a Hacker's Backdoor: Service Control Manager

00:00 - SCManager Persistence
00:27 - Explaination
01:21 - How it works
05:18 - Demo begin
08:00 - Changing security descriptor
12:12 - Creating a service
16:18 - Final Thoughts

🔥 YOUTUBE ALGORITHM ➡ Like, Comment, & Subscribe!

[DarkFaken]

These videos are always a great way to learn something without too much detail that I lose interest. Thanks for making such helpful content

[chrisweaver]

Found this the other day on linkedin and was dismissed as it needing admin, however this has been informative! thanks!

[perryuploads]

Information about access control list (ACL). Thanks John!

An access control list (ACL) is a list of access control entries (ACE). Each ACE in an ACL identifies a trustee and specifies the access rights allowed, denied, or audited for that trustee. The security descriptor for a securable object can contain two types of ACLs: a DACL and an SACL.

A discretionary access control list (DACL) identifies the trustees that are allowed or denied access to a securable object. When a process tries to access a securable object, the system checks the ACEs in the object's DACL to determine whether to grant access to it. If the object doesn't have a DACL, the system grants full access to everyone. If the object's DACL has no ACEs, the system denies all attempts to access the object because the DACL doesn't allow any access rights. The system checks the ACEs in sequence until it finds one or more ACEs that allow all the requested access rights, or until any of the requested access rights are denied.

A system access control list (SACL) allows administrators to log attempts to access a secured object. Each ACE specifies the types of access attempts by a specified trustee that cause the system to generate a record in the security event log. An ACE in an SACL can generate audit records when an access attempt fails, when it succeeds, or both.

Don't try to work directly with the contents of an ACL. To ensure that ACLs are semantically correct, use the appropriate functions to create and manipulate ACLs.

ACLs also provide access control to Microsoft Active Directory service objects. Active Directory Service Interfaces (ADSI) include routines to create and modify the contents of these ACLs.

[fraznofire]

Loving these living off the land videos, I'm starting to get more and more into Windows Internals for sysadmin and security, really awesome timing that this video showed up.

[tomasgorda]

Great explanation and also great real example John. Thank you.

[obaidullahnoori]

This video is full of powerful experiences!!! thanks for making such content!

[NahImPro]

John I love your work and you inspire me daily.

[bnkzfp]

i need try it😊 john thank you for tutorial!!

[Polandisch]

I did not understand much honestly.... But great video again! Thanks!

[udotcarter]

For sc sdset should not be as loud based on the parameters provided. So that’s the 3rd layer of detection via winevent logs - cheers! Happy hunting

[sam-urrz]

I'm no cyber security expert but this seems like very overcomplicated UBA... You really have to dedicate yourself to the Microsoft world to fully understand the access control in Windows.

[mmm-cake]

Bravo 👏🏼 Always fantastic content. Does a simple “revert all to defaults, e.g., fresh install” command(s) exist? Appreciate ya!

[dcriley]

John why do you look so happy about this YT Video?

[vinceb]

This video really spoke to me, Ive been working in IT for a few years and am basically a beginner with some novice understanding of Microsoft and barely any knowledge in Linux. Does anyone here have any recommendations on where to start working in security with my profile? Like what courses (paid is fine, or free) should I start in order to get going?

[therealb]

We need a linux version of this. How hackers backdoor into linux desktops please!

[gregsayshi]

Would love to see more videos on MacOS/iOS.. your videos are great but I’m not sure if they apply to me :(

[maddogmaz]

It's all fun and games until the FBI kicks in your door at 4am

[liljoker]

How about making a video explaining how to combatant against this backdoor, and what to do if it has already been executed on your pc?

[jimmyscott]

I love the activate windows water mark lol

[logiciananimal]

Microsoft still says (IIRC) that basically administrators are expected to be able to do this sort of thing, so if such an account is allowed to be run by a malicious actor, that's basically game over. On the other hand, if that's really the expectation, why do they keep trying to stop Mimikatz?