No description, website, or topics provided.
Switch branches/tags
Nothing to show
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Failed to load latest commit information.
asm_code32
asm_code64
.gitignore
cmake.bat
cmakelists.txt
defs.h
ldrdebug.c
main.c
manifest.manifest
readme.md
redirecteddll.c
sxsoaps.c
sxstypes.h

readme.md

Hook ActivationContext

This is simple tool to hook and force process to load redirected DLL.

To build and test code you will need Visual Studio Build tools 2013, 2015 or 2017, either standalone or one integrated with Visual Studio, and cmake:

Code is manipulating Activation Context DLL redirection in 2 ways. One method would be to fake AssemblyDirectory to point to the fake folder where you would store your fake DLL. For this attack sxsoaps.dll is used which is at the same time present in the SystemDefaultActivationContextData.

Another attack is to add new DLL redirection which will cause call LoadLibrary("meh.dll") to load redirecteddll.dll, and this attack can be used against the remote process to fake path of a system dll. In this case I chose to attack advapi32.dll loading.

Of course, next steps would be COM redirection for example, or window class hijacking, but that can be left as an exercise.

Code also gives ability to debug child process with --debug flag.

actctx.exe --debug

This will cause process to run in infinite loop at the LdrInitializeThunk thus debugger can be attached and ActivationContext data parsing can be debugged if needed.

Similar code for LdrDebug break you may find at ReWolf's code repository if you intend to do stand alone debugging from the very start of the process.