Let's talk D.L. hijacking now.
You should already be on your remote desktop machine with this spun up.
If you're not.
Go ahead and get that done while you're listening to my voice talk about what deal hijacking is.
So what is the deal.
Well and you've probably seen it before but you might just kind of ignore it.
It's it's a dynamic link library is what they stand for and you can think of it almost like an executable
because they are like executable they're just not directly executable.
Something to compare it to if you're familiar with Linux as a dot S.O. file and they're basically just
these shared libraries.
So the deal contain like classes and functions and resources variables all sorts of things.
And you'll often see Dell ls run with executable.
So what we're doing in the case of DL hijacking is we're looking for a specific instance.
Now when Windows environment starts up a service or an application it looks for Dell's.
Now if the DLR doesn't exist then we can get malicious with it.
So if it's looking in a path that's right well and where the DLR does not exist that it's looking for
we can get malicious.
Now let's take a look at how we can do that.
So I'm going to go ahead and just open up the tools folder and from here I'm going to open up Process
Monitor and we're going to run Process Monitor as administrator.
We're just going to simulate this here.
So in a normal environment we might run something like power spoilt or we might try to take this process
off line and read through it but we're just going to kind of look what happens in that way we can understand
what's going on and why we're seeing DSL injections or hijacking and how we can do this.
So let's take a look here.
Type in our password of hacker 1 2 3 and we're going to load this.
So now I've already got some configurations in here.
But what I want you to do is I want you to come in to filter and I want you to add a filter that says
result is and then name not found.
And keep that under include and then hit add you can see I have that here.
You can also see that path ends with DOT yellow.
So let's go ahead and set path and then two ends with and we'll just do dot DL l.
And then lastly I've got this deal hijack service in here.
You see you don't have to worry about that.
I'm going to hit apply and OK for now.
And you could see that it's running through a list of events and it's just showing in here where there
has been a name not found for a DSL.
Now if these names are not found and it's looking for them we could possibly overwrite this DSL if we
can control the service.
And if the location is right able so common locations that are rivals like program files but in our
case we have a temple there.
That's right.
So let's go ahead and just go out to a command line and we're going to run the service.
Now we have a vulnerable service here and that vulnerable service is going to be SC start you're going
to say DL l SDC OK if it says is already running.
Go ahead and say stop DSL SBC and go ahead and give it a start
and you should see some stuff come in here.
All right.
So things just happened and what we can see here is we've got names not found.
We've got one in program files so potentially that's hijack a right there.
We've also got another one here in the temp folder of a hijack me DOD DSL.
So we see this hijack meet our DSL.
We have a couple of paths that we can take now the path that we've been doing over and over and over
again has been using Matar fritter or medicinally and getting a shell so we could generate a quick shell
we could do a file and just put this as an executable and save it as a hijack meetup DSL and replace
this.
However we are just going to go a different path here.
So what I want to do is I want to copy over this Windows DLC file that we've got in our our machine.
So if we go into our folders here and we go back we go to source we've got these windows underscored
Dale that see.
So I just want to move this to my machine.
So I'm going to create a FTB server temporarily.
So all we're gonna do here is we're just going to say I'm going to move over to the transfer folder
and I'm going to do something along the lines of Python dash am pi FCP lib port twenty one dash dash
all right
and then I'm going to spawn a command show here and I'm just going to FTB to my server anonymously ten
not eleven not thought out one 14.
I do believe they are going to stay anonymous and then anonymous and now we're just going to put the
windows DL Al Ghazi
So now we should have it on our machine.
You can see it came through over here.
What we're going to do on our side of things is we're just going to get it.
That Windows DL El and you can see there's a command in here and the command says hey let's run.
Who am I put it to this deal out at Texas.
We're going to improve upon this.
We're gonna say hey let's run this command that says Nat local group administrators user add again user
being us the user not just any user.
So this would be our user name.
We're going to say this and same thing that we did before.
Look I even has in here how to compile it for 64 bit.
This is exactly how we're going to compile it.
So I'm going to go ahead and just start typing that out.
So you would just say X 86 underscore 64 WS sixty four main thirty two.
You can auto tab this a little bit GCSE is what we're after and then.
Yep so we're good.
And then here we're gonna say Windows underscore a deal out at sea dash shared dash output of hijacked
me that DL out
OK that's good.
Now all we have to do is hold this up in a simple H TGP server on port 80 ADR We already in use will
just use eighty one.
I've got a server spinning up somewhere and then we'll just navigate over here really quick
and let's go ahead and say goodbye to our FCP server.
We'll do a net local group of administrators.
You can see that just TCM and administrator in here.
So then I'm going to come into here at ten eleven and up for 114 on port 81.
All right.
Having issues connecting on eighty one side I just killed my other server that was running and brought
up 80 and let's go here and just download the file.
So we've got the DL under hijack need DSL and we're just gonna go ahead and save this into the temp
folder why the Templar.
Because we can write to the Templar and because that's where the call out is coming from.
So remember in the proc mind we saw it going to the temple there.
So we're going to save it there.
We're gonna close this.
We're going to go ahead and just SC stop the DL service and we're going to SC start the DL service
all right.
And then we're going to net local group administrators again.
And look who is right here in the administrators group.
It is the user.
So that is DL L. hijacking and a very very basic nutshell.
I can get much crazier than this but just understand the criteria.
That's really what we need to know.
We have tools that can look for this but you really just want to know the criteria here being that we
are looking for a DL that's trying to load it has a name not found if we have a rival directory for
that DL how we can hijack that DSL and have that run for us and do something malicious.
That's the big thing here.
We're looking for the name not found with the deal itself and the directory we can hijack into.
So that's it for this lesson from here we're going to talk about one of my favorite escalation paths
which are service permissions and paths.
So I'll catch you over in the next section.