We've been through a lot with the operating systems inside of our labs throughout this course.
And one thing that we are going to start doing is taking a look under the hood.
And regardless of the operating system, whether it be Windows or a POSIX-based system,
there are services that run in the background, essentially invisible to the users, even the administrators.
These services run behind the scenes in order to perform essential and critical tasks for us,
so that way we don't have to worry about them throughout the course of our functions on the actual system.
So let's say, for instance, we're wanting to do a print.
We're in Word, we're wanting to print something out for school, and we hit print.
Well, instead of us doing direct communication with that printer and making sure that the peripherals and drivers are loaded,
there is a print spooler service inside of Windows that will basically schedule and communicate everything for us
between the word processing software and the actual printer that I have over there under Big Gold.
So for us as the user, it's as simple as hitting print and then letting the internal communications handle all those tasks controlled by those services.
Now, there are services that are assigned basically by default with the operating system, kind of like print spooler in Windows.
And there are services that are installed depending on the types of third-party software that you decide to purchase or download for your system.
It basically, you look at it like this.
Anytime there's a function that saves time and effort and deals directly with the kernel,
those services are in the background to help us kind of alleviate all the additional tasks that old school computing used to have
be involved with it.
So services did exist back in Windows 3.1 days, but not as detailed as it is now.
In addition, those services can regulate and throttle back some of the system resources that we utilize on the actual computer system.
So for instance, in our labs, we use a lot of Hyper-V virtualization.
And our main overall lab is a Windows Server Data Center.
And the services related to that make sure that we don't allocate too many resources that's out of bounds of what the actual system has.
Think physically for a second.
And we can allocate and run these different virtual machines that we practice on without overburdening the host lab itself.
In the past, we've said that if you have a physical system with eight gigs of physical RAM, you can't over allocate past that.
And that can't over allocate portion was never to say that you couldn't as far as like have six virtual machines with four gigs piece on memory.
As an example, that's 24 gigs.
You could configure it like that.
Well, if you fire all six of those virtual machines up, instead of having the system just overtax the memory that's physically installed, which is eight gigs,
your services behind the scenes would be able to throttle and control and find some way, if possible, to manage running all of those virtual machines at once.
Now they will be slow and they will perform like pond water moving through.
It's when it's just slow.
That's just just slow.
But those are the services running behind the scenes, making sure that we don't tax the system so much so that it crashes and sends us into a blue screen for over usage of resource allocation.
Now, on the side screen over here, we're taking a look at the actual task manager for my personal system.
And you can see I can have a lot of stuff running here.
And you can also see that we have a lot of CPU and memory usage along with power usage as well.
These are the resources and different items of configuration controlled by services running in the background.
And if you wanted to take a more detailed look at which services are running on your Windows system, since we're focused on Windows in this particular skill, by all means, look up above.
And on that last tab, you will see services.
We'll click on that real quick.
And you can see inside of here, these are all the services.
I have them listed in alphabetical order.
And if they are running, they have a PID assigned to them, a process ID, meaning that there is something running in the background as far as an application is concerned.
Now, just take, for instance, this one right here, the Adobe Arm service.
This is the Adobe Acrobat update service.
What this service does is basically go behind the scenes and check for updates every so often.
And if there are updates available based on the configuration of your Adobe suite, if you have it installed, it will automatically install those Adobe updates without any interaction from the user themselves.
You see right below that there is another service for Adobe update service.
So I'm assuming that the first one has something to do with Adobe Acrobat reader.
But that's without digging too far into it and just looking at the actual description of it.
But since we have that one highlighted, it's going to be PID 4432.
So moving up in our task manager, the tab to the left of services is details.
We're going to go in there and look for PID 4432.
Let's go ahead and click on that real quick and then sort by PID and look for 4432.
And I'm going to find it. I promise it right here.
And you can see that it's the ArmSVC.exe.
Now, we can and will throughout this skill start examining these services in more detail to figure out where the files are, the file path and get more information for potential exploitation.
But this is also a service that's configured by default to run its startup.
And if it didn't exist, then every time that you worked inside Adobe Acrobat, you would be expected and required based on your system policies inside of your organization to run updates yourself.
And this service allows us to be able to kind of skip that and allow for automation.
So that way it's not on the user to have this as a part of their computing task every time they log in or power up the system.
Now, in this skill, we're going to be taking a look at not only services to get a more firm understanding of what they are, where they are and how they are.
But we're also going to be taking a look at potentially exploiting services by doing some hijacking.
Because we've seen in previous skills where we've taken and created files using tools like MSF Venom and been able to send them to a target system and ran them behind the scenes using DLL hookers and going into hijack mode.
The same can be done with services depending on the types of permissions that those services have.
And that is something else that we will be examining throughout this skill.
So without further ado, let's go ahead and do it to it.