DLLHijackingScanner: bypassing UAC using DLL hijacking and abusing the “Trusted Directories” verification
UAC bypass – DLL hijacking
This is a PoC for bypassing UAC using DLL hijacking and abusing the “Trusted Directories” verification.
Generate Header from CSV
The python script CsvToHeader.py can be used to generate a header file. By default, it will use the CSV file dll_hijacking_candidates.csv that can be found here: dll_hijacking_candidates.csv.
The script will check for each portable executable(PE) the following condition:
- If the PE exists in the file system.
- In the manifest of the PE, if the requestedExecutionLevel is set to one of the following values:
- asInvoker
- highestAvailable
- requireAdministrator
- In the manifest, if the autoElevate is set to true:
<autoElevate>true</autoElevate>
- If the user-specified the -c argument, the script will check if the DLL to hijack is in the list of DLLs imported from the PE table.
Arguments
To generate the header file you can use the following command:
python CsvToHeader.py > dll_hijacking_candidates.h
Generate the list of vulnerable PE and DLL
The files that will be used are DLLHijacking.exe and test.dll.
DLLHijacking.exe
DLLHijacking.exe is the file that will be used to generate the list of vulnerable PE. It will perform the following steps:
- CreateFakeDirectory
A function that creates a directory in C:\windows \system32.
- Copy Files in the new directory
- from C:\windows\system32\[TARGET.EXE] to C:\windows \system32\[TARGET.EXE]
- from [CUSTOM_DLL_PATH] to C:\windows \system32\[TARGET.DLL]
- Trigger
Run the executable from C:\windows \system32\[TARGET.EXE]
- CleanUpFakeDirectory
A function that deletes the directory created in step 1 and files from step 2.
- CheckExploit
Check the content of the file C:\ProgramData\exploit.txt to see if the exploit was successful.
Log file
DLLHijacking.exe will always generate a log file exploitable.log with the following content:
- 0 or 1 to indicate whether the exploit was able to bypass the UAC.
- The executable name
- The dll name
E.g.
1,computerdefaults.exe,PROPSYS.dll 0,computerdefaults.exe,Secur32.dll
Execution
Command to run:
DLLHijacking.exe [DLL_PATH]
if no argument is passed, the script will use the DLL test.dll which is stored in the resource of DLLHijacking.exe.
Result
Tested on Windows 10 Pro (10.0.19043 N/A Build 19043).
test.dll
test.dll is a simple dynamic library that will be used to see if the exploit is successful. The DLL will create a file C:\ProgramData\exploit.txt with the following content:
- 0 or 1 to indicate whether the exploit was able to bypass the UAC.
- The executable name
- The DLL name
This file will be deleted once the exploit is complete.
Download
Copyright (C) 2021 SecuProject
