is SVC host. And this might
sound familiar because
if you're in the security defense realm that's always one that's attacked.
So just as a side we're going to say bottom one 752 with the process ID SVC
host is running at
system. So we want to try to do the exact same thing for that particular
process ID and see if
we can load our DLL into it. So let's go up and see what current process IDs
are running for process
ID 752. And you can see that there's quite a bit in there. And it starts out
with SVC host
and then list all of them in there. So now let's run our same commandlet that
we did the injection
with. This time we want to inject evil two dot DLL inside a process ID 752. And
it says memory
allocated. We're going to hit up twice again to get a process ID modules list.
And we can see that
inside of that particular one that we do in fact have evil two dot DLL as
injected inside of SVC
host.exe running at service level on the system. If only there was a way to be
able to exploit this
and have a reverse shell pop up under services permissions on the actual system
itself.