Koppeling - Adaptive DLL Hijacking / Dynamic Export Forwarding


This project is a demonstration of advanced DLL hijack techniques. It was released in conjunction with the "Adaptive DLL Hijacking" blog post. I recommend you start there to contextualize this code.

This project is comprised of the following elements:

  • Harness.exe: The "victim" application which is vulnerable to hijacking (static/dynamic)
  • Functions.dll: The "real" library which exposes valid functionality to the harness
  • Theif.dll: The "evil" library which is attempting to gain execution
  • NetClone.exe: A C# application which will clone exports from one DLL to another
  • PyClone.py: A python 3 script which mimics NetClone functionality

The VS solution itself supports 4 build configurations which map to 4 different methods of proxying functionality. This should provide a nice scalable way of demonstrating more techniques in the future.

  • Stc-Forward: Forwards export names during the build process using linker comments
  • Dyn-NetClone: Clones the export table from functions.dll onto theif.dll post-build using NetClone
  • Dyn-PyClone: Clones the export table from functions.dll onto theif.dll post-build using PyClone
  • Dyn-Rebuild: Rebuilds the export table and patches linked import tables post-load to dynamically prepare for function proxying

The goal of each technique is to successfully capture code execution while proxying functionality to the legitimate DLL. Each technique is tested to ensure static and dynamic sink situations are handled. This is by far not every primitive or technique variation. The post above goes into more detail.


Example

Prepare a hijack scenario with an obviously incorrect DLL

> copy C:\windows\system32\whoami.exe .\whoami.exe
        1 file(s) copied.

> copy C:\windows\system32\kernel32.dll .\wkscli.dll
        1 file(s) copied.

Executing in the current configuration should result in an error

> whoami.exe 

"Entry Point Not Found"

Convert kernel32 to proxy functionality for wkscli

> NetClone.exe --target C:\windows\system32\kernel32.dll --reference C:\windows\system32\wkscli.dll --output wkscli.dll
[+] Done.

> whoami.exe
COMPUTER\User

More articles
  1. Hackrf Tools
  2. Hacker Hardware Tools
  3. Easy Hack Tools
  4. Nsa Hack Tools Download
  5. Nsa Hack Tools
  6. Pentest Tools Github
  7. Hacking Tools For Games
  8. Pentest Tools Review
  9. Hacker Tools Hardware
  10. Pentest Tools For Android
  11. Best Hacking Tools 2020
  12. Hacking Tools Hardware
  13. Hacking Tools Pc
  14. World No 1 Hacker Software
  15. Pentest Reporting Tools
  16. Usb Pentest Tools
  17. Hacker Tools Github
  18. Pentest Tools For Windows
  19. Pentest Tools Nmap
  20. Pentest Tools Website
  21. New Hack Tools
  22. Ethical Hacker Tools
  23. Hackers Toolbox
  24. Hack Tools
  25. What Is Hacking Tools
  26. Hack And Tools
  27. Pentest Tools Review
  28. Computer Hacker
  29. Pentest Tools Online
  30. Hacking Tools Mac
  31. Hacker Tools For Ios
  32. Pentest Tools Apk
  33. Hacker Tools Windows
  34. Pentest Tools Kali Linux
  35. Termux Hacking Tools 2019
  36. Pentest Tools Kali Linux
  37. Pentest Tools For Android
  38. Pentest Box Tools Download
  39. Hacking Tools For Pc
  40. Tools For Hacker
  41. Hack Website Online Tool
  42. Pentest Tools Online
  43. Hackrf Tools
  44. Hacking Tools For Windows 7
  45. Pentest Tools Github
  46. Hacker Tools Windows
  47. Termux Hacking Tools 2019
  48. Hacking Tools Github
  49. Hacking Tools Software
  50. Hacker Tools For Windows
  51. Hack Tools Github
  52. Nsa Hack Tools Download
  53. Pentest Tools Download
  54. Hack Tools Mac
  55. How To Hack
  56. Hack Tool Apk
  57. Pentest Tools Url Fuzzer
  58. Pentest Tools Bluekeep
  59. Hack Tools For Games
  60. Hacker
  61. Usb Pentest Tools
  62. Hacking Tools
  63. Hack Tools For Games
  64. Hacking Tools Online
  65. Hack Tools Online
  66. Pentest Tools Apk
  67. Hack Apps
  68. Pentest Tools For Android
  69. Hacking Tools 2019
  70. Android Hack Tools Github
  71. Hacker Tools For Pc
  72. Best Pentesting Tools 2018
  73. Pentest Tools Nmap
  74. Pentest Reporting Tools
  75. Hacking Tools 2019
  76. Hacker Search Tools
  77. Hacker Tools 2020
  78. Black Hat Hacker Tools
  79. Hacker Hardware Tools
  80. Hack Tools Github
  81. Usb Pentest Tools
  82. Hacking Tools Pc
  83. Hacking Tools Name
  84. Hacking Tools
  85. Pentest Tools For Mac
  86. Hacking Tools Kit
  87. Hacker Tools Free
  88. Hacking Tools 2020
Posted by

No comments:

Post a Comment

Subscribe to: Post Comments (Atom)