DLLHijackTest

Blogpost

• https://posts.specterops.io/automating-dll-hijack-discovery-81c4295904b0

Usage

• Use Procmon to obtain a CSV file of potential DLL hijacks
• Modify

  outputFile

  variable within

  write.cpp

• Build the project for the appropriate architecture
• Open

  powershell.exe

  and load

  Get-PotentialDLLHijack.ps1

  into memory

  • . .\Get-PotentialDLLHijack.ps1

• Run

  Get-PotentialDLLHijack

  with the appropriate flags
  • Example:

    • Get-PotentialDLLHijack -CSVPath .\Logfile.CSV -MaliciousDLLPath .\DLLHijackTest.dll -ProcessPath "C:\Users\John\AppData\Local\Programs\Microsoft VS Code\Code.exe"

  • -CSVPath

    takes in a path to a .csv file exported from Procmon

  • -MaliciousDLLPath

    takes in a path to your compiled hijack DLL

  • -ProcessPath

    takes in a path to the executable you want to run

  • -ProcessArguments

    takes in commandline arguments you want to pass to the executeable
• View the contents of

  outputFile

  for found DLL hijacks
  • Run

    strings.exe

    on the

    outputFile

    to clean up the output paths
• Party!!!