Enumerating processes and services on Windows.
In this video, we'll be exploring
the process of how to enumerate a list of running processes
and services on a Windows system that you have just compromised.
So you might be asking yourself the question,
why is this important?
I can understand why enumerating users and groups is important.
I can understand why enumerating network information
is important.
But why processes and services?
Well, like the previous steps, you know that fall
under local enumeration.
It's always important to learn more about the system
that you've just exploited, like what processes, services,
and schedule tasks are currently running.
But why is it important?
Well, it's important for a few reasons.
In the case of running processes,
the reason why we ought to enumerate a list of running
processes is, in the event that we
want to actually migrate our current process
to another process.
So an example of this would be, if we have access
to a Windows target via an Meterpreter session,
and the current process that we're working on
or that we're working with on the target system
is unstable and is having issues,
we can migrate to a more stable process like exploree.exe.
And in order to do this, we actually
need to identify explorer.exe and as well as its process ID.
And of course, that's just one example.
Another example comes into play when we're exploring
or when we will be taking a look at the privilege escalation
stage of the post exploitation phase of a penetration test,
and that's where scheduled tasks--
this is where scheduled tasks come into play, right?
So the reason we want to enumerate a list of scheduled
tasks running on the system is primarily
because during the privilege escalation phase,
we will be trying to identify weaknesses or misconfigurations
within each of these scheduled tasks
that we can take advantage of in order
to elevate our privileges.
So again, this information is very, very important, right?
So in terms of what we're looking for,
we are trying to identify the running processes and services
as well as the scheduled tasks.
Now, if you have never used Windows
before or if you have a basic understanding of how Windows
works, you might be a little bit confused
as to what a process is and what a service is, right?
So a process is essentially an instance
of a running executable, also known as an exe or program,
right?
And a service is a process which runs in the background
and does not interact with the desktop.
So an example of a process is when you launch Google Chrome.
So when you double-click on Google Chrome.exe,
that's a process.
And that's primarily what we're trying to identify firstly.
And then, in the context of services,
these are really programs or processes
that run in the background and do not
interact with the desktop.
So they're not like end user applications or third party
applications that you typically find,
like Google Chrome, or VLC, or Microsoft Word, et cetera.
All right.
And you'll actually see the difference
as we move into the practical demonstration.
So we are going to be utilizing the same lab environment we've
used in this section.
And again, all you need to do is just fire it up.
And this video has a lab environment attached to it.
So we'll start off by gaining access to the target system,
and we'll obtain a Meterpreter session.
After which, we'll begin exploring
how we can enumerate the list of running processes and services
and why this information is important.
So fire up the lab environment, and I'll see you there
in a couple of seconds.
All right, so I'm back within the lab environment.
And by default, you'll be provided
with the target IP address, which, in your case,
will be different.
All you need to do is copy it.
Now, given the fact that we know the target system is running
a vulnerable version of the Rejetto HTTP File Server,
we already know what Metasploit exploit
module we can use to gain access,
as we've explored this in the previous videos
within this section.
So I'll open up a terminal, and I'll open up MSF console.
And we can then search for the Rejetto module,
and load it, and exploit the target in order
to gain access or rather exploit the vulnerability in order
to gain access.
So I'll say, search and rejetto.
I'll then say use and specify the module ID,
which, in this case, is 0.
There we are.
And I specify the target IP address.
So I'll say, set RHOSTS and paste in the target IP address.
Of course, in your case, that's going to be different.
Once that is done, we can type in exploit,
and we should receive a Meterpreter session.
So we'll give this a couple of seconds.
There we are.
We get a Meterpreter session.
That's going to begin the clean up.
And we should be able to-- there we are.
So we get an Meterpreter session.
Now, let's start off by taking a look
at how we can enumerate a list of running processes
with Meterpreter, right?
And then, we'll move on to the manual commands
through a standard command shell session.
So if you have access to the Windows target
system via Meterpreter session, you can type in the ps command.
So that will list out a list of running processes, right?
And if we take a look at the top here,
you can see that it'll tell you that this is the process list.
And it'll then sort the information
into various columns.
So you have your process ID.
You have your PPID, your Name, Architecture, Session, User,
and Path.
The most important of all are going
to be the actual process name.
You then have the process ID of the a specific process.
So for example, if we are trying to look for explorer.exe,
the process ID of explorer.exe is 2176, right?
The architecture is self-explanatory.
That is going to depend on the actual architecture
of the version or rather the architecture of Windows that's
running on the target system.
