What makes this attack so dangerous is the fact that there are some files out there that load
into services that have very weak file permissions. And while svchost is not one of them, I do kind
of want to walk you through how the file permissions are set for a standard default
Windows operating system service that's here from the beginning. So inside of C drive Windows system
32. And the reason that we know this is if we zoom in, we can see inside of our services detail
for bits that is path to the executable is C drive Windows system 32. And then it tells us what the
file is. And that's exactly what we have opened over here. So as you're getting more details about
the services, like we did in the previous skill, it's good to know where most of these are being
stored at. And here in a little bit, we're going to be going through and making sure that we
actually have the ability to find them. I did them. I recorded these out of order and that
ability to find them is actually in the video right above me. Now, knowing that what we're
taking a look at here is going to be right clicking on svchost.exe and going into properties.
And I'm going to show you real quick that inside of security, I'm going to zoom in for you real
quick that we have all application packages. Now that's a security group that you could dig
further details on later on along with all restricted application packages. So that's not
a user or a group. That's more of a policy setting that's installed by default inside of Windows.
Right below that, you start to see users and some of these may not be familiar to you. For instance,
system, the system account is there by default because you're not a user running svchost. The
system is going to run it behind the scenes, but hint, hint, it's part of background
downloader and stuff, but most services run in the background. And in order to do so,
they need permissions that users may not have. If we go ahead and zoom out real quick, I'm going to
select system and scroll down. So that way you can see as well, right there. System has the
ability to read and execute along with read on that particular file. Now we will go into the
advanced for different permissions here in a moment, but you can also see that administrators,
users, and trusted installer have the ability to access this file as well. Now as a pentester,
this is a target for us because you notice I just said users. They don't have the ability to write
to svchost, but we do have the ability to read it and using the ability, also the execute
permission as well too. So we could very well call upon bits knowing the full flag usage,
right to the left where it says svchost.exe-k net svcs-p. If we ran that as a user,
bits would fire up, but it would immediately terminate because there would be nothing to
download behind the scenes because windows update didn't run prior to that. So if we
zoom out real quick and go into advanced permissions, you can see that the owner of
this is actually trusted installer. And that's because that's another policy setting that makes
it to where no individual user has all the permissions to svchost. And even the administrator
on the system doesn't have write permissions to this. The only account that has access to this
is the trusted installer account. So as we're getting into the system, if we wanted to attack
svchost and write something to it, we would have to do it under the usage of trusted installer
as a account. And nine times out of 10, the trusted installer set by the local security policy
is not allowed to log on locally. It's what's considered to be a service account inside of
windows, something never meant to be logged into. It's basically a method for windows to keep an
audit trail, hint hint auditing, of how these services are started up and when they're started
up and what happens to them when they shut down. That being said, you could take ownership of this
and change the permissions on it. But depending on what you're doing, it could crash the operating
system as well. So if your intention is DOS, that's the way to go. If however, you're trying
to do a modification and get something else to run, you might want to look at an alternative here.
So going out and taking another look at this real quick, I also want to show you the cancel here,
because if you do make any changes to it, you're going to be making a error pop-up inside of
windows because what we have here is digital certificates, a digital signature on the svchost
file. And this is basically a digital signature file or certificate attached to the file that says
I am validating the hash of that file. And as we know, hashing can be done for the full contents
of that actual file. So the contents altogether, not including the file name, as long as that
hash stays the same, that certificate will stay attached to that svchost.exe. If we make any
changes to this, then it will lose its credibility and its digital signatures, thus making windows
highly suspect of running this in the future and could prevent other services from being ran,
since a lot of services on here run through svchost.exe.