Just like with the process and services that are running on the actual system,
we can also do the same with drivers and also installed software.
So we can do this inside of our same command prompt and what we're going to be doing
is another WMIC command product get name with a comma and no space version.
This will tell us all the listings of the software installed on the actual
system. But I'm going to warn you, this command takes a minute to populate.
And if you are wondering why we're doing this in command and not exactly PowerShell,
because the command in PowerShell is extremely long, I will have it in the code box below.
And it does run faster, but it's an extremely long command.
When you're doing this on your own inside of a pen test environment,
you'll be able to make text documents on your system with some of those in there already to
where you can copy and paste. But being able to do this on the fly with basically shorter
commands that you can remember off the top of your head works a lot better.
Now, right here, you can see we have an entire list of software that's installed on the system.
This comes into important practice when we're talking about looking for more vulnerabilities,
because as we dig into what's actually going on here, we can see based on this software list,
and start looking for vulnerabilities based on versioning info.
Now, I want to pick on MySQL Server 9.3. You see that the exact version is 9.30.
You could start looking through the CVE database for vulnerabilities specific to that,
along with my favorite, PHP Manager. Because we know in previous skills that PHP does have
a lot of vulnerabilities. And the way that BWAP works, in this particular instance,
there are so many out there that you can exploit. And having more detailed versioning information
on this allows you to start building that more exploitive repertoire, if you will.
Now, we can go a little bit further and start getting more driver information as well, too.
To do this, it's pretty straightforward. Driver query, one word, slash B slash F-O list.
And once I type everything out correctly, we can start getting an output of all the
drivers installed on the system to include detailed information of where that driver
is actually installed at. As an example, just to give you a real quick right here,
we're looking at module name of XInputHID, the display name, the description, and the actual
file location of where that driver is actually installed at. The reason this becomes important
is because you can actually install fake drivers on the system just as well as you can other fake
files like we've done with dummy.exe. We are just looking at different locations and potentially
also vulnerabilities in those drivers. Just like you would do with the software,
you could take a list like this and look for vulnerabilities on firmware. And if you said,
let's say you find something for a real audio player or something like that way back in the day
and saw the firmware for it, you could actually go through and start building those DLL hijackers
that we learned about earlier in the course for things just like this. Now you notice that a lot
of these are sys files because that's what the drivers are installed as on the system. Just know
it's the same type of methodology and when you're doing your MSF Venom for being able to create
those hijacker files, you could just change the output to sys files and install it as a fake
driver.