Hi everybody welcome to part seven of the going a little deeper in the Windows operating system.
In this video we're going to be talking about windows pipes.
So what is a Pipe Pipe is a two sided object in windows that allows data to flow between it similar
to how a pipe works in the real world.
There it's normally between two processes and or a child or parent process which I know we haven't gone
over what a process is in a nutshell.
But we'll have an entire video on what the process is what a child processes.
Just know that the parent spawns off something called a child and they both are interconnected.
So in this case a pipe will connect the two and transfer data between them.
Now there are two types of pipes there's named Anonymous pipes now a named pipe again is a two way communication
between two processes.
It can be used on the local system or a network system most likely in the same domain.
Now it uses a unique file system called SPSS or named pipe file system.
Now keep this in mind if you want to look a little bit more into what a named file system is.
As far as how the actual file system works I will leave that to you guys it's for homework.
Now the path of the named pipe looks generally like this.
So you're gonna have a slash slash dot slash pipe slash and then the name of the pipe sometimes or some
extra characters pass that point.
But I'll take a look at some of the the named pipes on the VM that we've already set up for now we have
anonymous pipes.
These are similar to named pipes but our nor are in were they are restricted.
So they have a lot less overhead in maintenance.
So as far as like coding wise and keeping them up to date and managing them they're very quick and easy.
However they are very limited.
You cannot send out over the network and it's to local transfers only.
Now when I say local I'm not talking just the local host I'm talking about between a parent and a child
process.
So this can't send a pipe or a data from one process to another that are not a parent or child.
Now can we attack this.
There are a few use cases where impersonating the user at one end will work as well.
So we can use the name to impersonate named pipe client API call and then pass the output of that into
a create process as user.
So what name impersonate named pipe client does it generates a impersonation token based on the pipes
client.
So a pipe works in a client server in a server and a client.
So both sides can be a server and a client.
So when they send or receive they'll flip flop which one they are.
So in this particular case the client when we make this call would be the other end which could be a
different process could be a different host.
So what we do is we would call that we generate our impersonation token based on that that client based
process and then we create a process as user using that access token or that impersonation token and
then we can spawn a process that this can be command line could be Registry Editor.
It doesn't matter.
The point is is we can create and spawn a process just based on somebody on the other end of a name
pipe being there.
Now of course to be able to do that you need to be normally adamant on the system or a user that has
access to that named by now we're going to take a look at the named pipes on the local system.
So what we're going to Turtle's package which you should probably get familiar with there's a lot of
good tools in there.
You can see a lot of very detailed stuff with with some of these.
So we're going to first look at pipe list 64 bit.
All right.
So I've already downloaded it and unzip it so go ahead and do that same thing and then run this on your
system.
So as we can see here we've got a few named pipes so you can see the the the the pretense of each pipe.
So these slash slash dots slash pipe has been removed from this just for readability so we can see virtual
box Trey has a named pipe for administrator that it's passing data to and from that log is there as
well.
Some of the networking stuff the Sam stuff wind sock for the network changes so see here.
Looks about it.
So this will give you a good idea of the named pipes.
It's pretty difficult to view anonymous pipes and they're not they don't normally stick around nearly
as long.
So as an example if we had access to this guy right here and we had access to to one end of the pipe
for some some weird issue but we didn't have a system of access we should be able to impersonate that.
So there's a lot of things you can do and a lot of that comes with manipulating the Windows API.
So get get familiar with it do a little bit further research on pipes and unknown and anonymous pipes
and go ahead and post it into the Facebook chat if you have any questions around pipes how they work
or general questions on how to view certain things or maybe maybe even use a dot net or power shell
to actually create your own named pipe and send data back and forth between two systems.