We're inside of our Kali box and I'm going to zoom in for you here real quick.
You can see that we have our MSF console opened up.
We're using our payload of Windows X64 meter preater and reverse TCP.
I have the option set for this being our listener on 0.53 port 4444.
And I've done everything except for actually start the exploit for the listener
.
Now the reason I've done this is is because if you remember we've created some
very evil DLLs.
They're inside of our share folder inside of our Hyper-V host.
And both of them are set evil and evil two are set at 0.53 4444 as far as the
reverse TCP shell for us to be able to exploit.
We're going to inject this one of these DLLs inside of a running process and
see if it triggers the actual reverse shell for us to be able to go in and
manipulate.
So let me go ahead and zoom out real quick and pop on over to our PowerShell
prompt here.
We're using DLL injector evil dot dll on process 5392.
Now process 5392 is the actual notepad that I just opened up blank nothing to
it.
I just needed a running process I can mess with that wouldn't crash the VM.
And I verified that by simply going inside of task manager and making sure that
I can see the actual pit assigned to notepad.exe.
We know we can inject but when we inject a DLL that actually has a payload
attached to it, will it execute?
Well, I'm going to move this right here and this right here and I'm going to go
back into Cali real quick and type in exploit to go ahead and start our
listener.
And once our listener has been started, I'm going to go in and execute the
actual DLL injection.
And you could see just like that that once the memory was allocated and the DLL
was loaded into
the process of 5392 that on the right side our reverse shell opened up.
So just like that by having a DLL crafted an MSF venom that was set with that
payload that we did from the last two skills,
we were able to inject it in a running process without disrupting the flow of
traffic for the system overall
and have the payload act accordingly to what we needed it to do.
So now this is a whole other feature or yeah feature for us
exploit for the actual system that we're targeting and now we're able to go in
and
do everything that we're able to do like we were before with our reverse shell.
Doing so we can go in and do a who am I? Oh, I'm sorry.
Do a DIR real quick.
And one of the other commands and this is kind of a bonus that I wanted to show
you here is that
before we've been kind of just doing a quick directory listing to make sure
that we can see
everything inside of our reverse shell on the target system.
However, we're really limited in options as far as it goes to actually
exploiting the target system.
So we want to make use of the DLL injection here and go a little bit further
and see if we can invoke
actual commands. In order to do this, one of the things that we can do is load
PowerShell.
And once we see that the loading the extension of PowerShell has been
successful,
we can actually go ahead and type PowerShell shell or PowerShell underscore
shell and I'll have these
below for you. Press enter and you could see there that I'm already met with a
PS and a Pacman sign.
And what this does is it opens up full functionality of PowerShell on the
remote system.
How do I know? Well, I can simply do a DIR and get a normal directory listing
now and I can go
further and say who am I? And it tells us who we are now that full
functionality of commands on
that remote system have been enabled. Now I do this in PowerShell, load the
PowerShell,
use the shell inside of that because this gives me more functionality than what
I actually get
out of regular command prompt because I'm limited to our basic DOS commands.
Yes, who am I? Is a
DOS command, but inside of PowerShell, I can run other commandlets inside of
there.
For instance, if I wanted to say let's say get - local and I keep forgetting
tab doesn't work
inside of this and I guess I'm doing that to show you my mistakes so that way
you don't make them.
Get - local user and I can get all the users that are built into the actual
system itself.
Really, we're starting to bleed into the first parts of enumeration of the
actual system itself,
but this is on a local system. We'll be getting into Active Directory, don't
you worry. But this
is just an example of how you can eject a DLL inside of an actual running
process and not cause
any disruption in the process overall.