Frequently Exploited Windows Services.
Now that we have a good idea of the various vulnerabilities
that affect the Windows Operating
systems and the various types of vulnerabilities that
can be used or that can be exploited in order
to gain access to a Windows operating system,
let's take a closer look at some of the frequently exploited
Windows services.
And, of course, this will shed light
on services that you may have not been
or you may not have been familiar with
or services that are typically disabled on Windows systems
but that you may find running in the wild.
So, again, the focus here within this course
is not to focus on third party applications that
can be installed on a Windows operating system.
Instead, we're going to be focusing
on exploiting the various services and protocols that
are native to Windows and can be configured to run.
And, of course, as you'll see in a few seconds,
most of these services are already running by default.
So it's very important to understand first and foremost
that Microsoft Windows has various native services
and protocols that can be configured to run on a host.
And by default, in some cases, services like SMB
are already configured to run.
Now, the important thing to note here
is that these services provide an attacker with an access
vector that they can then utilize to gain access
to a target host.
So instead of focusing on third party applications,
if we turn our attention to the native services like SMB, RDP,
WinRM, et cetera, you'll be able to see that these services also
suffer from various vulnerabilities.
And if they are the only services that
are running on a Windows target, regardless
of whether it's a server or a laptop that's running Windows,
all of them suffer from specific types of vulnerabilities.
And all of these vulnerabilities can
be exploited in order to gain access to that particular host.
So having a good understanding of what these services are,
how they work, and the potential vulnerabilities
is a vitally important skill to have as a penetration tester.
So in order for you to become or to master penetration testing,
you need to really have a good understanding of the operating
systems that you're targeting.
And in addition to being able to exploit services--
third party services and programs or applications that
are running on Windows--
you need to be able to identify and exploit vulnerabilities
that are running on the native or inherent services that
have been developed by Microsoft and the services
that you'll typically see running on a standard Windows
system.
So the following table essentially
outlines a list of some of the most frequently exploited
Windows services.
It also outlines the ports that they run on
as well as their purpose.
So let's start off with Microsoft IIS, which
stands for internet information services.
This runs on TCP port 80 or port 443
if there's an SSL certificate configured.
So what is IIS?
Well, IIS is essentially a proprietary web server software
developed by Microsoft that runs on Windows.
So this is a web server technology
that was developed by Microsoft, and you will typically
see this running in Windows environments.
They can be used to host a plethora of applications.
Regardless of what their purpose is,
it's very important to know what IIS is and what it's used for.
And, of course, we'll be exploring
this even more once we get to the exploitation section.
We then have WebDAV.
So this is where a lot of people get a little bit confused,
but it really is very simple to understand.
WebDAV, or web distributed authoring and versioning
protocol, is essentially an HTTP extension
that allows clients to update, delete, move, and copy files
on a web server.
So WebDAV is essentially--
what it is used for is it is used to essentially
convert or to enable a file server functionality on a web
server like Microsoft IIS.
And you'll typically see WebDAV enabled and configured
on a Microsoft IIS web server.
So, as I said, regardless of what the web server is hosting,
WebDAV again essentially allows clients,
regardless of whether they are internal or remote,
to essentially update, delete, move, or copy files
on a web server.
And, of course, this is akin to an HTTP file server.
So that's essentially what WebDAV is.
And, of course, WebDAV will also run on the same ports
that Microsoft IIS runs on, which is port 80 or port 443
if there is an SSL certificate configured.
You then have SMB, also known as CIFS.
SMB is the server message block protocol.
This runs on port 445 on modern Windows systems.
And, of course, on all the Windows systems,
it also runs on top of net bias.
So what is SMB?
Well, SMB is essentially a network file sharing protocol
that is used to facilitate the sharing of files
and peripherals between computers on a local network,
also known as a LAN.
So if you've ever worked within a Windows environment
or worked with Windows before and you perform a port scan
on your Windows system or just list out
the currently open ports, you'll see that port 445 is running.
So what is SMB used for?
Well, a simple example of this is
when you're working on an internal network
or on a network that has multiple Windows systems.
They can essentially connect to each other for the purpose
of sharing files and folders and, of course, for sharing
hardware devices like printers.
So, again, if you've ever worked within a Windows environment,
you'll know that you can set up a file share,
and other Windows systems on that network
can access that file share.
This is all facilitated through SMB.
And, of course, in a typical company network,
there may be one or two printers.
And if they're connected to the LAN network,
again, SMB can be used to share that printer to other Windows
systems on that network.
So it's a very, very important protocol
when it comes down to Windows, and it's one
that you'll typically see running by default.
We then have RDP, which is the remote desktop protocol.
This runs typically on TCP port 3389.
What is it?
Well, this is a proprietary graphical user interface
remote access protocol that is developed by Microsoft
and is used to remotely authenticate and interact
with the Windows system.
So RDP is disabled by default. However, if enabled,
it essentially allows users--
remote and local-- to essentially connect
and authenticate with that Windows system.
And, of course, you need to provide legitimate credentials.
After which, you'll essentially be
provided with a graphical user interface that
allows you to remotely control and interact with that Windows
system.
So this is a very important protocol, and, of course,
we'll be exploring various exploits and vulnerabilities
within our RDP that again can be used to gain access
to the target system.
We then have WinRM.
Now, this is a protocol that really a lot of people
are not familiar with or aware of,
and it's one that you will see in some or many cases
really on an internal network.
So WinRM essentially stands for the Windows remote management
protocol.
This will typically run on TCP port 5986.
And in the case of an SSL certificate,
it will then run on port 443.
But again, with some of these services,
they can be configured to run on different ports,
so it's very important to keep that in mind.
However, with a typical Windows environment,
they will be configured to run on their default ports.
Now, the Windows remote management protocol
is essentially a protocol that can
be used to facilitate remote access with Windows systems.
So, again, it's a protocol that essentially
allows you to execute commands on a Windows system
remotely regardless of whether you are on the internet
and you are connecting to another computer
on the internet or whether you're
running on an internal network.
So WinRM is a protocol that we'll also be exploring.
We'll be taking a look at the vulnerabilities
that can be exploited and how this protocol can essentially
allow us to gain access to the target system.
All right, so by no means is this an exhaustive list
of frequently exploited Windows services,
or Windows services for that matter.
These are some of the services, in my opinion, at least,
and in my experience as a penetration tester, that you
should be familiar with, and these are the services,
as I mentioned in the previous video,
that you'll typically find running on an internal network.
And as you can already tell, they are not really
used to host much.
However, in the case of WebDAV, this
is typically used to host files and documents that
can be accessed by users within an internal network.
And in order to facilitate that, you'll
see Microsoft IIS being used.
So regardless of whether it's being
used to host a web application, which is very unlikely,
or to host documents, which is very likely,
it's very important to actually be
able to identify vulnerabilities within Microsoft IIS and WebDAV
and also be able to exploit them.
And, of course, as I said, SMB is typically
going to be running.
And RDP will be disabled by default, but, in some cases,
you may find it enabled, so that's something
that you need to keep in mind.
And that goes for WinRM as well, but, as I said,
these are very important services
that are native to Windows or that have
been developed by Microsoft.
And again, it's very important that you get
a good understanding of them.
And, of course, we'll be exploring all of them
in depth during the Exploitation section.
All right, so that is going to conclude this video.
In the next video, we'll begin the Exploitation section.
So we'll get started by exploring
all of these services in depth and taking
a look at how they can be exploited
in order to gain access.
So I'll be seeing you in the next video.