Hacking Articles Tips Tricks Videos Tutorials

Kali Linux Tutorials
DLLHijackingScanner : This Is A PoC For Bypassing UAC Using DLL Hijacking And Abusing The “Trusted Directories” Verification

DLLHijackingScanner is a PoC for bypassing UAC using DLL hijacking and abusing the “Trusted Directories” verification.

Generate Header from CSV

The python script CsvToHeader.pycan be used to generate a header file. By default it will use the CSV file dll_hijacking_candidates.csvthat can be found here: dll_hijacking_candidates.csv.

The script will check for each portable executable(PE) the following condition:

* If the PE exists in the file system.
* In the manifest of the PE, if the requestedExecutionLevel is set to one of the following values:
* asInvoker* highestAvailable* requireAdministrator* In the manifest if the autoElevate is set to true:-cargument, the script will check if the DLL to hijack is in the list of DLLs imported form PE table. Arguments

python .\CsvToHeader.py -h
usage: CsvToHeader.py -f [DLL_PATH] -c
CsvToHeader can be used to generate a header file from a CSV.
optional arguments:
-h, –help show this help message and exit
-f [DLL_PATH] Path of the csv to convert (default=”dll_hijacking_candidates.csv”)
-c Enable import dll in PE (default=False)
-v, –version Show program’s version number and exit

To generate the header file you can use the following command:

python CsvToHeader.py > dll_hijacking_candidates.h

Generate the list of vulnerable PE and DLL

The files that will be used are DLLHijacking.exeand test.dll. DLLHijacking.exe

DLLHijacking.exe is the file that will be used to generate the list of vulnerable PE. It will perform the following steps:

1. CreateFakeDirectoryFunction that create a directory in C:\windows \system32.
2. Copy Files in the new directory
* from C:\windows\system32\[TARGET.EXE]to C:\windows \system32\[TARGET.EXE]* from [CUSTOM_DLL_PATH]to C:\windows \system32\[TARGET.DLL]3. TriggerRun the executable from C:\windows \system32\[TARGET.EXE]4. CleanUpFakeDirectoryFunction that delete the directory created in step 1 and files from step 2.
5. CheckExploitCheck the content of the file C:\ProgramData\exploit.txtto see if the exploit was successful. Log file

DLLHijacking.exe will always generate a log file exploitable.logwith the following content:

* 0 or 1 to indicates whether the exploit was able to bypass the UAC.
* The executable name
* The dll name

E.g.

1,computerdefaults.exe,PROPSYS.dll
0,computerdefaults.exe,Secur32.dll

Execution

Command to run:

DLLHijacking.exe [DLL_PATH]

if no argument is passed, the script will use the DLL test.dllwhich is stored in the resouce of DLLHijacking.exe. Result

Tested on Windows 10 Pro (10.0.19043 N/A Build 19043).
https://blogger.googleusercontent.com/img/a/AVvXsEiH4CQZD8WvsyXwvSMwXQfrzu3c1scnLR2gTwjWfwdX_LJmLqZerXD4dfEslwcP-22FrSRo4eKPhHl3iBvEwbJVbRpSjPkxak5pNQN5ZLrILVl32tTutPzaL7jQj9ik9H0ADFsB669iaFXCmVf4H4a7EHgiwd5RkgIcm35m49J_ZHKpGWSShC_1L82i=s979
test.dll test.dllis a simple dynamic library that will be use to see if the exploit is successfully. The DLL will create a file C:\ProgramData\exploit.txtwith the following content:

* 0 or 1 to indicates whether the exploit was able to bypass the UAC.
* The executable name
* The DLL name

This file will be deleted once the exploit is complete. Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials

DLLHijackingScanner : This Is A PoC For Bypassing UAC

DLLHijackingScanner is a PoC for bypassing UAC using DLL hijacking and abusing the "Trusted Directories" verification.

7 viewsedited 09:59

Hacking Articles Tips Tricks Videos Tutorials

7 views09:59

Hacking Articles Tips Tricks Videos Tutorials

Photo

Kali Linux Tutorials
IDA2Obj : Static Binary Instrumentation

IDA2Obj is a tool to implement SBI (Static Binary Instrumentation).

The working flow is simple:

* Dump object files (COFF) directly from one executable binary.
* Link the object files into a new binary, almost the same as the old one.
* During the dumping process, you can insert any data/code at any location.
* SBI is just one of the using scenarios, especially useful for black-box fuzzing.
How To Use

* Prepare the enviroment:
* Set AUTOIMPORT_COMPAT_IDA695 = YESin the idapython.cfgto support the API with old IDA 6.x style.
* Install dependency: pip install cough

* Create a folder as the workspace.
* Copy the target binary which you want to fuzz into the workspace.
* Load the binary into IDA Pro, choose Load resources and manually load to load all the segments from the binary.
* Wait for the auto-analysis done.
* Dump object files by running the script MagicIDA/main.py.
* The output object files will be inside ${workspace}/${module}/objs/afl.
* If you create an empty file named TRACE_MODEinside the workspace, then the output object files will be inside ${workspace}/${module}/objs/trace.
* By the way, it will also generate 3 files inside ${workspace}/${module}:
* exports_afl.def (used for linking)
* exports_trace.def (used for linking)
* hint.txt (used for patching)
* Generate lib files by running the script utils/LibImports.py.
* The output lib files will be inside ${workspace}/${module}/libs, used for linking later.

* Open a terminal and change the directory to the workspace.
* Link all the object files and lib files by using utils/link.bat.
* e.g. utils/link.bat GdiPlus dll afl /RELEASE
* It will generate the new binary with the pdb file inside ${workspace}/${module}.

* Patch the new built binary by using utils/PatchPEHeader.py.
* e.g. utils/PatchPEHeader.py GdiPlus/GdiPlus.afl.dll
* For the first time, you may need to run utils/register_msdia_run_as_administrator.batas administrator.

* Run & Fuzz.
Download

___________________________
@hacking_Attack
@Hacking_Video