This is a PoC for bypassing UAC using DLL hijacking and abusing the “Trusted Directories” verification.
The python script CsvToHeader.py
can be used to generate a header file. By default it will use the CSV file dll_hijacking_candidates.csv
that can be found here: dll_hijacking_candidates.csv.
The script will check for each portable executable(PE) the following condition:
asInvoker
highestAvailable
requireAdministrator
<autoElevate>true</autoElevate>
-c
argument, the script will check if the DLL to hijack is in the list of DLLs imported form PE table.> python .CsvToHeader.py -h
usage: CsvToHeader.py -f [DLL_PATH] -c
CsvToHeader can be used to generate a header file from a CSV.
optional arguments:
-h, --help show this help message and exit
-f [DLL_PATH] Path of the csv to convert (default="dll_hijacking_candidates.csv")
-c Enable import dll in PE (default=False)
-v, --version Show program's version number and exit
To generate the header file you can use the following command:
python CsvToHeader.py > dll_hijacking_candidates.h
The files that will be used are DLLHijacking.exe
and test.dll
.
DLLHijacking.exe is the file that will be used to generate the list of vulnerable PE. It will perform the following steps:
CreateFakeDirectory
Function that create a directory in C:windows system32
.
Copy Files in the new directory
C:windowssystem32[TARGET.EXE]
to C:windows system32[TARGET.EXE]
[CUSTOM_DLL_PATH]
to C:windows system32[TARGET.DLL]
Trigger
Run the executable from C:windows system32[TARGET.EXE]
CleanUpFakeDirectory
Function that delete the directory created in step 1 and files from step 2.
CheckExploit
Check the content of the file C:ProgramDataexploit.txt
to see if the exploit was successful.
DLLHijacking.exe will always generate a log file exploitable.log
with the following content:
E.g.
1,computerdefaults.exe,PROPSYS.dll
0,computerdefaults.exe,Secur32.dll
Command to run:
DLLHijacking.exe [DLL_PATH]
if no argument is passed, the script will use the DLL test.dll
which is stored in the resouce of DLLHijacking.exe
.
Tested on Windows 10 Pro (10.0.19043 N/A Build 19043).
test.dll
is a simple dynamic library that will be use to see if the exploit is successfully. The DLL will create a file C:ProgramDataexploit.txt
with the following content:
This file will be deleted once the exploit is complete.
This project is made for educational and ethical testing purposes only. Usage of this software for attacking targets without prior mutual consent is illegal.
It is the end user's responsibility to obey all applicable local, state and federal laws.
Developers assume no liability and are not responsible for any misuse or damage caused by this program.
Write a AI detection pass, persuasive, cickable, catchy, well structured and seo optimized article with… Read More
AI Will Make Human Art More Valuable AI models are increasing in popularity and value… Read More
UK Set to Announce Ban on TikTok on Government Smartphones: Report Following in the footsteps… Read More
How ChatGPT and Generative AI Could Change the Way We Travel The travel industry is… Read More
The curious case of Pluto! Is it a dwarf planet, comet or an asteroid? This… Read More
A Spy Wants to Connect with You on LinkedIn: How to Spot and Avoid Fake… Read More
Leave a Comment