Spartacus Toolkit

Spartacus can generate Visual Studio skeleton projects to create proxy DLLs. It supports two main approaches:

1. Simple Redirection: Redirects all exported functions back to the legitimate DLL. Payloads must be executed from DllMain.
2. Ghidra-powered Proxying: Uses Ghidra to extract function signatures. This allows you to execute payloads from specific proxied functions (e.g., GetFileVersionInfoExW) instead of relying on DllMain.

Usage Examples:

Simple redirection (no function proxying):

--mode proxy --dll C:\Windows\System32\version.dll --solution "C:\data\tmp\refactor-version" --overwrite --verbose --external-resources

Advanced proxying with Ghidra: Extract signatures to create proxy functions for as many functions as possible.

--mode proxy --ghidra C:\ghidra\support\analyzeHeadless.bat --dll C:\Windows\System32\userenv.dll --solution C:\Projects\spartacus-userenv --overwrite --verbose

Proxy specific functions only:

--mode proxy --ghidra C:\ghidra\support\analyzeHeadless.bat --dll C:\Windows\System32\version.dll --solution C:\Projects\spartacus-version --verbose --overwrite --external-resources --only "GetFileVersionInfoExW, GetFileVersionInfoExA"

Manage function prototypes: Generate a prototype database from .h files to assist Ghidra:

--mode proxy --action prototypes --path "C:\Program Files (x86)\Windows Kits" --csv C:\data\prototypes.csv --verbose

Spartacus provides a sign mode to facilitate the creation of self-signed certificates and the subsequent signing of compiled DLLs or executables. This is useful for bypassing certain security checks during hijacking research.

Generate a self-signed certificate

Use --action generate to create a .pfx certificate. You can use --copy-from <path> to automatically copy the Issuer and Subject from an existing signed file (e.g., a system DLL) to make the new certificate appear more legitimate.

Sign a file

Use --action sign to sign a target file using a previously generated .pfx certificate. You can specify the hashing algorithm using --algorithm (e.g., SHA256).

# Generate a self-signed certificate copying metadata from an existing file
--mode sign --action generate --pfx "C:\Output\myCertificate.pfx" --password "Welcome1" --not-before "2023-01-01 00:00:04" --not-after "2025-01-01 00:00:42" --copy-from C:\Windows\System32\version.dll --verbose

# Sign a compiled DLL with the certificate
--mode sign --action sign --pfx "C:\Output\myCertificate.pfx" --password "Welcome1" --path "C:\Projects\Spartacus-AMSI\amsi.dll" --algorithm SHA256 --verbose

Spartacus supports two methods for finding COM hijacking vulnerabilities:

1. Log Parsing: Parses ProcMon logs to find missing registry keys ending in InprocServer32 that result in NAME_NOT_FOUND. If the key is under HKEY_CURRENT_USER, it attempts to find the associated GUID in HKEY_CLASSES_ROOT.
2. Local System Scanning: Scans the registry (HKEY_CLASSES_ROOT, HKEY_CURRENT_USER, HKEY_LOCAL_MACHINE) for keys like InProcServer, InProcServer32, LocalServer, or LocalServer32 that have missing EXE/DLL locations or insecure ACLs (e.g., user-writable).

Usage Examples:

Collect events from ProcMon:

--mode com --procmon C:\SysInternals\Procmon.exe --pml C:\Data\logs.pml --csv C:\Data\VulnerableCOM.csv --verbose

Parse existing PML logs:

--mode com --existing --pml C:\Data\logs.pml --csv C:\Data\VulnerableCOM.csv --verbose

Scan local registry for misconfigurations:

--mode com --acl --csv C:\Data\VulnerableCOM.csv --verbose

Spartacus can automate the discovery of DLL hijacking vulnerabilities by parsing SysInternals Process Monitor (ProcMon) logs.

Workflow:

1. Spartacus generates a ProcMon configuration file.
2. It executes ProcMon and waits for user input.
3. You run or terminate processes to trigger DLL loading attempts.
4. Press ENTER to stop ProcMon.
5. Spartacus parses the resulting .pml file to identify NAME_NOT_FOUND or PATH_NOT_FOUND events, compares them to actually loaded DLLs, and generates Visual Studio solutions for proxying the identified vulnerable DLLs.

Usage Examples:

Collect new events: Save events to a specific PML file and output results to CSV and Visual Studio solutions.

--mode dll --procmon C:\SysInternals\Procmon.exe --pml C:\Data\logs.pml --csv C:\Data\VulnerableDLLFiles.csv --solution C:\Data\Solutions --verbose

Parse existing logs: Process an existing .pml file to find vulnerabilities and generate solutions.

--mode dll --existing --pml C:\MyData\SomeBackup.pml --csv C:\Data\VulnerableDLLFiles.csv --solution C:\Data\Solutions --verbose