I want to spend just a couple of minutes getting familiar with understanding where services are,
what they do, and how they're configured inside of the operating system. We're going to be focusing
on Windows in this portion of our course. We will be hitting on POSIX-based systems
here in a couple of skills. So I'm going to hop on over to the lab real quick, and I also want
to point out something real quick. I had to make a couple of lab changes. This does not affect any
of the previous skills, but this lab, while it may look a little bit familiar to you from the
previous skills, it is a little bit different, and there are some things that I had to remove.
So that way we can have ample space and storage and other resources available to us. So if you
want to practice your skills from previous skills inside of here, you may have to go back and open
up those VMs. With all that being said, on the left I have the Windows 10 system over yonder,
and then on the right, right above me, I have the task manager for the Hyper-V host that we're
actually inside of for our lab right now. So we know that our Windows 10 system over yonder is
a workstation, and the task manager above me is for Windows Server. There will be similarities
between the two as we start to go in and click on the services tab and sort by alphabet, and
for instance, you see ALG on the right and ALG on the left. As I zoom in for you real quick,
you can see both of those are right there, and there are services very similar to that that are
baselined for Microsoft. Where the difference starts to come in at is that one is a workstation,
one is a server, and it's on us to start getting more familiar with the certain aspects of how
these differentiate. Let's say, for instance, that you are in a system through some sort of backdoor,
and for whatever reason, you're only using services to distinguish what kind of operating
system you're on. Well, we're going to refresh that here in just a second, but I do want to
point out that there are some that allow us to be able to see that we're on a workstation,
and some that allow us to see if we're on a server, but that's more for those Microsoft
centered courses here on CBT Nuggets. We're just taking a look at some of these services real quick,
and we're going to be looking at, let's pick one real quick, BITS. That is the Background
Intelligence Transfer Service that is installed on all Microsoft operating systems, and its
responsibility is after Windows updates detect new updates, BITS runs in the background for
those updates to be transferred to the system so you don't have to download them manually.
If you right click on the actual service and go into Open Services, there you go,
it'll get there. It will give you the MMC or the Microsoft Management Console for services.
If you wanted to get here, you could just hit Start R and type in MMC and add the step in for
services. Now I have BITS highlighted here, and you can see that it gives a little bit more
detail on the actual name and description. Then if I move over here, the actual service itself
was just called BITS, and over here it actually has the full name for it, Background Intelligence
Transfer Service, and it has the description of it as well. Now if you double click on this,
you'll notice a couple of things real quick, and I'll zoom in so we can see that. Right here,
we get the service name, the display name, and what we really want to pay attention to
is the path to the executable and the actual startup type. Secondary to us is the actual
status because that's something we can always change whenever we remote into the system and
use the proper commands that we learned about in the previous skill. Basically, the path to the
executable is one of those files that we might try to exploit later on, and you'll notice that a lot
of services inside of Windows rely on the svchost.exe file. The only difference between BITS
and any other service that uses that same svc file is the fact that they have additional flags
following the command. For instance, here it's "-k netsvcs-p". Now you notice that the startup
type is manual, meaning that this service does not start up automatically when the system starts,
that the user has to have, or the operating system has to have some interaction with it in order to
get it going, and that interaction is through Windows Update. So if you run a Windows Update
check and you don't get any updates to download, this service will still remain stopped. But if you
do have updates to download and you start downloading them, automatically through the way
the operating system is configured, Windows Updates will send a command over to the BITS service
and start it up into manual start. And then behind the scenes, based on the configuration
in Group Policy, Registry, and all that other great stuff, BITS will download all the updates,
put them in a temp folder, and execute them for us. So why is all this information important? Well,
that path right there is a critical piece of information that you can take to the bank for
default Windows installations. We know that generally most basic operating services have a
path inside of the C Drive Windows System 32 folder, and that's why it's such a critical
folder for protection and also a highly valued target for us as actual pen testers.
And we can change startup types as well too. So if we were able to go in through the registry somehow,
or through Command Prompt or PowerShell, and change the actual BITS service to point to a
different type of path for a file that we crafted. Let's say we made a fake svcservice.exe
and changed the settings of BITS. So when Windows checks for updates, it says I found some,
I'm going to send the command to BITS to start up. Ha ha, it's a fake svchost.exe. And instead of
downloading those updates, it's actually starting our other backdoor for persistence.