In this skill, we're going to be looking at memory exploitation and a couple of kind of a
background segments of this, if you will, because we're focusing solely on things that are in the
running memory and not necessarily hard-coded or written to the hard drive itself. This is
where attacks are only focused on things inside the RAM itself. So take for instance the fact
that when we look at a computer system and remote into it, that there's all sorts of information
that we've been pulling so far, but the majority of it has been on the actual hard drive. Now,
there is information that we pull that is in the running memory, but that just so happens to
coexist inside the running memory, and it also takes a place on the actual hard drive itself.
I'm going to give you an example. When we go into a system, whether it be through MSF Console or
on an actual system itself, we run a command like ifconfig or ipconfig if you're in a Windows
environment, and once we get the response to that in the command line or terminal, that gives us all
the IP information on that system. Now, primarily that information is written to the hard drive
itself. Specifically in Windows, it's written to the actual registry, and what you're getting when
you get the return prompt from ipconfig in that Windows world is stuff that's been assigned and
written to some sort of file that's being saved at that moment. Think Windows System 32 inside the
Etsy folder, and your configuration is going to be stored there, but it's also in the running memory
as well because we need to be able to refer back to it at any given time, so it takes a piece of
the RAM up to keep that as randomly as it needs to be pulled. So, like I said, things that we've
been working with so far have primarily been in both arenas as far as hard drive and
the actual running memory. Now, the running memory, just as a refresher for us, is the RAM on a system
or virtual RAM if you're in that virtualized environment for virtual machines, where we have a
buffer of memory for us to be able to call up different programs and have them remain open or
remain running without having to have the CPU constantly go back and forth to the hard drive
itself. It resides in a different portion of the actual processing world overall, and I don't want
to get too far into that because that's covered under A+, here at CBT Nuggets, and it's very well
dived into talking about things like Northbridge, Southbridge, and all the like like that. So, we
open up a program like Word, and the program itself, Word.exe, resides, gets put into the
actual RAM itself because it's currently being utilized, and then we open up PowerShell, and then
the PowerShell prompt gets pulled up, not the commands, but the prompt itself gets put into the
actual RAM as well. Now, when you close Word.exe, that doesn't necessarily mean Word.exe is going to
dump out of the RAM. It could be that it still resides there until something else pushes it out,
and once that memory capacity is full, the RAM itself, if there's nothing open or if there's
something that is not open that has been closed earlier, it's going to get pushed out in preference
for all the things that are currently being called upon and open at that time. Now, yes, I am
oversimplifying this a lot, and we've covered some of this earlier in the course when we went into
things like buffer overflow, where a buffer overflow is where the RAM is not only just this
one continuous cup that we're waiting to fill up. It's broken down into different segments, sectors,
and, you know, just portions of memory that are dedicated in these predefined chunks based on
your operating system and hardware that have portions of programs in them or portions of
memory usage in them. In a buffer overflow, what it does is sends a command usually full of zeros or
nops and makes the cup overflow and fill either into another storage container or just go out
altogether and cause that program or data inside that buffer to either break or allow us to be able
to slip in a command through the fact that it's now open. And again, still oversimplifying everything,
but I wanted to kind of make sure that we understood the basics of what it is that we're
dealing with when we're talking about memory exploits. Because it can be confused with the
fact that we're going in on the actual hard drive and messing with files and programs,
but that's not the case. We're actually taking a look at this from attacking the memory of the
actual system itself. And we're going to be diving deeper into the understanding of all this here in
the beginning of this skill. And then as we continue throughout, we'll do a couple of examples and
get a little bit behind the scenes as far as what we can do with that memory once we
have access to it or if we just want to go ahead and break it.