VX Heaven

Library Collection Sources Engines Constructors Simulators Utilities Links Forum

DLL Hijacking in antiviruses

Inception #1 (EN)

[Back to index] [Comments]

Hey there!

We are going to talk about DLL Hijacking here (with examples of this attack) in the context of antiviruses. This text represents observations and should be considered as such. Obviously, if this information is all too simple and familiar to you, let's call it a beginner guide =)

DLL Hijacking - is referred to as DLL substitution. Many programs, when calling the LoadLibrary(char *) function, transmit the file name as a parameter, rather than the full way to it. That way, you can substitute one library being uploaded for any other one. This has to do with the search of the DLL beginning in the directory that contains the calling EXE-file. In this case the substituted DLL is launched with the same privileges as the running process.

For AV, like for any other software, this attack technique can (and should) be used. Clearly, as a result of a successful attack, our code is working in a proxy application, has the same privileges and can do whatever it wants.

So let’s divide AVs by self-defense into 2 groups:

For instance, Comodo (AV/IS v5.10) belongs to the first group. (Unfortunately), applications that are not in the proxy list can’t harm any data in the AV’s folder so easily. However, it’s possible to copy your files there. While superficially analyzing some of the Comodo's components, I discovered a significant number of LoadLibrary calls for files missing from the specified directory (and the entire axis as well). All we need to do is upload our own library with a specific name in the required folder and enjoy the result (a restart may be needed). For example, we have the following directory:

"C:\Program Files\COMODO\COMODO Internet Security\themes"

(default path) – comodo keeps tonalities there, which represent life PE-files:

"black.theme" (etc (HIEW)): 
| Number |   Name   |    VirtSize   |   RVA        |   PhysSize    |    Offset     |   Flags       |
| 1      |   .rsrc  |    0006AB68h  |   00001000h  |   0006AC00h   |    00000200h  |   40000040h   |

Algorithm of their hook-up is:

    0046AA33  |.  E8 4D040900   CALL cavscan.004FAE85                    ; \ FindFirstFileW
    0046AA38  |.  8945 D8       MOV DWORD PTR SS:[EBP-28],EAX
    0046AA3B  |.  C645 FC 01    MOV BYTE PTR SS:[EBP-4],1
    0046AA3F  |.  8D4D CC       LEA ECX,DWORD PTR SS:[EBP-34]
    0046AA42  |.  E8 E988F9FF   CALL cavscan.00403330
    0046AA47  |   837D D8 00    /CMP DWORD PTR SS:[EBP-28],0             ;   cycle: loadind of themes
    0046AA4B  |.  74 6B         |JE SHORT cavscan.0046AAB8
    0046AA4D  |.  8D4D DC       |LEA ECX,DWORD PTR SS:[EBP-24]
    0046AA50  |.  E8 EA010900   |CALL cavscan.004FAC3F                   ;   FindNextFileW
    0046AA55  |.  8945 D8       |MOV DWORD PTR SS:[EBP-28],EAX
    0046AA58  |.  8D4D DC       |LEA ECX,DWORD PTR SS:[EBP-24]
    0046AA5B  |.  E8 4E030900   |CALL cavscan.004FADAE
    0046AA60  |.  85C0          |TEST EAX,EAX
    0046AA62  |.  75 52         |JNZ SHORT cavscan.0046AAB6
    0046AA64  |.  8D4D DC       |LEA ECX,DWORD PTR SS:[EBP-24]
    0046AA67  |.  E8 D4ECFEFF   |CALL cavscan.00459740
    0046AA6C  |.  85C0          |TEST EAX,EAX
    0046AA6E  |.  75 46         |JNZ SHORT cavscan.0046AAB6
    0046AA70  |.  8D55 C8       |LEA EDX,DWORD PTR SS:[EBP-38]
    0046AA73  |.  52            |PUSH EDX
    0046AA74  |.  8D4D DC       |LEA ECX,DWORD PTR SS:[EBP-24]
    0046AA77  |.  E8 08060900   |CALL cavscan.004FB084                   ;   gluing strings
    0046AA7C  |.  8945 B4       |MOV DWORD PTR SS:[EBP-4C],EAX
    0046AA7F  |.  8B45 B4       |MOV EAX,DWORD PTR SS:[EBP-4C]
    0046AA82  |.  8945 B0       |MOV DWORD PTR SS:[EBP-50],EAX
    0046AA85  |.  C645 FC 03    |MOV BYTE PTR SS:[EBP-4],3
    0046AA89  |.  8B4D B0       |MOV ECX,DWORD PTR SS:[EBP-50]
    0046AA8C  |.  E8 EFA8FCFF   |CALL cavscan.00435380
    0046AA91  |.  50            |PUSH EAX                                ; /Arg2
    0046AA92  |.  8B4D 08       |MOV ECX,DWORD PTR SS:[EBP+8]            ; |
    0046AA95  |.  51            |PUSH ECX                                ; |Arg1
    0046AA96  |.  8B4D C0       |MOV ECX,DWORD PTR SS:[EBP-40]           ; |
    0046AA99  |.  E8 42020000   |CALL cavscan.0046ACE0                   ; \ ... LoadLibraryW
    0046AA9E  |.  0FB6D0        |MOVZX EDX,AL
    0046AAA1  |.  0FB645 D7     |MOVZX EAX,BYTE PTR SS:[EBP-29]
    0046AAA5  |.  0BC2          |OR EAX,EDX
    0046AAA7  |.  8845 D7       |MOV BYTE PTR SS:[EBP-29],AL
    0046AAAA  |.  C645 FC 01    |MOV BYTE PTR SS:[EBP-4],1
    0046AAAE  |.  8D4D C8       |LEA ECX,DWORD PTR SS:[EBP-38]
    0046AAB1  |.  E8 7A88F9FF   |CALL cavscan.00403330
    0046AAB6  | ^ EB 8F         \JMP SHORT cavscan.0046AA47
    0046AAB8  |   8A4D D7       MOV CL,BYTE PTR SS:[EBP-29]


