DLL Hollowing

Deep dive into a stealthier DLL hollowing/memory allocation variant.

https://www.secforce.com/blog/dll-hollowing-a-deep-dive-into-a-stealthier-memory-allocation-variant/

#malware #dll #hollowing

UAC bypass - DLL hijacking

This is a PoC for bypassing UAC using DLL hijacking and abusing the "Trusted Directories" verification.

https://github.com/SecuProject/DLLHijackingScanner

#uac #bypass #dll #hijacking

WindowsDllsExport

A list of all the DLLs export in C:\windows\system32\
The idea is to find some interesting export that can be used to evade some detection.

https://github.com/Mr-Un1k0d3r/WindowsDllsExport

#winapi #dll #exports #pentest #redteam

Process Injection via KernelCallBackTable

Process injection via the KernelCallBackTable involves replacing original callback function by custom payload so that whenever the function is invoked, payload will be triggered. In this case the fnCOPYDATA callback function has been used.

C# Code Snippet:
https://gist.github.com/sbasu7241/5dd8c278762c6305b4b2009d44d60c13

#edr #evasion #dll #injection #kernelcallbacktable

LdrLoadDll-Unhooking

https://github.com/trickster0/LdrLoadDll-Unhooking

#edr #evasion #dll #cpp

📌 Save the Environment

Many applications appear to rely on Environment Variables such as %SYSTEMROOT% to load DLLs from protected locations.
By changing these variables on process level, it is possible to let a legitimate program load arbitrary DLLs.

Research:
https://www.wietzebeukema.nl/blog/save-the-environment-variables

Source Code:
https://github.com/wietze/windows-dll-env-hijacking

#maldev #dll #hijacking #environment

​​​⚛️ AtomLdr

A DLL loader with advanced evasive.

Features:
• DLL unhooking from \KnwonDlls\ directory, with no RWX sections
• The encrypted payload is saved in the resource section and retrieved via custom code
• AES256-CBC Payload encryption using custom no table/data-dependent branches using ctaes; this is one of the best custom AES implementations I've encountered
• Indirect syscalls, utilizing HellHall with ROP gadgets
• Payload injection using APC calls - alertable thread
• Api hashing using two different implementations of the CRC32 string hashing algorithm
• The total Size is 17kb

https://github.com/NUL0x4C/AtomLdr

#loader #dll #edr #evasion #redteam

🔑 KeePass2: DLL Hijacking and Hooking API

This new article about a way to get the Master Password of a KeePass database.

https://skr1x.github.io/keepass-dll-hijacking/

#keepass #dll #hijacking #redteam

👻 Ghost in the PPL: BYOVDLL

This blog post explores bypassing LSA Protection in Userland through the "Bring Your Own Vulnerable DLL" (BYOVDLL) technique. It also delves into the successful exploitation of vulnerabilities in the CNG Key Isolation service and the methods employed to load vulnerable DLLs within protected processes.

🔗 Source:
https://itm4n.github.io/ghost-in-the-ppl-part-1/

#lsa #lsass #ppl #dll #maldev

👻 Ghost in the PPL Part 2: From BYOVDLL to Arbitrary Code Execution in LSASS

In this second installment, the author deepens the exploration of techniques for bypassing LSASS protection, focusing on arbitrary code execution by refining the PoC, exploiting vulnerabilities like CVE-2023-28229, and bypassing Control Flow Guard (CFG) through RPC-based process handle duplication.

🔗 Source:
https://itm4n.github.io/ghost-in-the-ppl-part-2/

#lsa #lsass #ppl #dll #maldev

👻 Ghost in the PPL Part 3: LSASS Memory Dump

In the third part of the series, the author explores methods for dumping the memory of LSASS, including indirectly calling MiniDumpWriteDump, loading arbitrary DLLs into LSASS via the WinSock2 Autodial feature, and dynamically resolving addresses.

🔗 Source:
https://itm4n.github.io/ghost-in-the-ppl-part-3/

#lsa #lsass #ppl #dll #maldev

🚀 Elevating Privileges in Windows via Activation Cache Poisoning

A deep dive into CVE-2024-6769, which leverages two chained bugs to escalate privileges from medium to high integrity. The first stage involves remapping the root drive, followed by a DLL hijacking exploit. The second stage poisons the Activation Cache through the CSRSS process to gain full administrator access.

🔗 Research:
https://www.coresecurity.com/core-labs/articles/cve-2024-6769-poisoning-activation-cache-elevate-medium-high-integrity

🔗 Source:
https://github.com/fortra/CVE-2024-6769

#windows #privesc #dll #hijacking