Windows provides more than just a few
opportunities for pen testers. Although, it's
generally a secure environment, same thing with
Linux, but if it's not deployed in a secure
manner, and all the Ts are crossed, and all the
Is are dotted, then there are little chinks in
the armor, different places where you can
actually poke and find some vulnerabilities.
Services in windows would be one of those areas.
It's very possible that services even though
they're very secure in general, work with a
higher elevated privilege level, which is
something that you want, and it's possible to find
some vulnerabilities occasionally with services
that you can then leverage and you can increase
your own privilege level. Let's talk about, let's
look at a couple of the service vulnerabilities,
potential service vulnerabilities. One would be
unquoted service paths. Those are paths that point
to the executable for the service, that's not, that
are not quoted, and includes spaces, that gives an
attacker an opportunity to actually put their own
executable in and the other would be writable services.
Let's take a look at services and see
what each one of those might mean. If we look at
the list of services, we can see that we have lots
and lots of services for any Windows machine. So
let's scroll down, and let's see, find one that
looks interesting. How about the Windows Defender
Advanced Threat Protection Service? That would be
a nice one to replace if you want to decrease the
overall security of a Windows box. So if we take a
look at it, let's look at the Properties, we see
several things going on here. First off, notice
that I cannot write to the path. This is not a
writable service. That was the second
vulnerability that we talked about services, and
that's the ability to have a writable service. If
you can write to it, then an attacker could gain
access to the system, change the path to whatever
he or she wants, and then the next time the system
launches this service, it would run the executable
code the attacker wanted. But since this is not
writable, we can't do that. What else can we do?
Take a look at this path here. Now first off,
this is a quoted path. That's a good thing. But if
this service was defined and the path was not
quoted, that could be a problem, because we see
that the path here is C:\Program Files\Windows
Defender Advanced Threat Protection. What if we
did this though? What if we went to drive C and
let's create a new directory, a new folder called Program.
[No audio]
Now notice we have Program space Files
and Program. If we wanted to redirect the service,
[No audio]
we could go into Program and create a New Folder called
Windows
[No audio]
Defender
[No audio]
Advanced Threat Protection
[No audio]
and we can't see the whole, oh, there we go, MsSense.exe.
[No audio]
Now this is a Text Document. Of course, we would
make it a real exe, but I'm just doing this for
explanation purposes, just to demonstrate it. So we
see that the service is in C:\Program Files\Windows
Defender Advanced Threat Protection, and then we
have our MsSense.exe, executable. But if we
did not quote this path, if we accidentally
created the service without a quoted path, and
the operating system would go to C and under C, he
would find a Program folder, he would actually
choose that before following across the space, so
that by creating our own Program folder, we would
short circuit what Windows would normally do, and
Windows would then go look at Windows for a
Windows Defender Advanced Threat Protection
underneath Program. He finds it and he runs the
executable. Well, this executable is something we
put into place, and it's our own program, and of
course, it's probably going to be malicious. So
this is a way that we can leverage a weakness of
services when you don't use quoted paths. So the
moral the story is if you always quote your paths
that have spaces in them, this vulnerability does
not exist. So that's just one of the
vulnerabilities that we find with services, and
even if you do have your services set up properly,
it's possible that the services themselves could
be legacy. They could be misconfigured. You could
have clear text information being passed or being
stored. So services not only have to be
installed properly and set up properly, but they
also need to make sure that they're operating
properly and not operating in an older or insecure
mode. Likewise, whenever you install applications,
it's possible that an administrator could install
applications that anyone can read and write from,
which results in unsecure file and folder
permissions, or even if it's installed properly,
it's very possible that you could change
permissions so that too many users can read from
and write to a particular folder or a collection
of folders. So you want to make sure that you restrict
the folder permissions or as an attacker,
you want to find folder permissions that are
more generous than they actually need to be. If
you can place an executable that someone will run,
putting a keylogger anywhere in the system can be
a tremendous benefit. Keyloggers record every
keystroke, and that's an easy-easy way if you can
place one to find people's user IDs and passwords.
If you can see exactly what they type, then you
can basically interpret what they've typed in to
user ID and password fields, and then you can
capture that information and use it for your own
purposes. A schedule task, another opportunity to
run the programs that you want. An attacker could
add new tasks to run persistently with elevated
privileges. If you can add something to the system
scheduler, then you typically can get, you know,
a lot of bang for your buck. Typically can go
up in privilege, as well as having it run without
you having to do anything. You can just say, 'Hey, I
want this thing to run at 1 o'clock every single
morning or every weekday or every weekend morning'.
In that way, you only have to place the payload,
you don't have to come back and kick it off on
demand, and lastly, just as with Linux, we have
the kernel, the core portion of the operating
system, Windows has a kernel as well, and as time
goes on, more and more exploits are found against
vulnerabilities in the kernel, and if your kernel
does not remain patched, in other words, every
time Microsoft sends an update to patch the system
against security, that kernel becomes less and
less secure because there's more opportunities for
anyone and attacker or a pen tester to launch an
exploit against a newly found vulnerability or
maybe it's not an even newly found vulnerability.
Any unpatched vulnerability is an opportunity
for that system to be attacked.
[No audio]