DLL Sideloading
Вставка
- Опубліковано 9 вер 2024
- In this Video I'm explaining DLL Sideloading and show you how to find vulnerable applications + create your own custom DLLs to "exploit" it.
4:20 - Start, Introduction
8:22 - How to find vulnerable binaries with Siofra
13:15 - Building a DLL in Nim
18:14 - Checking Exposed functions with dllexp
22:11 - Checking Imports with DumpBin
23:39 - Checking Imports with PEStudio
26:10 - Using NetClone to Clone DLL Imports for Sideloading
31:11 - SideLoading version.dll into OneDrive.exe
35:30 - Checking Chrome for Sideloading
40:05 - Automatically generate Sideloading Payload with NimSyscallLoader
42:45 - Sideload chrome_elf.dll into Chrome.exe
44:00 - Adding custom export functions to our Nim DLL
48:55 - Sideload custom chrome_elf.dll into Chrome.exe
57:20 - Recommendations for building a Sideloading Payload DLL
1:05:00 - Building a Meterpreter Sideloading DLL with NimSyscallPacker
1:09:15 - Getting a Meterpreter Callback via Sideloading without detections
1:10:30 - Checking memory regions for MSF
Links:
Koppeling:
github.com/mon...
Scan dirs with Siofra:
/ 1
Siofra:
github.com/Cyb...
NimSyscallPacker:
/ 1482428360500383755
PeStudio:
www.winitor.co...
DllExp:
www.nirsoft.ne...
Nim:
nim-lang.org/i...
Nim DLL template:
github.com/S3c...
this is really cool +++++
woah man it worked for me fine. thanks for the tut, please drop more videos like this one! :)
fantastic work .
Cool video! thank you
Dude I use the same one for my Payloads!! Lol Nice work!!
yay he is back
Nice video i'm big fan
Nice!!
awesome work sponsored
How would you go about detecting sideloading dll's if you were thinking from a defender's perspective?
typically to detect hijacked DLLs you'll need to check the task manager's flow, if the malware hooks the ntQuerySystemIinformation function then you have to monitor the network through wireshark for any suspecious running apps since it has no API to abused.
What injection technique are you using ?