Now, one thing you need to take into consideration
or that you actually need to take a special note on
is the user column, right?
So this will display the privileges
associated with a particular process, right?
And in this case, you can see that specific Windows processes
have NT AUTHORITY system privileges.
Now, given the fact that we have access to the target system
as the administrator user, which, again,
is a privileged user account, you
can see that when we type in ps, it'll
display a list of all the user privileges associated
with a particular process.
However, if we weren't a privileged user,
and we typed in ps, we would get the same information.
However, under the user column, wherever the actual privileges
were displayed, in the case of NT AUTHORITY system privileges,
that would not be displayed.
It would only display the actual user
information pertinent to the current user you have access
to.
So for example, if I gained access to the target system
through a user called Bob, and I typed in ps,
and Bob was not a privileged user,
it would still display all the processes as well as
the process IDs.
However, under the actual user column,
it would not display all the NT AUTHORITY system privileges.
It would only display privileges associated with the user Bob,
right?
And the other column right over here is path.
So that'll give you the path to the executable itself.
So you can see that the svchost.exe process is derived
from the following executable.
So that's on the C Windows System32 svchost.exe.
Now, coming to the example that I mentioned
during the slides, and that was how we can essentially
migrate our process.
So let's say we wanted to migrate our process
to explorer.exe.
Well, we could use the ps command
to list out the list of running processes,
and then identify the explorer.exe process
as we did here.
And then, take a look at the process ID.
And then, we can essentially type in migrate,
specify the process ID, et cetera.
However, you actually do not need to list out
the actual list of processes.
You can utilize the pgrep utility
to search for a particular process name.
So I can say, for example, I want
the process ID of explorer.exe.
I can hit Enter, and you can see it
will tell me that the process ID for explorer.exe is 2176.
So whenever you are trying to obtain a stable Meterpreter
session, it's always recommended to migrate to explorer.exe,
primarily because explorer.exe is rarely stopped
or rarely has any issues in terms of stability
as it is required in order for the Windows operating system
to function.
So we can migrate to a specific process or process
ID for that matter, by typing in migrate,
and then specifying the process ID.
So I can say migrate to Explorer,
and I specify the actual process ID of explorer.exe,
which, in this case, is 2176.
I'll hit Enter, and that is going
to migrate to that particular process,
and the migration is completed successfully.
And if you remember, we actually did not
type in the getuseid command, but we
had obtained a 32-bit Meterpreter session, right?
If we take a look at our current Meterpreter session now,
and I can say sysinfo, you can see
that if we migrate to a 64-bit process,
we are going to obtain the architecture
specific to the process that we migrated to.
So explorer.exe was a 64-bit process.
And when we migrated to it, we obtained a 64-bit Meterpreter
session.
So again, that's a very, very important information.
And of course, we can utilize the pgrep utility, but not
really just a limited to migrating to a process.
If we were trying to find a particular process,
like, for example, the HTTP File Server process, I can say pgrep
and then hfs to see if it's running.
So I can say hfs.exe.
And if it is running, it'll tell me the process ID.
So this is a good way of identifying a specific process
that you're interested in, and this will tell you
whether it's running.
So for example, if I said pgrep and aws.exe,
you can see that if it doesn't display a process a ID, that
means that it's not running.
All right, so now that we've explored this
or we've explored the process of enumerating processes
with Meterpreter, let's take a look
at how to enumerate processes and services
with a standard command shell, right?
Because in most cases, you will not
have access to a Meterpreter session right out of the box.
So I'll open up a command shell session here.
And to get started, we can list or obtain
a list of started services by saying net start,
and I'll hit Enter.
And if we take a look at the top,
you can see it's going to tell you these Windows
Services are started.
So remember, these are services, not processes.
So again, if we remember what we explored in the slides,
I mentioned that a service runs in the background, right?
And if you go through this list, you
can see that we'll not find processes
like hfs.exe, et cetera.
So these are all the background services that are running.
And of course, it makes sense to have
them running in the background.
We have DHCP client, the Amazon SSM agent,
et cetera, et cetera.
All right, so if we wanted to list out the services utilizing
another utility, like WMIC, we could also
do that by saying wmic, and then service.
And we can then say, list.
So at wmic service list, and then
we can keep the output brief.
So we can do that by saying wmic service list brief.
Hit Enter.
We'll give this a couple of seconds.
And now, this is going to display
a list of all running services.
And the way the output is sorted is in the form of an ExitCode,
the name of the service, the ProcessID
of that particular service, the StartMode, the State,
and its Status, right?
