Koppeling - Adaptive DLL Hijacking / Dynamic Export Forwarding

This project is a demonstration of advanced DLL hijack techniques. It was released in conjunction with the "Adaptive DLL Hijacking" blog post. I recommend you start there to contextualize this code.

This project is comprised of the following elements:

Harness.exe: The "victim" application which is vulnerable to hijacking (static/dynamic)
Functions.dll: The "real" library which exposes valid functionality to the harness
Theif.dll: The "evil" library which is attempting to gain execution
NetClone.exe: A C# application which will clone exports from one DLL to another
PyClone.py: A python 3 script which mimics NetClone functionality

The VS solution itself supports 4 build configurations which map to 4 different methods of proxying functionality. This should provide a nice scalable way of demonstrating more techniques in the future.

Stc-Forward: Forwards export names during the build process using linker comments
Dyn-NetClone: Clones the export table from functions.dll onto theif.dll post-build using NetClone
Dyn-PyClone: Clones the export table from functions.dll onto theif.dll post-build using PyClone
Dyn-Rebuild: Rebuilds the export table and patches linked import tables post-load to dynamically prepare for function proxying

The goal of each technique is to successfully capture code execution while proxying functionality to the legitimate DLL. Each technique is tested to ensure static and dynamic sink situations are handled. This is by far not every primitive or technique variation. The post above goes into more detail.

Example

Prepare a hijack scenario with an obviously incorrect DLL

> copy C:\windows\system32\whoami.exe .\whoami.exe
        1 file(s) copied.

> copy C:\windows\system32\kernel32.dll .\wkscli.dll
        1 file(s) copied.

Executing in the current configuration should result in an error

> whoami.exe 

"Entry Point Not Found"

Convert kernel32 to proxy functionality for wkscli

> NetClone.exe --target C:\windows\system32\kernel32.dll --reference C:\windows\system32\wkscli.dll --output wkscli.dll
[+] Done.

> whoami.exe
COMPUTER\User

Download Koppeling

Go Macro Bars

Go Macro Energy Bars - In fact, brown rice syrup weighs more than a lot of the opposite ingredients in these bars. So regardless that the bars comprise more oats and nuts by quantity, brown rice syrup must be listed first because it weighs more. As a side observe, I like firms that give again to society. I used to be given the opportunity to strive their three new bar flavors (despatched to me by GoMacro). It was also shocking, since these bars usually are not as candy as many other bars in the marketplace. Plus, a portion of the proceeds from their Everlasting Joy Bars goes towards feeding the homeless. It appears that evidently by regulation substances have to be listed so as of weight, and brown rice syrup could be very dense. And GoMacro selects one taste every quarter to highlight as their "Give Back Bar." They donate 10% of the gross sales of that bar to a non-revenue group. Nevertheless, I was concerned that brown rice syrup is the first ingredient in most o...

ANESTHESIOLOGIE REANIMATION HAITI (HUEH)

Rechercher dans ce blog

Koppeling - Adaptive DLL Hijacking / Dynamic Export Forwarding

More articles

Commentaires

Enregistrer un commentaire

Posts les plus consultés de ce blog

Joyeuses fetes

آفرینک | تماشای آنلاین انیمیشن و کارتون

Go Macro Bars