Everybody and welcome to the last video the operating system internals module.
Now I know that this module has been a lot of slideshows and documentation.
We're gonna go over a lot more of this particular stuff in the exploitation course that's going to follow
this.
So bear with me we're gonna be going into a lot more hands on stuff past this point.
This was just some need to know stuff so that way when I reference it later so if I'm talking about
an exploit that bypasses DEP or this issue is caused by a SLR you're aware of how it works when I reference
the stack you'll know exactly what I'm talking about so.
Great job everybody for making it this far.
It is it's a lot of information but it's it's something that you just have to be aware of.
It's one of those things you just gonna have to keep in the back of your mind.
Now our last video is gonna be talking about the antivirus.
Now a lot of you might not already know what an antivirus is.
That's fine.
In this particular case we're going to assume you know nothing.
Now this tool is designed to identify malicious intent from the user or an application that's trying
to do something it shouldn't.
This normally resides at the kernel level or system on a Windows platform.
It has the most freedom there.
It can interface with calls that are being made.
It can interact with any memory segments it wants to.
It has a lot of power on a system.
What I want you to know is as most enterprises have in a V or an antivirus in some way shape or form.
This is important because when you're attacking a machine and let's say you have initial access if you
dump over net cat or a medicinally interpreter show or anything like that or Mimi Katz for password
hashes in a V or any of its salt will flag that immediately either delete the process quarantine it
and or notify the admin immediately.
Now in enterprise level environments that could mean an alert just got sprung up and a ticket got sprung
up and somebody is already been looking at it in the last five seconds since you dumped it on the machine.
So in some places that's that can happen quickly and that can make you go from undetected to detected
immediately.
So knowing what's running on a system is important.
Is there an antivirus.
Is there not.
If there is what type is it because then you might be able to work and run a few applications to try
to hide or mask the executable you're trying to use based on the certain type of antivirus so if you
know somebody is using e set as an example you could build your detection or mitigations for your executable
around set and then upload it to Virus Total to find out if you set even finds it if it doesn't find
it.
Feel free to load it over the system.
Another good way is to just download the same version to your test machine and start running the applications
see what happens.
Just running exploits as well even in memory can sometimes cause the the antivirus is to kick off and
tip off admins.
So understand the Navy is important.
There's other things like carbon black that will go through and analyze process patterns and what they're
actually doing this is calls or when API calls they're making but we're not going to go over that in
this video.
Know that they exist and know the antivirus is are most likely installed on some system and 80 can run
a few different types of checks.
Just here are some examples.
They can sandbox the application which is normally the case and then they can use signature based detection.
So it's looks at the signature of the first you know X amount of bytes of a file or the empty five on
file.
The last few bytes in the end of the file or they can do heuristics where it tries to run the application
in a safe or sandbox really restricted sandbox environment to determine what it's trying to do what
calls its making to be malicious.
Now there are thousands of ways to bypass an antivirus and a lot of them are have been found now but
it only takes one or two tweaks from an old technique to generate a new one.
So if that's something you guys are interested in let me know in the Facebook group and I can start
making a few more courses on bypassing antivirus and kind of how you go about it.
But for the scope of this particular course we're not going to be going to in-depth on how an A.B. actually
sandboxes and checks on an application.
But if that's something you guys want feel free to let me know more kind of go from there.
So this has been the end of this module.
Thanks for all for sticking with me so far.
In the next module we're going to go over hands on and how to create Active Directory.
How.
What are some of the configurations for it.
You gain an understanding of how an enterprise environment on the Windows side will actually work.