So this is really all the services
that are running in the background,
and it'll provide you with the process ID,
whether it's currently running or stopped,
which is very, very important, right?
And all of this information is really relevant
when it comes down to privilege escalation.
So it might not make a lot of sense right now, but trust me,
this information is very important.
And the ability to enumerate it is equally as important.
So again, that's how to list all the services with WMIC.
We can also list out the list of services or other processes
and services using the task list command.
And we can say SVC.
So tasklist/SVC.
Hit Enter.
And this is going to display the list of processes running,
as well as the services that are running
under a particular process.
So you can see that we have the lsass.exe process here.
So that's lsass.exe, the process ID, and then
the services that run under lsass.exe.
So this is pretty--
I would say that this is the most important command.
Because not only does it list out
the list of running processes, but also
the services that run under a particular process, right?
So an example of this would be, if we take a look at hfs.exe,
so that's the HTTP File Server.
You can see it provides us with the process ID,
but we can see that it doesn't have any services running
under hfs.exe or it doesn't have any services that
are responsible for maintaining the functionality
of the program itself.
So for Windows specific processes
like svchost and lsass.exe, it'll
display the list of services that are running
under that particular process.
So again, this is a very, very important information.
If you also want to list out a list of these scheduled
tasks on the system, that can also
be done via command shell session,
by typing in schtasks, so just an abbreviation for scheduled
tasks.
We can then query.
So /query.
And we can then say fo, and we can then say list, right?
So that is going to provide us with, essentially,
the entire list of scheduled tasks
that have been configured to run on this target system.
Now, this command is going to output
a lot of information, which I would recommend that you copy
and paste into a text file for later use,
as this will really come into play during the privilege
escalation phase of the post-exploitation phase
of a penetration test.
So once I Enter, you'll see that this
is going to enumerate a lot of information.
So we'll give this a couple of seconds.
You can see that it's not enumerated
additional information that's really important,
and that is because we did not specify.
So I can say, scheduled tasks again, and we can then specify.
In this case, we can say /query /fo LIST,
and we can then say /v. They'll display additional information.
And you can see that we have more fields being populated now
for each specific scheduled task.
So let's take a look at some of these examples here.
So this is under the folder Mozilla.
The hostname-- this provides us with the hostname
of the system.
The task name, in this case, is Mozilla Firefox Default Browser
Agent.
So that's for the browser agent.
The status is currently set to ready,
and it provides us with the task to run.
So we can see that this is the task that
has been configured to run.
And then, you have the schedule right over here.
So scheduling data is not available in this format.
The schedule type is daily, et cetera, right?
So you, again, might be asking yourself,
why is this information important?
Well, in certain cases, scheduled tasks
could be misconfigured or configured
in a way that makes them vulnerable to exploitation,
and more specifically, they can be exploited in some cases
to elevate our privileges.
So in the context of privilege escalation,
we would typically be looking for scheduled tasks that
are running with the NT AUTHORITY system privileges,
right?
And that's typically what we would be looking for.
In that, if we can get that scheduled task
to run or execute our specific executable, an executable
that we specify, then we can potentially
elevate our privileges.
And of course, that's something that, again, will fall
under privilege escalation.
So as I said, I would recommend that you
copy all of this information and paste it into a text file
as it will become important later on.
And again, for all the information
that you're gathering or that you have gathered
during the local enumeration phase of post-exploitation,
I would recommend that you save all of that information
and you ensure that you're documenting
all of the important information that you're gathering,
so that you can actually use it during the other phases
of post-exploitation and also during the reporting stage
or phase of the penetration test.
So again, you can go through the list.
You can then copy this and save it into a text file.
With that being said, that is going
to conclude the practical demonstration
side of this video.
All right, so now that we've explored
the process of enumerating system information, users
and groups, network information, service information, service
and process information on a Windows system,
we can now move on to the final video within the Windows
local enumeration section, which will essentially
cover the process of automating everything
that we've done so far.
And the reason why I have this at the end of this section
is primarily because you need to have the ability
to enumerate all of this information
manually before you can move on to automating it.
So the objective in the next video
is to automate all of these local enumeration checks
that we've done throughout this section.
And we will be doing this through the use
of various Metasploit Framework post-exploitation modules
in addition to a couple of enumeration scripts
or utilities that will automate all of this enumeration
and will speed things up, therefore, making
the local enumeration phase of post-exploitation
much more efficient as you move along
or as you progress with your career as a penetration tester.
So I'll be seeing you in the next video.