Rattler: Automated DLL Enumerator– Identifying/Exploiting DLL Preloading Vulnerabilities
Introduction
By Chris Le Roy (@brompwnie) chris@sensepost.com
Rattler is a tool that automates the identification of DLL’s which can be used for DLL preloading attacks. More information can be found in this blogpost https://sensepost.com/blog/2016/rattleridentifying-and-exploiting-dll-preloading-vulnerabilities/.
Rattler’s associated research was presented @bsides Cape Town and the talk can be found here, https://www.youtube.com/watch?v=xvluwoPM8v8.
What does it do?
Rattler automatically enumerates an applications DLL’s to identify and exploit DLL’s which can be hijacked via a DLL preloading attack.
Getting the code
Firstly get the code:
Building the code
Rattler was developed using C++ with Microsoft Visual Studio 2015 using the default console application project settings.
Getting the binaries
Rattler compiled binaries can be found in the Releases section, https://github.com/sensepost/rattler/releases.
Usage
Depending on the target executable location, Rattler may need to be run with elevated permissions.
ratter_32.exe “c:\path\to\target\application.exe” 1
- “c:\path\to\target\application.exe” =path to the executable you want to enumerate.
- 1 = Enumeration mode, only one at this point.