    005A7328     \53            PUSH EBX                                 ; /FileName
    005A7329   .  FF15 FCE46800 CALL DWORD PTR DS:[KERNEL32.LoadLibrar   ; \LoadLibraryW
    005A732F   .  8946 28       MOV DWORD PTR DS:[ESI+28],EAX

During work of antivirus a color schemes can be loaded / unloaded several times:

Thus, rename your dll, for example, in "shit.theme" and throws in a folder with the themes. Comodo of sucks.

Second group - KIS/NOD32/DrWeb/etc. For example, NOD32 (AV/SS v5.2). His directory write-protected etc. But and here was detected a code of dynamic loading "ppeset.dll" (read docs "plugin for cisco nac") in service "ekrn.exe">:

    0040205F  |.  68 ECFA4A00   PUSH ekrn.004AFAEC                       ; /FileName="ppeset.dll"
    00402064  |.  FF15 80124A00 CALL DWORD PTR DS:[KERNEL32.LoadLibrar   ; \LoadLibraryW
    0040206A  |.  8BF8          MOV EDI,EAX
    0040206C  |.  85FF          TEST EDI,EDI
    0040206E  |.  74 19         JE SHORT ekrn.00402089
    00402070  |.  68 04FB4A00   PUSH ekrn.004AFB04                       ; /ProcName="DllRegisterServer"
    00402075  |.  57            PUSH EDI                                 ; |hModule
    00402076  |.  FF15 88124A00 CALL DWORD PTR DS:[KERNEL32.GetProcAdd   ; \GetProcAddress
    0040207C  |.  85C0          TEST EAX,EAX
    0040207E  |.  74 02         JE SHORT ekrn.00402082
    00402080  |.  FFD0          CALL EAX
    00402082  |   57            PUSH EDI                                 ; /hLibModule
    00402083  |.  FF15 78124A00 CALL DWORD PTR DS:[KERNEL32.FreeLibrar   ; \FreeLibrary
    00402089  |   8B0D 646B4C00 MOV ECX,DWORD PTR DS:[4C6B64]

This library wasn’t found in this whole OS with default AV’s settings.

We can bypass nod32 in this way:

After restarting the system, our library will be added, it will call the function DllRegisterServer() and unload from the address area (AA) of the "ekrn.exe" process.

There’s one more thing: if any of the AV processes created, say, a dialog box to open files ("Open"/"Save"/etc), then we can move our files through this dialog box even to directories protected by antivirus ("Action Via Window" attack - why the hell not). Such dialog boxes are created with the help of GetOpenFileName / GetSaveFileName functions, which belong to the “Comdlg32.dll” library. This library is running in the AA process of AV, which is considered to be a proxy and has admin rights or higher.

The algorithm of running this attack can be:

  1. launch our process;
  2. monitor windows for a dialog box to open the files;
  3. when this dialog box appears, we will know which process it belongs to and will know its current folder;
  4. if the current directory is what we needed (AV’s protected folder), we should check if our file (with a specific name) is there. Found it? – Ok, now get to point [6], otherwise - [5]. If the current directory doesn’t match – then you need point [2];
  5. copy/move your file to Clipboard (CB), run the dialog box found and press "Ctrl + V";
  6. our program is shutting down;

It’s all great, but many of the moves mentioned above will most certainly not run on Windows Vista / 7 because of the fucking UAC..

As you know, when the uac is enabled, most applications will launch with default user rights (even if the user works from an admin account). You can't really change various system parameters (copying / pasting / etc the file to system directory, changing the environment variables of the system, injects into the processes and / or transferring window messages to them (UIPI protection) with higher Integrity Level etc etc - all that is unavailable).

The most obvious solution is to upgrade the rights related to bypassing controls.

So, bypass can be divided into 2 types: active (uac dialog box does not appear) and passive (does appear).

The following will belong to the active type:

Passive type:

It's pretty clear that in a generic case, an active attack is more efficient: we make a breach and make stuff happen. However, a passive one also has pretty good chances – we will never teach users to read =)

As you see, everything is possible, just go for it!

[email protected] / [email protected]
Inception E-Zine
[Back to index] [Comments]
By accessing, viewing, downloading or otherwise using this content you agree to be bound by the Terms of Use! aka