Windows Feature Hunter: dynamic instrumentation toolkit

by do son · July 3, 2021

Windows Feature Hunter (WFH)

Windows Feature Hunter (WFH) is a proof of concept python script that uses Frida, a dynamic instrumentation toolkit, to assist in potentially identifying common “vulnerabilities” or “features” within Windows executables. WFH currently has the capability to automatically identify potential Dynamic Linked Library (DLL) sideloading and Component Object Model (COM) hijacking opportunities at scale.

DLL sideloading utilizes the Windows side-by-side (WinSXS) assembly to load a malicious DLL from the side-by-side (SXS) listing. COM hijacking allows an adversary to insert malicious code that can be executed in place of legitimate software through hijacking the COM references and relationships. WFH will print the potential vulnerabilities and write a CSV file containing the potential vulnerabilities in the target Windows executables.

Install

git clone https://github.com/ConsciousHacker/WFH.git
cd WFH
pip install -r requirements.txt

Use

Example

DLL Sideloading Identification

First, you need to copy the binaries you want to analyze to the same directory as wfh

PS C:\Tools\WFH > copy C:\Windows\System32\mspaint.exe .

PS C:\Tools\WFH > copy C:\Windows\System32\charmap.exe .

PS C:\Tools\WFH > dir





    Directory: C:\Tools\WFH





Mode                 LastWriteTime         Length Name

----                 -------------         ------ ----

d-----         5/14/2021   2:12 PM                .vscode

-a----          5/6/2021   2:39 PM           1928 .gitignore

-a----         12/7/2019   2:09 AM         198656 charmap.exe

-a----         5/18/2021   7:39 AM           6603 loadlibrary.js

-a----          4/7/2021  12:48 PM         988160 mspaint.exe

-a----         5/18/2021   7:53 AM           8705 README.md

-a----         5/17/2021  11:27 AM           5948 registry.js

-a----          5/6/2021   2:41 PM             11 requirements.txt

-a----         5/18/2021   8:35 AM          10623 wfh.py

Now you can run wfh against the binaries to identify dll sideloading opportunities

If you prefer more verbose output, you can use “-v” to see every message from Frida instrumenting the Windows API calls. You can also view this output in the raw log file.

COM Hijacking Identification

Use Cases

Native Windows Signed Binaries

Copy all native Windows signed binaries to the wfh directory

Get-ChildItem c:\ -File | ForEach-Object { if($_ -match ‘.+?exe$’) {Get-AuthenticodeSignature $_.fullname} } | where {$_.IsOSBinary} | ForEach-Object {Copy-Item $_.path . }

Hunt for DLL sideloading opportunities