Friday, June 2, 2023

Koppeling - Adaptive DLL Hijacking / Dynamic Export Forwarding


This project is a demonstration of advanced DLL hijack techniques. It was released in conjunction with the "Adaptive DLL Hijacking" blog post. I recommend you start there to contextualize this code.

This project is comprised of the following elements:

  • Harness.exe: The "victim" application which is vulnerable to hijacking (static/dynamic)
  • Functions.dll: The "real" library which exposes valid functionality to the harness
  • Theif.dll: The "evil" library which is attempting to gain execution
  • NetClone.exe: A C# application which will clone exports from one DLL to another
  • PyClone.py: A python 3 script which mimics NetClone functionality

The VS solution itself supports 4 build configurations which map to 4 different methods of proxying functionality. This should provide a nice scalable way of demonstrating more techniques in the future.

  • Stc-Forward: Forwards export names during the build process using linker comments
  • Dyn-NetClone: Clones the export table from functions.dll onto theif.dll post-build using NetClone
  • Dyn-PyClone: Clones the export table from functions.dll onto theif.dll post-build using PyClone
  • Dyn-Rebuild: Rebuilds the export table and patches linked import tables post-load to dynamically prepare for function proxying

The goal of each technique is to successfully capture code execution while proxying functionality to the legitimate DLL. Each technique is tested to ensure static and dynamic sink situations are handled. This is by far not every primitive or technique variation. The post above goes into more detail.


Example

Prepare a hijack scenario with an obviously incorrect DLL

> copy C:\windows\system32\whoami.exe .\whoami.exe
1 file(s) copied.

> copy C:\windows\system32\kernel32.dll .\wkscli.dll
1 file(s) copied.

Executing in the current configuration should result in an error

> whoami.exe 

"Entry Point Not Found"

Convert kernel32 to proxy functionality for wkscli

> NetClone.exe --target C:\windows\system32\kernel32.dll --reference C:\windows\system32\wkscli.dll --output wkscli.dll
[+] Done.

> whoami.exe
COMPUTER\User



Related word


  1. Hacking Tools For Kali Linux
  2. Hacking Tools For Pc
  3. Hacking Tools Pc
  4. Free Pentest Tools For Windows
  5. Hacker Techniques Tools And Incident Handling
  6. Pentest Tools List
  7. Hacking Tools For Windows 7
  8. Hacker Tools For Windows
  9. Beginner Hacker Tools
  10. Pentest Tools Subdomain
  11. Pentest Tools Url Fuzzer
  12. Hacker Tools For Ios
  13. Pentest Tools Nmap
  14. Hacking Tools Mac
  15. Hacker Tools Hardware
  16. Tools For Hacker
  17. Underground Hacker Sites
  18. Hacking App
  19. Computer Hacker
  20. Hack Tools For Mac
  21. Tools For Hacker
  22. Hacking Tools And Software
  23. Hacker Tools Free
  24. Hack Tools For Pc
  25. Hack Tools Pc
  26. Easy Hack Tools
  27. Pentest Tools List
  28. Hack App
  29. Hack Tools For Ubuntu
  30. Nsa Hack Tools Download
  31. Hacking Tools For Windows Free Download
  32. Hack Tool Apk No Root
  33. Kik Hack Tools
  34. Hacking Tools Name
  35. Hacker Tools Online
  36. How To Make Hacking Tools
  37. What Are Hacking Tools
  38. Hack Tools
  39. Growth Hacker Tools
  40. Pentest Tools Windows
  41. World No 1 Hacker Software
  42. Hacks And Tools
  43. Pentest Tools Download
  44. Hacker Tools For Mac
  45. Pentest Tools Website Vulnerability
  46. Install Pentest Tools Ubuntu
  47. Ethical Hacker Tools
  48. Pentest Tools Alternative
  49. Pentest Tools Find Subdomains
  50. Best Hacking Tools 2020
  51. Game Hacking
  52. Hack Tool Apk
  53. Hacking Tools Mac
  54. Hacker Security Tools
  55. Ethical Hacker Tools
  56. Hack App
  57. New Hacker Tools
  58. Kik Hack Tools
  59. Hacking Tools
  60. Hacking Tools Software
  61. Pentest Tools Subdomain
  62. Hacker Tools Hardware
  63. Pentest Tools For Windows
  64. Beginner Hacker Tools
  65. Hacker Tools
  66. New Hacker Tools
  67. Hackrf Tools
  68. Hacker Hardware Tools
  69. Top Pentest Tools
  70. Hacking Tools And Software
  71. Pentest Tools Tcp Port Scanner
  72. Hack Tools 2019
  73. Hacker Tools Free Download
  74. Best Hacking Tools 2020
  75. Hacking Tools For Windows Free Download
  76. Ethical Hacker Tools
  77. Hacking Tools And Software
  78. Usb Pentest Tools
  79. Termux Hacking Tools 2019
  80. Pentest Tools Apk
  81. Pentest Tools Apk
  82. Hacker
  83. Wifi Hacker Tools For Windows
  84. Pentest Tools Android
  85. Hack App
  86. Hack Tools For Windows
  87. Hacker Tools For Mac
  88. How To Install Pentest Tools In Ubuntu
  89. Pentest Tools Tcp Port Scanner
  90. Hacking Tools Name
  91. Hacker Security Tools
  92. Pentest Tools Kali Linux
  93. Free Pentest Tools For Windows
  94. Game Hacking
  95. Hacker
  96. Hacking App
  97. Easy Hack Tools
  98. Hacking Tools Hardware
  99. Pentest Tools Bluekeep
  100. Hack Website Online Tool
  101. Hacking Tools Free Download
  102. Pentest Box Tools Download
  103. Hack Tools Download
  104. Hacker Tools Github
  105. Hackers Toolbox
  106. Hack Tools Pc
  107. World No 1 Hacker Software
  108. Hacker Tools For Windows
  109. Blackhat Hacker Tools
  110. Hack Rom Tools
  111. Pentest Tools Android
  112. Hack Tools 2019
  113. Easy Hack Tools
  114. Pentest Tools Kali Linux
  115. Hack Apps
  116. Hacking Tools 2019
  117. Pentest Tools For Ubuntu
  118. Pentest Tools Bluekeep
  119. Hacking App
  120. Hacker Tools Hardware
  121. Hacker Tools 2019
  122. Nsa Hack Tools
  123. Hack Tools For Ubuntu
  124. Hacking Tools Name
  125. Usb Pentest Tools
  126. Pentest Tools Free
  127. Hacking Tools For Windows
  128. Install Pentest Tools Ubuntu
  129. Pentest Tools Port Scanner
  130. Pentest Tools Apk

No comments: