I know some of this may be a refresher for you from the previous skill, but I wanted to hit on
this a little bit more detailed for you. So if that is the case for you and you're more familiar
with this already, by all means go ahead and skip to the next part of this skill.
But here we are in PowerShell of the actual Hyper-V host and what we're going to be doing
is getting a list of services that run on the actual target system of PowerShell.
Keep in mind we are not doing this through Meterpreter right now. We're just taking a
look at it from the actual system itself. Now in order to do this on the actual system,
make sure that we do have permissions to do so because we're viewing right now
and gaining a better understanding. So we are opened up an administrator. We're going to be
doing a git cim instance space dash class name win32 underscore service. And what this is going
to do is give us the exact same output of services that we would see in the task manager MMC or
services tab. The difference being is that now you have a way to do this inside of PowerShell.
So when you do that remote connection, you can see all the information here instead of like in
the previous skill, accidentally popping up windows when the user being shocked. So you can
go through here and get the process ID, the actual name of the services and get the status of them
and see what the last exit code was. Now, that's all well and good. We just have a list of services,
but we don't have a lot of actual detail around this. Now, since we've been picking on bits,
I'm going to stick with it here for a second and we're going to go a little bit further and go
into the command of SCQC. And I believe it's bits. My bad. I totally had to do this in command
prompt because SCQC bits is an actual command prompt command. And I'm bouncing between PowerShell
and command prompt for a reason, because I want you to be familiar with both in case you have to
either use command prompt or PowerShell inside of your meterpreter environment for the actual
pen test. As I zoom in here for you real quick, you can see here that we have all the information
can pertain into bits. And as you'll see in the next portion of the skill, all this information
as well, the binary path name is what we're specifically taking a look at. C drive windows
system 32 SVC host.exe. And then we have all the information pertaining to this. In addition to
the dependencies of this actual service itself. So we have RPC SS, and you can even go a little
bit further and type in the same command for that very same service. That's a dependency,
meaning that this must be running first before actual bits fires up. And there we go. And you
can see that this one is an auto start as compared to bits being a actual demand start
manual. Now, why are we bringing all this up? Well, if you look at the actual path name for
RPC, it's the exact same SVC hosts, but as we'll mention in the next portion of this skill,
that SVC host.exe is digitally signed. So what are we looking at here? We're basically
using this as a building block for how to build out our own service that we can create and
manipulate the system by tricking it into thinking that it can run a service behind the scenes.
Whenever it boots up, basically slaying the groundwork for us to be able to maintain persistence.
And I know it's been a while since we went over the pentesting life cycle, but persistence is one
of the key things that we have to maintain during our actual pentest. While we may be able to gain
access once to a particular system, maintaining persistence allows us to be able to revisit that
system at a later time through use of something like a back door. And services are one of the
best ways to do that because it's hidden and it's hard for people to actually find it unless they
know what they're looking for. Now, of course, this lab environment that we have is kind of
cheating a little bit because dummy.exe is what we're going to try to use as a service.
That file has been exempted inside of our security tools for the actual Windows 10
virtual machine inside of our lab for the purposes of us, like we mentioned earlier in the course,
getting used to the fact that we can actually use things like MSF Console, MSF Venom, and other
Metasploit tools and applications. So keeping all this in mind, let's go a little bit deeper
into those services.