Before we wrap this one up, there's one last thing that I kind of want to go
over real quick.
And that is covering our tracks, so to speak. We're not getting into evasion
tactics just yet,
but this is something I really want to point out. And that is we have phantom
pits that are floating around for processes that are actually locked into place
and not truly
closing. This is a dead giveaway that something's not right in the actual
system itself and a way
for system administrators and that blue team to actually go through and see if
something's actually
a foot or not. There's basically doesn't smell right. So what we're taking a
look at here is on the
host system, the host VM system, and we're going to zoom in for you real quick.
You can see that I
have two instances of notepad running. Pid 7 5 3 2, Pid 1768. And you may be
keen to see that I
only have one notepad open and I have nothing else on the actual taskbar. Now
this obviously raises
concern if you're the administrator of the system. Now if you're a pen tester
and you're not worried
about, you know, the ramifications of something like this, that's okay too,
because not a lot of
people really check for this. It's good for us to know this because this is
another reason why we
want to hook onto a Pid that is less suspicious and not cause something like
this. Occasionally,
what will happen is is if we go in and do a DLL injection and close the actual
program like notepad
for example, the DLL is still called into memory and therefore it creates a
problem to where the
Pid and the program that's hosting that DLL gets stuck in the running process
of the system overall.
And so we've already closed out the original notepad, but while the GUI may
have been gone,
the actual DLL is locked into place. And I know this because I'm taking a look
at process 7 5 3 2,
which is the notepad open right here. And as I scroll down to the bottom and
zoom in for you,
you can see that everything looks to be kind of in order. If I go ahead and
change that to
process ID 1768, you can see that that as I zoom in, the evil DLL is open. And
it'll show you the
location of the actual file itself. Now there's further steps you can take to
see if this is actually
communicating or not, such as like MBT stat, checking, you know, Prokmon and
going in and
seeing what DLLs are actually called into system, because as we know task
manager doesn't show us
the DLLs, but Prokmon does go in and show us what's actually hooked into the
actual running memory
of the system. And this is where things get a little murky for folks like us.
If we go back over
to our task manager and see all the different SVC host processes that are
running, you can see
that there's quite a few of them. And it wouldn't be too hard to hook a DLL
onto one of those to mask
it because let's say one of those SVC hosts.exe files closes for whatever
process it's actually
running in the background. And our DLL that we've made to hook on and attach to
it is still locked
into memory and keeping the pit open. Well, unbeknownst to the average person,
this looks legitimate and
normal inside of task manager. We would actually have to see something else to
raise concern for
us to be able to dig deeper into what's actually going on. And so when we, this
is just something
I wanted to point out when we run programs and do injection and even command
injection can cause
these kinds of problems. But is it harmful to the system that we're targeting?
Not really.
Depending on the DLL that we're actually injecting, and in this case, we're
just doing a reverse
shell to the CaliBox inside of our lab. But as the complexity of that DLL grows
and along with the
actual functions that's being called up inside of that DLL, so does the
complexity of the actual
memory that's still in use because that memory is locked. It's not going to
overwrite. It's not
going to push it. Other programs are not going to push it out of the way just
because it needs
more RAM. Now, if you want to go into causing a knobsled and basically eat up
all the memory on
a system and do some other fantastic stuff, this is something to definitely
keep in mind because
we were talking about disruption a few skills back and utilizing something like
a knobsled and showing
the effect to the overall system. Again, this is just something I wanted to
point out and show
you that this is something to think about in the back of your mind.