Also with VM tools, so we're running a virtual machine, it really depends
whether it's Linux or not, whatever, but there're open VM tools.
There's some sort of agent or set of drivers that are going to be
loaded on the device so that the VM works properly with your
resources, your hardware resources. Right.
Is that something that's checked as well?
It definitely is,
and installing VM tools into a guest OS is a huge indicator that malware
uses to determine whether or not it's in a virtual machine.
That makes sense. And more often than not, if there is a VM escape
vulnerability, it's going to be in those tools. So you might not
want to go in and install those tools. Now understanding that when
you do install those tools, it does make it much easier to use the VM.
It's easier to copy files in and out.
It can copy data in and out.
It works better with your host OS.
You can use things like USB drives a little bit easier, and so on. Your
display's nicer. Your display's nicer, and so on.
But if your malware is looking for the VMware tools,
for example, you may not want to have it in there. You might
want to have a snapshot without the VM tools so that if you do
run into a piece of malware that has anti‑VM capabilities and
looks for the VM guest tools,
then you can kind of jump back into a place where you don't have them
installed, and so it kind of bypasses that check there.
Yeah, absolutely.
So if we're not able to, say we don't have VMware tools installed,
it almost seems like maybe that's the way to go,
right?
Right.
Especially if the escape's going to be through that.
I didn't know that. That's a really interesting
nugget, that that's a vector. Right.
But now I can't copy files in and out.
And as I do my analysis,
I'm going to want to pull information off and maybe publish
that, depending on what it is I'm doing.
I may need to kind of copy/paste in and out. You could
share a clipboard, which is super nice.
What do you do instead?
So copying files in and out seems to be the big pain point if
you don't have the VMware tools installed.
But there are a couple of ways that you can kind of get around that. The
first way is you can kind of set up a separate system that's running
like an SSH server or an FTP server or a web server that then you can
then put your files onto, and then from the guest, access that and
download the files. Honestly,
one of the easiest ways that I found is in your guest OS, set up a
temporary directory like C:colon/temp or something like that,
and then use the Microsoft folder sharing utilities to share that
folder out. And then from your host OS, and again,
you would have to set it up so that your host OS can access
your guest OS, but from your host OS,
connect to that shared folder through the Microsoft
utilities like Windows Explorer, and then copy files in and out that way.
You don't want to do the opposite where you share a folder on
your host OS because if the malware you're analyzing is like
ransomware or it has some exploit where it tries to move
laterally or something like that, you could open up your host OS to compromise.
So share it on the guest OS, not the host OS.
Yeah, and that's for a few reasons.
So we're going through‑‑‑that's that checkbox that we looked at
where the host is sharing the virtual adapter. Yes,
yes.
And you're going through the network for S and B traffic, which we know can
have some exploits that could potentially be vulnerable.
But also you can _____ and downgrade, and so if you're using your
host OS credentials from your guest OS, you're now exposing those
credentials, versus the other way around. You don't really care if
your guest credentials are exposed.
Right.
And, again, like we've said multiple times, assume your host OS is
going to compromised. So don't make it be a domain‑connected system.
Make it be some system that if you need to,
you can re‑image.
Don't use the password you use everywhere else.
Things like that.
Don't use your domain admin to connect to the shared drive.
Yeah, I would not recommend doing that.
That's a good point.