Kali Linux

DLLHijackingScanner : This Is A PoC For Bypassing UAC Using DLL Hijacking And Abusing The “Trusted Directories” Verification

DLLHijackingScanner is a PoC for bypassing UAC using DLL hijacking and abusing the “Trusted Directories” verification.

Generate Header from CSV

The python script CsvToHeader.py can be used to generate a header file. By default it will use the CSV file dll_hijacking_candidates.csv that can be found here: dll_hijacking_candidates.csv.

The script will check for each portable executable(PE) the following condition:

  • If the PE exists in the file system.
  • In the manifest of the PE, if the requestedExecutionLevel is set to one of the following values:
    • asInvoker
    • highestAvailable
    • requireAdministrator
  • In the manifest if the autoElevate is set to true:<autoElevate>true</autoElevate>
  • If the user specified the -c argument, the script will check if the DLL to hijack is in the list of DLLs imported form PE table.

Arguments

python .\CsvToHeader.py -h
usage: CsvToHeader.py -f [DLL_PATH] -c
CsvToHeader can be used to generate a header file from a CSV.
optional arguments:
-h, –help show this help message and exit
-f [DLL_PATH] Path of the csv to convert (default=”dll_hijacking_candidates.csv”)
-c Enable import dll in PE (default=False)
-v, –version Show program’s version number and exit

To generate the header file you can use the following command:

python CsvToHeader.py > dll_hijacking_candidates.h

Generate the list of vulnerable PE and DLL

The files that will be used are DLLHijacking.exe and test.dll.

DLLHijacking.exe

DLLHijacking.exe is the file that will be used to generate the list of vulnerable PE. It will perform the following steps:

  1. CreateFakeDirectoryFunction that create a directory in C:\windows \system32.
  2. Copy Files in the new directory
    • from C:\windows\system32\[TARGET.EXE] to C:\windows \system32\[TARGET.EXE]
    • from [CUSTOM_DLL_PATH] to C:\windows \system32\[TARGET.DLL]
  3. TriggerRun the executable from C:\windows \system32\[TARGET.EXE]
  4. CleanUpFakeDirectoryFunction that delete the directory created in step 1 and files from step 2.
  5. CheckExploitCheck the content of the file C:\ProgramData\exploit.txt to see if the exploit was successful.

Log file

DLLHijacking.exe will always generate a log file exploitable.log with the following content:

  • 0 or 1 to indicates whether the exploit was able to bypass the UAC.
  • The executable name
  • The dll name

E.g.

1,computerdefaults.exe,PROPSYS.dll
0,computerdefaults.exe,Secur32.dll

Execution

Command to run:

DLLHijacking.exe [DLL_PATH]

if no argument is passed, the script will use the DLL test.dll which is stored in the resouce of DLLHijacking.exe.

Result

Tested on Windows 10 Pro (10.0.19043 N/A Build 19043).

test.dll

test.dll is a simple dynamic library that will be use to see if the exploit is successfully. The DLL will create a file C:\ProgramData\exploit.txt with the following content:

  • 0 or 1 to indicates whether the exploit was able to bypass the UAC.
  • The executable name
  • The DLL name

This file will be deleted once the exploit is complete.

R K

Recent Posts

Nmap cheat sheet for beginners

Nmap (Network Mapper) is a free tool that helps you find devices on a network,…

16 hours ago

Understanding the Model Context Protocol (MCP) and How It Works

Introduction to the Model Context Protocol (MCP) The Model Context Protocol (MCP) is an open…

1 week ago

The file Command – Quickly Identify File Contents in Linux

While file extensions in Linux are optional and often misleading, the file command helps decode what a…

1 week ago

How to Use the touch Command in Linux

The touch command is one of the quickest ways to create new empty files or update timestamps…

1 week ago

How to Search Files and Folders in Linux Using the find Command

Handling large numbers of files is routine for Linux users, and that’s where the find command shines.…

1 week ago

How to Move and Rename Files in Linux with the mv Command

Managing files and directories is foundational for Linux workflows, and the mv (“move”) command makes it easy…

1 week ago