Home

Awesome

DueDLLigence

Shellcode runner framework for application whitelisting bypasses and DLL side-loading. The shellcode included in this project spawns calc.exe.

Authors: Evan Pena (@evan_pena2003), Ruben Boonen (@FuzzySec), Casey Erikson (@EriksocSecurity), Brett Hawkins (@h4wkst3r)

If desired, change the injection type by modifying the following line to the appropriate injection type <br>public const ExecutionMethod method = ExecutionMethod.CreateThread;

Blog Post References: <br>https://www.fireeye.com/blog/threat-research/2019/10/staying-hidden-on-the-endpoint-evading-detection-with-shellcode.html <br>https://www.fireeye.com/blog/threat-research/2020/01/abusing-dll-misconfigurations.html

Running the DLL with the following legitimate exes

Application Whitelisting Bypasses. Lolbins

Control.exe

Export: CPlApplet Syntax: Rename compiled “dll” extension to “cpl” and just double click it! <br>Control.exe [cplfile] <br>Rundll32.exe Shell32.dll, Control_RunDLL [cplfile]

Rasautou

Export: powershell <br>rasautou –d {dllpayload} –p powershell –a a –e e

Msiexec

Export: DllUnregisterServer <br>msiexec /z {full path to msiexec.dll}

DLL Side-Loading Binaries and Details

Tortoise SVN (SubWCRev.exe)

Executable: SubWCRev.exe <br>File Path: C:\Program Files\Tortoise SVN\bin <br>MD5 Hash: c422a95929dd627b4c2be52226287003 <br>DLL == "crshhndl.dll"; Arch == x64; OS == Win7 & 10; <br>Exports: InitCrashHandler,SendReport,IsReadyToExit,SetCustomInfo,AddUserInfoToReport,RemoveUserInfoFromReport,AddFileToReport,RemoveFileFromReport,GetVersionFromApp,GetVersionFromFile

Dism Image Servicing Utility (Dism.exe)

Executable: Dism.exe <br>File Path: C:\Windows\System32 <br>MD5 Hash: 5e70ab0bf74bba785b83da53a3056a21 <br>DLL == "DismCore.dll"; Arch == x64; OS == Win7 & 10; <br>Export: DllGetClassObject

PotPlayerMini

Executable: PotPlayer.exe <br>File Path: {Installation Directory} <br>MD5 Hash: f16903b2ff82689404f7d0820f461e5d <br>DLL == "PotPlayer.dll"; Arch == x86; <br>Exports: PreprocessCmdLineExW,UninitPotPlayer,CreatePotPlayerExW,DestroyPotPlayer,SetPotPlayRegKeyW,RunPotPlayer

Credit for the DueDLLigence name goes to Paul Sanders (@saul_panders)