DOCSEARCHbyAlgolia
Submit Docs

DLL Hijacking Scanner

repository·main·Indexed 42 days ago

https://github.com/secuproject/dllhijackingscanner

A Proof of Concept (PoC) tool for bypassing User Account Control (UAC) by exploiting DLL hijacking vulnerabilities in Windows 'Trusted Directories'. It includes DLLHijacking.exe for scanning vulnerable PE and DLL combinations and CsvToHeader.py for converting CSV candidate lists into C++ header files.

Tokens
1.1K
Snippets
5
Records
7
Agent score
5%

What's inside DLL Hijacking Scanner

  1. Understand the test.dll exploit verification

    main

    The test.dll is a sample dynamic library used to verify if the UAC bypass works. When loaded by a hijacked process, it creates a file at C:\ProgramData\exploit.txt containing:

    • 0 or 1 (indicating success/failure)
    • The executable name
    • The DLL name

    This file is automatically deleted once the exploit process completes.

  2. Run the DLLHijacking.exe scanner

    main

    The DLLHijacking.exe tool generates a list of vulnerable PE and DLL combinations by attempting to exploit UAC via DLL hijacking.

    Workflow:

    1. Creates a fake directory in C:\windows\system32.
    2. Copies the target executable and your custom DLL into that directory.
    3. Triggers the target executable.
    4. Cleans up the fake directory and files.
    5. Checks for success by inspecting C:\ProgramData\exploit.txt.

    Execution: Run the executable with the path to your custom DLL as an argument. If no argument is provided, it defaults to using the embedded test.dll.

    Output: Results are logged to exploitable.log in CSV format: [SuccessStatus],[ExecutableName],[DLLName] (where 1 is success and 0 is failure).

    DLLHijacking.exe [DLL_PATH]

  3. Generate a header file from a CSV using CsvToHeader.py

    main

    The CsvToHeader.py script converts a CSV file containing DLL hijacking candidates into a C++ header file.

    By default, it uses dll_hijacking_candidates.csv. For each Portable Executable (PE) in the CSV, the script verifies:

    1. The PE exists on the file system.
    2. The PE manifest requestedExecutionLevel is set to asInvoker, highestAvailable, or requireAdministrator.
    3. The PE manifest autoElevate is set to true.
    4. (Optional) If the -c flag is used, it verifies if the target DLL is present in the PE's import table.

    To generate the header file, redirect the script output to a .h file.

    python CsvToHeader.py > dll_hijacking_candidates.h

  4. How the DLL hijacking exploit mechanism works

    main

    The scanner tests for DLL hijacking vulnerabilities by simulating a UAC bypass attempt using a fake directory structure. The process follows these steps:

    1. Environment Setup: It creates fake directories C:\Windows \ and C:\Windows \System32 to exploit Windows search order behavior.
    2. File Deployment: It copies a target executable (from its internal list) and the target DLL into the fake System32 directory.
    3. Triggering: It uses ShellExecuteExA with the runas verb to attempt to execute the target executable with elevated privileges.
    4. Verification: It checks for success by looking for a specific log file (C:\ProgramData\exploit.txt) created by the hijacked process, which confirms both administrative privileges were obtained and the specific DLL/EXE pair was successfully loaded.
    5. Cleanup: It removes the fake directories and files to restore the system state.

  5. Reference the exploitable.log format

    main

    The DLLHijacking.exe tool generates a log file named exploitable.log. Each line follows this format:

    [SuccessIndicator],[ExecutableName],[DLLName]

    • SuccessIndicator: 1 if the UAC bypass was successful, 0 otherwise.
    • ExecutableName: The name of the tested PE.
    • DLLName: The name of the DLL used for hijacking.

    Example:

    1,computerdefaults.exe,PROPSYS.dll
0,computerdefaults.exe,Secur32.dll
    1,computerdefaults.exe,PROPSYS.dll
0,computerdefaults.exe,Secur32.dll

  6. Reference the CsvToHeader.py CLI arguments

    main

    The CsvToHeader.py script accepts the following arguments:

    • -f [DLL_PATH]: Path of the CSV file to convert (default is dll_hijacking_candidates.csv).
    • -c: Enable checking if the DLL is imported in the PE (default is False).
    • -h, --help: Show this help message and exit.
    • -v, --version: Show program's version number and exit.
    python .	extbackslash CsvToHeader.py -h

  7. Use the DLLHijacking scanner CLI

    main

    The DLLHijacking.exe tool scans for vulnerable PE files and DLLs that are susceptible to DLL hijacking for UAC bypass.

    Usage:

    DLLHijacking.exe [DLL_PATH]

    Arguments:

    • [DLL_PATH] (Optional): The path to a specific DLL you want to test for hijacking vulnerabilities. If omitted, the scanner uses its internal list of target DLLs.

    Output:

    • The tool prints a banner and progress to the console.
    • It identifies vulnerable pairs in the format: [*] Vulnerable: <exeName> -> <dllName>.
    • A summary of the test results is written to exploitable.log in the current working directory. The log format is IsRunAsAdmin,exeName,dllName (where IsRunAsAdmin is 1 if successful, 0 otherwise).
    • A final summary shows the number of vulnerable targets found versus total tests performed.
    DLLHijacking.exe [DLL_PATH]